Indirect Prompt Injection Defense on ICLR Academic Reviews 84 defensive payloads / 252 prompts 2026
100Defense Success Rate (DSR)Layer Cake
Evaluation Results
| Method | Links | |
|---|---|---|
| Layer CakeChatbot Setting=Qwen Chat (v1), Strategy=Explicit2026.05 | 100 | |
| Layer CakeChatbot Setting=Qwen Chat (v2), Strategy=Implicit2026.05 | 100 | |
| Layer CakeChatbot Setting=ChatGPT (v1), Strategy=Implicit2026.05 | 100 | |
| Visual DeceptionChatbot Setting=ChatGPT (v1), Strategy=Implicit2026.05 | 99 | |
| Layer CakeChatbot Setting=Qwen Chat (v1), Strategy=Implicit2026.05 | 98 | |
| Layer CakeChatbot Setting=Kimi, Strategy=Explicit2026.05 | 97 | |
| Visual DeceptionChatbot Setting=Doubao, Strategy=Explicit2026.05 | 95 | |
| Layer CakeChatbot Setting=Kimi, Strategy=Implicit2026.05 | 92 | |
| Layer CakeChatbot Setting=Qwen Chat (v2), Strategy=Explicit2026.05 | 91 | |
| MicroPixelChatbot Setting=Doubao, Strategy=Implicit2026.05 | 89 | |
| Visual DeceptionChatbot Setting=ChatGPT (v1), Strategy=Explicit2026.05 | 86 | |
| Layer CakeChatbot Setting=Doubao, Strategy=Explicit2026.05 | 85 | |
| Visual DeceptionChatbot Setting=Doubao, Strategy=Implicit2026.05 | 83 | |
| Layer CakeChatbot Setting=Doubao, Strategy=Implicit2026.05 | 82 | |
| Layer CakeChatbot Setting=SuperGrok, Strategy=Implicit2026.05 | 78 | |
| IMPDFChatbot Setting=ChatGPT (v2), Strategy=Implicit2026.05 | 77 | |
| MicroPixelChatbot Setting=SuperGrok, Strategy=Implicit2026.05 | 76 | |
| Visual DeceptionChatbot Setting=SuperGrok, Strategy=Implicit2026.05 | 75 | |
| OffPageChatbot Setting=ChatGPT (v1), Strategy=Implicit2026.05 | 73 | |
| MicroPixelChatbot Setting=Doubao, Strategy=Explicit2026.05 | 72 | |
| IMPDFChatbot Setting=Qwen Chat (v1), Strategy=Explicit2026.05 | 70 | |
| IMPDFChatbot Setting=Qwen Chat (v2), Strategy=Implicit2026.05 | 69 | |
| MicroPixelChatbot Setting=Kimi, Strategy=Implicit2026.05 | 63 | |
| IMPDFChatbot Setting=ChatGPT (v1), Strategy=Explicit2026.05 | 62 | |
| IMPDFChatbot Setting=ChatGPT (v1), Strategy=Implicit2026.05 | 62 | |
| OffPageChatbot Setting=ChatGPT (v2), Strategy=Implicit2026.05 | 62 | |
| Layer CakeChatbot Setting=SuperGrok, Strategy=Explicit2026.05 | 62 | |
| Layer CakeChatbot Setting=ChatGPT (v1), Strategy=Explicit2026.05 | 60 | |
| Visual DeceptionChatbot Setting=SuperGrok, Strategy=Explicit2026.05 | 58 | |
| MicroPixelChatbot Setting=Kimi, Strategy=Explicit2026.05 | 58 | |
| OffPageChatbot Setting=SuperGrok, Strategy=Implicit2026.05 | 57 | |
| IMPDFChatbot Setting=Qwen Chat (v2), Strategy=Explicit2026.05 | 54 | |
| Visual DeceptionChatbot Setting=ChatGPT (v2), Strategy=Implicit2026.05 | 52 | |
| SuffixChatbot Setting=Qwen Chat (v2), Strategy=Implicit2026.05 | 51 | |
| IMPDFChatbot Setting=Qwen Chat (v1), Strategy=Implicit2026.05 | 48 | |
| IMPDFChatbot Setting=SuperGrok, Strategy=Implicit2026.05 | 46 | |
| MicroPixelChatbot Setting=ChatGPT (v1), Strategy=Implicit2026.05 | 45 | |
| Visual DeceptionChatbot Setting=ChatGPT (v2), Strategy=Explicit2026.05 | 43 | |
| Layer CakeChatbot Setting=ChatGPT (v2), Strategy=Implicit2026.05 | 42 | |
| Layer CakeChatbot Setting=ChatGPT (v2), Strategy=Explicit2026.05 | 40 | |
| MicroPixelChatbot Setting=SuperGrok, Strategy=Explicit2026.05 | 35 | |
| Visual DeceptionChatbot Setting=Qwen Chat (v1), Strategy=Implicit2026.05 | 33 | |
| MicroPixelChatbot Setting=ChatGPT (v2), Strategy=Implicit2026.05 | 32 | |
| Visual DeceptionChatbot Setting=Qwen Chat (v2), Strategy=Explicit2026.05 | 29 | |
| MicroPixelChatbot Setting=Qwen Chat (v2), Strategy=Implicit2026.05 | 27 | |
| IMPDFChatbot Setting=SuperGrok, Strategy=Explicit2026.05 | 26 | |
| OffPageChatbot Setting=SuperGrok, Strategy=Explicit2026.05 | 26 | |
