End-to-End Defense in RAG on HotpotQA
0Attack Success Rate (ASR)TrustRAG
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| TrustRAGAttack Scenario=GL2026.05 | 0 | 0 | |
| CleanBaseAttack Scenario=GL2026.05 | 0 | 0 | |
| CleanBase + MetaSecAlignAttack Scenario=GL2026.05 | 0 | 0 | |
| Cordon-MASSeed=422026.05 | 0 | — | |
| PromptGuardAttack Scenario=FC2026.05 | 3 | 0 | |
| CleanBaseAttack Scenario=NA2026.05 | 3 | 0 | |
| CleanBase + MetaSecAlignAttack Scenario=NA2026.05 | 3 | 0 | |
| CleanBase + MetaSecAlignAttack Scenario=CI2026.05 | 3 | 0 | |
| PromptGuardAttack Scenario=NA2026.05 | 4 | 0 | |
| PromptGuardAttack Scenario=CI2026.05 | 4 | 0 | |
| PromptGuardAttack Scenario=CA2026.05 | 4 | 0 | |
| PromptGuardAttack Scenario=MA2026.05 | 4 | 0 | |
| PromptGuardAttack Scenario=PB2026.05 | 4 | 0 | |
| CleanBaseAttack Scenario=CI2026.05 | 4 | 0 | |
| CleanBaseAttack Scenario=CA2026.05 | 4 | 0 | |
| CleanBase + MetaSecAlignAttack Scenario=FC2026.05 | 4 | 0.6 | |
| CleanBase + MetaSecAlignAttack Scenario=CA2026.05 | 4 | 0 | |
| CleanBase + MetaSecAlignAttack Scenario=PB2026.05 | 4 | 1 | |
| TrustRAGAttack Scenario=CA2026.05 | 5 | 0.2 | |
| PromptGuardAttack Scenario=GL2026.05 | 5 | 2 | |
| TrustRAGAttack Scenario=FC2026.05 | 6 | 0 | |
| TrustRAGAttack Scenario=MA2026.05 | 6 | 0.6 | |
| TrustRAGAttack Scenario=PT2026.05 | 6 | 0.2 | |
| CleanBaseAttack Scenario=FC2026.05 | 6 | 0.6 | |
| CleanBaseAttack Scenario=PB2026.05 | 6 | 1 | |
| CleanBase + MetaSecAlignAttack Scenario=MA2026.05 | 6 | 1.2 | |
| RobustRAGSeed=422026.05 | 6.1 | — | |
| CleanBaseAttack Scenario=MA2026.05 | 7 | 1.2 | |
| TrustRAGAttack Scenario=NA2026.05 | 8 | 99 | |
| TrustRAGAttack Scenario=PW2026.05 | 8 | 0.8 | |
| TrustRAGAttack Scenario=PB2026.05 | 8 | 0 | |
| TrustRAGAttack Scenario=CI2026.05 | 9 | 0.2 | |
| CleanBaseAttack Scenario=PT2026.05 | 11 | 4 | |
| PromptGuardAttack Scenario=PT2026.05 | 13 | 5 | |
| CleanBase + MetaSecAlignAttack Scenario=PT2026.05 | 13 | 4 | |
| DebateSeed=422026.05 | 16.3 | — | |
| PromptGuardAttack Scenario=PW2026.05 | 18 | 7.8 | |
| DataSentinelAttack Scenario=CA2026.05 | 22 | 11.4 | |
| TrustRAGSeed=422026.05 | 24.5 | — | |
| CleanBase + MetaSecAlignAttack Scenario=PW2026.05 | 27 | 23.8 | |
| CleanBaseAttack Scenario=PW2026.05 | 28 | 23.8 | |
| Vanilla RAGSeed=422026.05 | 28.6 | — | |
| ParaphraseSeed=422026.05 | 30.6 | — | |
| DataSentinelAttack Scenario=CI2026.05 | 35 | 21.2 | |
| DataSentinelAttack Scenario=FC2026.05 | 38 | 26.6 | |
| MetaSecAlignAttack Scenario=NA2026.05 | 39 | 99.8 | |
| MetaSecAlignAttack Scenario=FC2026.05 | 39 | 97.6 | |
| DataSentinelAttack Scenario=MA2026.05 | 44 | 27.4 | |
| DataSentinelAttack Scenario=GL2026.05 | 45 | 31 | |
| MetaSecAlignAttack Scenario=GL2026.05 | 50 | 100 | |
| MetaSecAlignAttack Scenario=MA2026.05 | 53 | 97.2 | |
| MetaSecAlignAttack Scenario=CA2026.05 | 57 | 95.8 | |
| MetaSecAlignAttack Scenario=PT2026.05 | 60 | 98.4 | |
| MetaSecAlignAttack Scenario=CI2026.05 | 61 | 98.2 | |
| No DefenseAttack Scenario=PT2026.05 | 75 | 98.4 | |
| DataSentinelAttack Scenario=NA2026.05 | 77 | 76.8 | |
| DataSentinelAttack Scenario=PT2026.05 | 78 | 97.4 | |
| MetaSecAlignAttack Scenario=PW2026.05 | 79 | 99.2 | |
| DataSentinelAttack Scenario=PW2026.05 | 82 | 89.8 | |
| MetaSecAlignAttack Scenario=PB2026.05 | 83 | 99.8 | |
| No DefenseAttack Scenario=GL2026.05 | 85 | 100 | |
| No DefenseAttack Scenario=CA2026.05 | 89 | 95.8 | |
| No DefenseAttack Scenario=FC2026.05 | 92 | 97.6 | |
| DataSentinelAttack Scenario=PB2026.05 | 92 | 94.4 | |
| No DefenseAttack Scenario=MA2026.05 | 93 | 97.2 | |
| No DefenseAttack Scenario=PW2026.05 | 94 | 99.2 | |
| No DefenseAttack Scenario=NA2026.05 | 95 | 99.8 | |
| No DefenseAttack Scenario=CI2026.05 | 97 | 98.2 | |
| No DefenseAttack Scenario=PB2026.05 | 97 | 99.8 |