# Data Exfiltration via Indirect Prompt Injection on Indirect Prompt Injection Dataset 1.0 (test) Source: [Data Exfiltration via Indirect Prompt Injection on Indirect Prompt Injection Dataset 1.0 (test)]() Collection index: [llms.txt]() Data updated: 2026-04-13T07:20:45.747Z Evaluation of model performance regarding data exfiltration success rates when subjected to indirect prompt injection attacks using the test split of Indirect Prompt Injection Dataset version 1.0. A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Data Exfiltration via Indirect Prompt Injection | | Dataset (including any stated split) | Indirect Prompt Injection Dataset 1.0 (test) | | Metric | Data Exfiltration Success Rate | | Unit | PERCENT | | Direction | Higher is better | | Results loaded | 28 of 28 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [Data Exfiltration Success Rate](): Higher is better; unit: PERCENT. ## Recorded results | Method | Data Exfiltration Success Rate | Result date | Report paper | | --- | --- | --- | --- | | x-ai/grok-4 | 72.4 | Not recorded | 68fa7bff1e209131cea8bc48 | | inception/mercury | 29.1 | Not recorded | 68fa7bff1e209131cea8bc48 | | qwen/qwen3-235b-a22b-2507 | 28.3 | Not recorded | 68fa7bff1e209131cea8bc48 | | meta-llama/llama-4-scout | 14.8 | Not recorded | 68fa7bff1e209131cea8bc48 | | meta-llama/llama-4-maverick | 10.1 | Not recorded | 68fa7bff1e209131cea8bc48 | | qwen/qwen3-32b | 8.2 | Not recorded | 68fa7bff1e209131cea8bc48 | | x-ai/grok-code-fast-1 | 8.2 | Not recorded | 68fa7bff1e209131cea8bc48 | | anthropic/claude-3-haiku | 6 | Not recorded | 68fa7bff1e209131cea8bc48 | | nousresearch/hermes-4-70b | 6 | Not recorded | 68fa7bff1e209131cea8bc48 | | qwen/qwen-2.5-72b-instruct | 5.2 | Not recorded | 68fa7bff1e209131cea8bc48 | | meta-llama/llama-3.3-70b-instruct | 5 | Not recorded | 68fa7bff1e209131cea8bc48 | | x-ai/grok-3-mini | 4.5 | Not recorded | 68fa7bff1e209131cea8bc48 | | z-ai/glm-4-32b | 4.2 | Not recorded | 68fa7bff1e209131cea8bc48 | | deepseek/deepseek-chat-v3.1 | 1.9 | Not recorded | 68fa7bff1e209131cea8bc48 | | google/gemini-2.5-flash-lite | 1.4 | Not recorded | 68fa7bff1e209131cea8bc48 | | deepseek/deepseek-chat-v3-0324 | 1.4 | Not recorded | 68fa7bff1e209131cea8bc48 | | openai/gpt-4.1-nano | 1.2 | Not recorded | 68fa7bff1e209131cea8bc48 | | openai/gpt-oss-20b | 1 | Not recorded | 68fa7bff1e209131cea8bc48 | | mistralai/mistral-small-3.2-24b-instruct | 0.7 | Not recorded | 68fa7bff1e209131cea8bc48 | | google/gemini-flash-1.5-8b | 0.3 | Not recorded | 68fa7bff1e209131cea8bc48 | | google/gemini-2.0-flash-001 | 0.2 | Not recorded | 68fa7bff1e209131cea8bc48 | | nousresearch/hermes-4-405b | 0.1 | Not recorded | 68fa7bff1e209131cea8bc48 | | openai/gpt-oss-120b | 0 | Not recorded | 68fa7bff1e209131cea8bc48 | | openai/gpt-5-nano | 0 | Not recorded | 68fa7bff1e209131cea8bc48 | | amazon/nova-micro-v1 | 0 | Not recorded | 68fa7bff1e209131cea8bc48 | | google/gemini-2.0-flash-lite-001 | 0 | Not recorded | 68fa7bff1e209131cea8bc48 | | anthropic/claude-sonnet-4 | 0 | Not recorded | 68fa7bff1e209131cea8bc48 | | amazon/nova-lite-v1 | 0 | Not recorded | 68fa7bff1e209131cea8bc48 | ### x-ai/grok-4 Data Exfiltration Success Rate: 72.4. Result ID: 69dc994247f34ce924c33152. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### inception/mercury Data Exfiltration Success Rate: 29.1. Result ID: 69dc994247f34ce924c33153. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### qwen/qwen3-235b-a22b-2507 Data Exfiltration Success Rate: 28.3. Result ID: 69dc994247f34ce924c33154. [Reporting paper]() Recorded evaluation configuration: {"parameters":"235.0B"}. This record does not assert independent reproduction. ### meta-llama/llama-4-scout Data Exfiltration Success Rate: 14.8. Result ID: 69dc994247f34ce924c33155. [Reporting paper]() Recorded evaluation configuration: {"parameters":"109.0B"}. This record does not assert independent reproduction. ### meta-llama/llama-4-maverick Data Exfiltration Success Rate: 10.1. Result ID: 69dc994247f34ce924c33156. [Reporting paper]() Recorded evaluation configuration: {"parameters":"402.0B"}. This record does not assert independent reproduction. ### qwen/qwen3-32b Data Exfiltration Success Rate: 8.2. Result ID: 69dc994247f34ce924c33157. [Reporting paper]() Recorded evaluation configuration: {"parameters":"32.8B"}. This record does not assert independent reproduction. ### x-ai/grok-code-fast-1 Data Exfiltration Success Rate: 8.2. Result ID: 69dc994247f34ce924c33158. