Indirect Prompt Injection on AlpacaFarm (test)
0Attack Success RateDelim.
Evaluation Results
| Method | Links | |
|---|---|---|
| Delim.Backbone=Llama-3.2-3B, Attack=Naive, Adversarial Training=SFT2025.05 | 0 | |
| ISEBackbone=Llama-3.2-3B, Attack=Naive, Adversarial Training=SFT2025.05 | 0 | |
| AIRBackbone=Llama-3.2-3B, Attack=Naive, Adversarial Training=SFT2025.05 | 0 | |
| Delim.Backbone=Llama-3.2-3B, Attack=Naive, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Llama-3.2-3B, Attack=Naive, Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Llama-3.2-3B, Attack=Naive, Adversarial Training=DPO2025.05 | 0 | |
| Delim.Backbone=Llama-3.2-3B, Attack=Ignore, Adversarial Training=SFT2025.05 | 0 | |
| ISEBackbone=Llama-3.2-3B, Attack=Ignore, Adversarial Training=SFT2025.05 | 0 | |
| AIRBackbone=Llama-3.2-3B, Attack=Ignore, Adversarial Training=SFT2025.05 | 0 | |
| Delim.Backbone=Llama-3.2-3B, Attack=Ignore, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Llama-3.2-3B, Attack=Ignore, Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Llama-3.2-3B, Attack=Ignore, Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Llama-3.2-3B, Attack=Completion, Adversarial Training=SFT2025.05 | 0 | |
| Delim.Backbone=Llama-3.2-3B, Attack=Completion, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Llama-3.2-3B, Attack=Completion, Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Llama-3.2-3B, Attack=Completion, Adversarial Training=DPO2025.05 | 0 | |
| Delim.Backbone=Llama-3.2-3B, Attack=Escape Sep., Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Llama-3.2-3B, Attack=Escape Sep., Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Llama-3.2-3B, Attack=Escape Sep., Adversarial Training=DPO2025.05 | 0 | |
| Delim.Backbone=Qwen-2.5-7B, Attack=Naive, Adversarial Training=SFT2025.05 | 0 | |
| AIRBackbone=Qwen-2.5-7B, Attack=Naive, Adversarial Training=SFT2025.05 | 0 | |
| Delim.Backbone=Qwen-2.5-7B, Attack=Naive, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Qwen-2.5-7B, Attack=Naive, Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Qwen-2.5-7B, Attack=Naive, Adversarial Training=DPO2025.05 | 0 | |
| Delim.Backbone=Qwen-2.5-7B, Attack=Ignore, Adversarial Training=SFT2025.05 | 0 | |
| ISEBackbone=Qwen-2.5-7B, Attack=Ignore, Adversarial Training=SFT2025.05 | 0 | |
| AIRBackbone=Qwen-2.5-7B, Attack=Ignore, Adversarial Training=SFT2025.05 | 0 | |
| Delim.Backbone=Qwen-2.5-7B, Attack=Ignore, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Qwen-2.5-7B, Attack=Ignore, Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Qwen-2.5-7B, Attack=Ignore, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Qwen-2.5-7B, Attack=Completion, Adversarial Training=SFT2025.05 | 0 | |
| AIRBackbone=Qwen-2.5-7B, Attack=Completion, Adversarial Training=SFT2025.05 | 0 | |
| Delim.Backbone=Qwen-2.5-7B, Attack=Completion, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Qwen-2.5-7B, Attack=Completion, Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Qwen-2.5-7B, Attack=Completion, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Qwen-2.5-7B, Attack=Escape Sep., Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Qwen-2.5-7B, Attack=Escape Sep., Adversarial Training=DPO2025.05 | 0 | |
| Delim.Backbone=Llama-3.1-8B, Attack=Naive, Adversarial Training=SFT2025.05 | 0 | |
| ISEBackbone=Llama-3.1-8B, Attack=Naive, Adversarial Training=SFT2025.05 | 0 | |
| AIRBackbone=Llama-3.1-8B, Attack=Naive, Adversarial Training=SFT2025.05 | 0 | |
| Delim.Backbone=Llama-3.1-8B, Attack=Naive, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Llama-3.1-8B, Attack=Naive, Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Llama-3.1-8B, Attack=Naive, Adversarial Training=DPO2025.05 | 0 | |
| Delim.Backbone=Llama-3.1-8B, Attack=Ignore, Adversarial Training=SFT2025.05 | 0 | |
| ISEBackbone=Llama-3.1-8B, Attack=Ignore, Adversarial Training=SFT2025.05 | 0 | |
| AIRBackbone=Llama-3.1-8B, Attack=Ignore, Adversarial Training=SFT2025.05 | 0 | |
| Delim.Backbone=Llama-3.1-8B, Attack=Ignore, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Llama-3.1-8B, Attack=Ignore, Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Llama-3.1-8B, Attack=Ignore, Adversarial Training=DPO2025.05 | 0 | |