| MicroPixelChatbot Setting=ChatGPT (v1), Strategy=Explicit2026.05 | 25 | |
| IMPDFChatbot Setting=ChatGPT (v2), Strategy=Explicit2026.05 | 25 | |
| Visual DeceptionChatbot Setting=Qwen Chat (v1), Strategy=Explicit2026.05 | 22 | |
| Visual DeceptionChatbot Setting=Qwen Chat (v2), Strategy=Implicit2026.05 | 22 | |
| OffPageChatbot Setting=ChatGPT (v1), Strategy=Explicit2026.05 | 22 | |
| SuffixChatbot Setting=ChatGPT (v1), Strategy=Implicit2026.05 | 21 | |
| SuffixChatbot Setting=Qwen Chat (v1), Strategy=Implicit2026.05 | 20 | |
| SuffixChatbot Setting=ChatGPT (v1), Strategy=Explicit2026.05 | 20 | |
| Visual DeceptionChatbot Setting=Kimi, Strategy=Explicit2026.05 | 19 | |
| MicroPixelChatbot Setting=ChatGPT (v2), Strategy=Explicit2026.05 | 17 | |
| Visual DeceptionChatbot Setting=Kimi, Strategy=Implicit2026.05 | 13 | |
| SuffixChatbot Setting=ChatGPT (v2), Strategy=Implicit2026.05 | 12 | |
| MicroPixelChatbot Setting=Qwen Chat (v1), Strategy=Implicit2026.05 | 8 | |
| SuffixChatbot Setting=SuperGrok, Strategy=Implicit2026.05 | 8 | |
| SuffixChatbot Setting=Qwen Chat (v1), Strategy=Explicit2026.05 | 5 | |
| SuffixChatbot Setting=ChatGPT (v2), Strategy=Explicit2026.05 | 5 | |
| MicroPixelChatbot Setting=Qwen Chat (v1), Strategy=Explicit2026.05 | 4 | |
| MicroPixelChatbot Setting=Qwen Chat (v2), Strategy=Explicit2026.05 | 4 | |
| SuffixChatbot Setting=Qwen Chat (v2), Strategy=Explicit2026.05 | 3 | |
| OffPageChatbot Setting=Kimi, Strategy=Implicit2026.05 | 3 | |
| SuffixChatbot Setting=SuperGrok, Strategy=Explicit2026.05 | 2 | |
| MetaInjectionChatbot Setting=Qwen Chat (v1), Strategy=Explicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=Qwen Chat (v1), Strategy=Implicit2026.05 | 0 | |
| OffPageChatbot Setting=Qwen Chat (v1), Strategy=Explicit2026.05 | 0 | |
| OffPageChatbot Setting=Qwen Chat (v1), Strategy=Implicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=Qwen Chat (v2), Strategy=Explicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=Qwen Chat (v2), Strategy=Implicit2026.05 | 0 | |
| OffPageChatbot Setting=Qwen Chat (v2), Strategy=Explicit2026.05 | 0 | |
| OffPageChatbot Setting=Qwen Chat (v2), Strategy=Implicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=ChatGPT (v1), Strategy=Explicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=ChatGPT (v1), Strategy=Implicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=ChatGPT (v2), Strategy=Explicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=ChatGPT (v2), Strategy=Implicit2026.05 | 0 | |
| OffPageChatbot Setting=ChatGPT (v2), Strategy=Explicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=SuperGrok, Strategy=Explicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=SuperGrok, Strategy=Implicit2026.05 | 0 | |
| IMPDFChatbot Setting=Kimi, Strategy=Explicit2026.05 | 0 | |
| IMPDFChatbot Setting=Kimi, Strategy=Implicit2026.05 | 0 | |
| SuffixChatbot Setting=Kimi, Strategy=Explicit2026.05 | 0 | |
| SuffixChatbot Setting=Kimi, Strategy=Implicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=Kimi, Strategy=Explicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=Kimi, Strategy=Implicit2026.05 | 0 | |
| OffPageChatbot Setting=Kimi, Strategy=Explicit2026.05 | 0 | |
| IMPDFChatbot Setting=Doubao, Strategy=Explicit2026.05 | 0 | |
| IMPDFChatbot Setting=Doubao, Strategy=Implicit2026.05 | 0 | |
| SuffixChatbot Setting=Doubao, Strategy=Explicit2026.05 | 0 | |
| SuffixChatbot Setting=Doubao, Strategy=Implicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=Doubao, Strategy=Explicit2026.05 | 0 | |
| MetaInjectionChatbot Setting=Doubao, Strategy=Implicit2026.05 | 0 | |
| OffPageChatbot Setting=Doubao, Strategy=Explicit2026.05 | 0 | |
| OffPageChatbot Setting=Doubao, Strategy=Implicit2026.05 | 0 |