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### anthropic/claude-3-haiku Data Exfiltration Success Rate: 6. Result ID: 69dc994247f34ce924c33159. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### nousresearch/hermes-4-70b Data Exfiltration Success Rate: 6. Result ID: 69dc994247f34ce924c3315a. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### qwen/qwen-2.5-72b-instruct Data Exfiltration Success Rate: 5.2. Result ID: 69dc994247f34ce924c3315b. [Reporting paper]() Recorded evaluation configuration: {"parameters":"72.7B"}. This record does not assert independent reproduction. ### meta-llama/llama-3.3-70b-instruct Data Exfiltration Success Rate: 5. Result ID: 69dc994247f34ce924c3315c. [Reporting paper]() Recorded evaluation configuration: {"parameters":"70.6B"}. This record does not assert independent reproduction. ### x-ai/grok-3-mini Data Exfiltration Success Rate: 4.5. Result ID: 69dc994247f34ce924c3315d. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### z-ai/glm-4-32b Data Exfiltration Success Rate: 4.2. Result ID: 69dc994247f34ce924c3315e. [Reporting paper]() Recorded evaluation configuration: {"parameters":"32.0B"}. This record does not assert independent reproduction. ### deepseek/deepseek-chat-v3.1 Data Exfiltration Success Rate: 1.9. Result ID: 69dc994247f34ce924c3315f. [Reporting paper]() Recorded evaluation configuration: {"parameters":"685.0B"}. This record does not assert independent reproduction. ### google/gemini-2.5-flash-lite Data Exfiltration Success Rate: 1.4. Result ID: 69dc994247f34ce924c33160. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### deepseek/deepseek-chat-v3-0324 Data Exfiltration Success Rate: 1.4. Result ID: 69dc994247f34ce924c33161. [Reporting paper]() Recorded evaluation configuration: {"parameters":"685.0B"}. This record does not assert independent reproduction. ### openai/gpt-4.1-nano Data Exfiltration Success Rate: 1.2. Result ID: 69dc994247f34ce924c33162. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### openai/gpt-oss-20b Data Exfiltration Success Rate: 1. Result ID: 69dc994247f34ce924c33163. [Reporting paper]() Recorded evaluation configuration: {"parameters":"21.0B"}. This record does not assert independent reproduction. ### mistralai/mistral-small-3.2-24b-instruct Data Exfiltration Success Rate: 0.7. Result ID: 69dc994247f34ce924c33164. [Reporting paper]() Recorded evaluation configuration: {"parameters":"24.0B"}. This record does not assert independent reproduction. ### google/gemini-flash-1.5-8b Data Exfiltration Success Rate: 0.3. Result ID: 69dc994247f34ce924c33165. [Reporting paper]() Recorded evaluation configuration: {"parameters":"8.0B"}. This record does not assert independent reproduction. ### google/gemini-2.0-flash-001 Data Exfiltration Success Rate: 0.2. Result ID: 69dc994247f34ce924c33166. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### nousresearch/hermes-4-405b Data Exfiltration Success Rate: 0.1. Result ID: 69dc994247f34ce924c33167. [Reporting paper]() Recorded evaluation configuration: {"parameters":"406.0B"}. This record does not assert independent reproduction. ### openai/gpt-oss-120b Data Exfiltration Success Rate: 0. Result ID: 69dc994247f34ce924c33168. [Reporting paper]() Recorded evaluation configuration: {"parameters":"117.0B"}. This record does not assert independent reproduction. ### openai/gpt-5-nano Data Exfiltration Success Rate: 0. Result ID: 69dc994247f34ce924c33169. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### amazon/nova-micro-v1 Data Exfiltration Success Rate: 0. Result ID: 69dc994247f34ce924c3316a. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### google/gemini-2.0-flash-lite-001 Data Exfiltration Success Rate: 0. Result ID: 69dc994247f34ce924c3316b. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### anthropic/claude-sonnet-4 Data Exfiltration Success Rate: 0. Result ID: 69dc994247f34ce924c3316c. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### amazon/nova-lite-v1 Data Exfiltration Success Rate: 0. Result ID: 69dc994247f34ce924c3316d. [Reporting paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.