Hidden objective detection on Prompt-Manipulation Out-of-Domain Evaluation Stealth Strategy

100Exit RateGemini-1.5-Flash

Evaluation results

Method
Gemini-1.5-Flash2026.05	100	100	100	58.12	95.9	100	100	100	100	94.89	—
GPT-4o2026.05	100	100	100	8	18.7	100	100	100	88	79.41	—
Gemini-1.5-Flash2026.05	100	100	100	54.2	100	100	100	100	100	94.91	—
Gemini-1.5-Flash2026.05	100	100	100	81.13	100	100	100	100	100	97.9	—
Gemini-3-Flash2026.05	100	100	100	21.82	78.57	100	100	100	100	—	88.93
Gemini-3-Flash2026.05	100	100	100	16.36	90.48	100	100	100	100	—	89.65
CoT-Guard 1.5B2026.05	99.34	94.87	100	60.11	98.12	100	98.7	100	98.22	94.37	—
Qwen2-1.5B2026.05	98.03	87.18	99.61	38.93	93.28	98.2	97.9	98.27	97.63	89.89	—
Gemini-3-Flash2026.05	96.3	100	100	4	4.42	93.75	89.33	96	94.2	—	75.33
Gemini-3-Flash2026.05	96.3	100	100	19.64	45.13	100	100	100	100	—	84.56
GPT-4o-mini2026.05	96	100	97.97	54.02	58.76	99.4	98.6	91.98	92	87.64	—
Qwen2-72B2026.05	93.33	94.87	97.42	24.43	32.62	99.1	97.6	94.64	96.76	81.2	—
CoT-Guard 1.5B2026.05	92.85	84.62	98.44	6.09	18.27	99.12	78.67	75.79	98.22	72.45	—
Gemini-1.5-Flash2026.05	86.67	100	100	0	0.93	100	76.69	94.11	99.47	73.1	—
Qwen2-7B2026.05	86.67	94.87	95.78	12.98	26.74	100	75.9	92.78	85.33	74.56	—
CoT-Guard 4B2026.05	85.6	79.17	88.64	47.85	37.61	80	87.5	84.41	90	—	75.64
CoT-Guard 4B2026.05	85.6	87.5	88.64	37.09	29.58	100	96.9	96.55	83.33	—	78.35
Qwen3-4B2026.05	85.19	70.83	90.91	66.76	35.34	80	98.7	87.26	90	—	78.33
Qwen3-4B2026.05	82.03	91.67	90.91	18.91	22.19	100	91.71	33.47	91.98	—	69.21
Qwen3-8B2026.05	82.03	95.83	91.63	22.25	7.59	90	22.7	65.33	70.34	—	60.86
Qwen3-32B2026.05	81.48	100	92.84	11.78	1.77	93.75	38.75	24	9.81	—	50.46
Qwen2-1.5B2026.05	80.67	92.31	97.67	2.27	6.75	100	67.05	9.63	89.68	60.67	—
GPT-5.42026.05	77.8	100	98.3	0	0	93.8	80	73.33	47.83	—	63.45
Qwen3-32B2026.05	74.9	100	98.33	20	1.77	100	85	85.33	62.22	—	69.73
Qwen3-4B2026.05	74.07	91.67	96.1	19.27	3.37	93.8	61.3	62.67	66.28	—	63.17
Qwen2-1.5B2026.05	67.28	76.65	77.95	16.09	46.18	78.1	60.6	74.55	67.38	62.75	—
Qwen3-4B2026.05	60.63	95.83	95.45	11.78	2.65	93.75	20	2.57	10.14	—	43.64
Qwen2-1.5B2026.05	56	96.43	77.47	7.63	12.43	91.2	42.3	51.3	48.5	53.7	—
GPT-5-mini2026.05	51.85	100	91.67	4	3.54	87.5	64	74.67	44.93	—	58.02
Qwen3-8B2026.05	49.93	95.83	94.47	11.56	3.54	87.5	0	0	30.43	—	41.47
Qwen2-72B2026.05	46	97.44	87.36	0.76	1.32	97.5	4.07	18.87	16.97	41.14	—
Qwen2-1.5B2026.05	40.67	100	98.9	0.76	1.5	99.38	1.89	1.34	11.47	39.55	—
Qwen2-7B2026.05	33.33	97.44	82.97	0.76	2.26	96.88	1.61	0	13.6	36.54	—
GPT-5.42026.05	33.33	100	98.33	0	0	62.5	1.33	0	0	—	32.83
Qwen3-4B2026.05	28.53	93.6	51.67	3.93	1.77	68.8	89.42	25.33	29.42	—	43.61
Llama3.1-8B-Instruct2026.05	21.1	35.8	42.5	10	17.5	36.4	19.1	12.2	30.9	25.06	—
GPT-5-mini2026.05	14.81	93.02	56.67	0	0	68.75	0	0	0	—	25.92
Qwen3-4B2026.05	14.81	83.72	20	0	0	50	85.17	0	1.45	—	28.35
Llama3.1-8B-Instruct2026.05	12.35	20	11.25	14.18	4.17	35	23	14.71	31.45	—	18.46
GPT-4o-mini2026.05	7.33	85.71	29.12	0	0.19	73.12	0	0	0.27	21.75	—
Llama3.1-8B-Instruct2026.05	6.58	0	4.85	2.91	1.56	6.25	21.38	10.11	16.23	—	7.76
Qwen2-1.5B2026.05	4.67	57.14	14.7	0	0	61.33	0.27	0.27	0.53	15.43	—
GPT-4o2026.05	0	100	88.24	0	0	91.67	0	0	0	31.1	—
Llama3.1-8B-Instruct2026.05	0	0	0.3	0.4	0.5	2	0.2	2.7	3.4	1.06	—