Defense against adversarial relinking on RELINK-generated attacks
86.9BAR After Success RatePromptLocate sanitizer
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| PromptLocate sanitizerPlacement=source sanitizer, Device=1 H800-norm.2026.06 | 86.9 | 0 | 97.9 | 1.66 | |
| ShieldGemma-2BPlacement=input filter, Device=1 H8002026.06 | 84.6 | 2.6 | 1.5 | 67.5 | |
| ProtectAI DeBERTa-v2Placement=input filter, Device=1 H8002026.06 | 84.4 | 2.8 | 14.5 | 53.6 | |
| CaMeLPlacement=runtime policy, Device=CPU2026.06 | 79 | 9.1 | 2.7 | 2.55 | |
| Sandwich promptingPlacement=compression prompt2026.06 | 59.6 | 31.4 | — | — | |
| ShieldGemma-9BPlacement=input filter, Device=1 H8002026.06 | 54.9 | 36.8 | 61 | 126.1 | |
| Delimiter promptingPlacement=compression prompt2026.06 | 49.7 | 42.8 | — | — | |
| BIPIA reminderPlacement=compression prompt2026.06 | 41.5 | 52.3 | — | — | |
| SecAlign backendPlacement=backend model2026.06 | 39.7 | 54.3 | — | — | |
| AttnTrace sanitizerPlacement=source sanitizer, Device=1 H800-norm.2026.06 | 16.6 | 80.9 | 78.4 | 6.56 | |
| KBRA-semantic (backend)Placement=backend transition audit, Device=CPU2026.06 | 0.3 | 99.6 | 0.93 | 69.9 | |
| KBRA-semantic (compressed)Placement=compression transition audit, Device=CPU2026.06 | 0.2 | 99.8 | 34.6 | 24 | |
| Llama Prompt Guard 2Placement=input filter, Device=1 H8002026.06 | 0 | 100 | 100 | 64.1 | |
| KBRA-exact (compressed)Placement=compression transition audit, Device=CPU2026.06 | 0 | 100 | 36.3 | 7.7 | |
| KBRA-exact (backend)Placement=backend transition audit, Device=CPU2026.06 | 0 | 100 | 9.2 | 12.5 |