| Delim.Backbone=Llama-3.1-8B, Attack=Completion, Adversarial Training=SFT2025.05 | 0 | |
| ISEBackbone=Llama-3.1-8B, Attack=Completion, Adversarial Training=SFT2025.05 | 0 | |
| AIRBackbone=Llama-3.1-8B, Attack=Completion, Adversarial Training=SFT2025.05 | 0 | |
| Delim.Backbone=Llama-3.1-8B, Attack=Completion, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Llama-3.1-8B, Attack=Completion, Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Llama-3.1-8B, Attack=Completion, Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Llama-3.1-8B, Attack=Escape Sep., Adversarial Training=SFT2025.05 | 0 | |
| AIRBackbone=Llama-3.1-8B, Attack=Escape Sep., Adversarial Training=SFT2025.05 | 0 | |
| Delim.Backbone=Llama-3.1-8B, Attack=Escape Sep., Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Llama-3.1-8B, Attack=Escape Sep., Adversarial Training=DPO2025.05 | 0 | |
| AIRBackbone=Llama-3.1-8B, Attack=Escape Sep., Adversarial Training=DPO2025.05 | 0 | |
| ISEBackbone=Llama-3.2-3B, Attack=Completion, Adversarial Training=SFT2025.05 | 0.5 | |
| Delim.Backbone=Llama-3.2-3B, Attack=Escape Sep., Adversarial Training=SFT2025.05 | 0.5 | |
| ISEBackbone=Llama-3.2-3B, Attack=Escape Sep., Adversarial Training=SFT2025.05 | 0.5 | |
| AIRBackbone=Llama-3.2-3B, Attack=Escape Sep., Adversarial Training=SFT2025.05 | 0.5 | |
| ISEBackbone=Qwen-2.5-7B, Attack=Naive, Adversarial Training=SFT2025.05 | 0.5 | |
| Delim.Backbone=Qwen-2.5-7B, Attack=Escape Sep., Adversarial Training=SFT2025.05 | 0.5 | |
| ISEBackbone=Qwen-2.5-7B, Attack=Escape Sep., Adversarial Training=SFT2025.05 | 0.5 | |
| AIRBackbone=Qwen-2.5-7B, Attack=Escape Sep., Adversarial Training=SFT2025.05 | 0.5 | |
| Delim.Backbone=Qwen-2.5-7B, Attack=Escape Sep., Adversarial Training=DPO2025.05 | 0.5 | |
| NoneBackbone=Llama-3.1-8B, Attack=Naive, Adversarial Training=None2025.05 | 0.5 | |
| Delim.Backbone=Llama-3.1-8B, Attack=Escape Sep., Adversarial Training=SFT2025.05 | 0.5 | |
| NoneBackbone=Llama-3.2-3B, Attack=Naive, Adversarial Training=None2025.05 | 1 | |
| Delim.Backbone=Llama-3.2-3B, Attack=Completion, Adversarial Training=SFT2025.05 | 1 | |
| Delim.Backbone=Qwen-2.5-7B, Attack=Completion, Adversarial Training=SFT2025.05 | 1 | |
| NoneBackbone=Llama-3.2-3B, Attack=Escape Sep., Adversarial Training=None2025.05 | 1.4 | |
| NoneBackbone=Llama-3.1-8B, Attack=Escape Sep., Adversarial Training=None2025.05 | 1.4 | |
| AIRBackbone=Qwen-2.5-7B, Attack=GCG, Adversarial Training=DPO2025.05 | 1.6 | |
| NoneBackbone=Llama-3.2-3B, Attack=Ignore, Adversarial Training=None2025.05 | 2.5 | |
| NoneBackbone=Llama-3.1-8B, Attack=Ignore, Adversarial Training=None2025.05 | 2.5 | |
| AIRBackbone=Llama-3.1-8B, Attack=GCG, Adversarial Training=DPO2025.05 | 2.8 | |
| NoneBackbone=Qwen-2.5-7B, Attack=Ignore, Adversarial Training=None2025.05 | 2.9 | |
| NoneBackbone=Qwen-2.5-7B, Attack=Escape Sep., Adversarial Training=None2025.05 | 2.9 | |
| NoneBackbone=Qwen-2.5-7B, Attack=Naive, Adversarial Training=None2025.05 | 3.4 | |
| NoneBackbone=Llama-3.2-3B, Attack=Completion, Adversarial Training=None2025.05 | 3.8 | |
| NoneBackbone=Qwen-2.5-7B, Attack=Completion, Adversarial Training=None2025.05 | 3.8 | |
| NoneBackbone=Llama-3.1-8B, Attack=Completion, Adversarial Training=None2025.05 | 3.8 | |
| ISEBackbone=Llama-3.1-8B, Attack=GCG, Adversarial Training=DPO2025.05 | 4 | |
| AIRBackbone=Llama-3.2-3B, Attack=GCG, Adversarial Training=SFT2025.05 | 4.1 | |
| AIRBackbone=Llama-3.2-3B, Attack=GCG, Adversarial Training=DPO2025.05 | 5.2 | |
| ISEBackbone=Qwen-2.5-7B, Attack=GCG, Adversarial Training=DPO2025.05 | 7.7 | |
| AIRBackbone=Llama-3.1-8B, Attack=GCG, Adversarial Training=SFT2025.05 | 11.3 | |
| Delim.Backbone=Llama-3.1-8B, Attack=GCG, Adversarial Training=DPO2025.05 | 13 | |
| ISEBackbone=Llama-3.1-8B, Attack=GCG, Adversarial Training=SFT2025.05 | 19.9 | |
| AIRBackbone=Qwen-2.5-7B, Attack=GCG, Adversarial Training=SFT2025.05 | 22.6 | |
| Delim.Backbone=Llama-3.2-3B, Attack=GCG, Adversarial Training=DPO2025.05 | 29.1 | |
| Delim.Backbone=Qwen-2.5-7B, Attack=GCG, Adversarial Training=DPO2025.05 | 32 | |
| ISEBackbone=Qwen-2.5-7B, Attack=GCG, Adversarial Training=SFT2025.05 | 36.6 | |
| Delim.Backbone=Llama-3.2-3B, Attack=GCG, Adversarial Training=SFT2025.05 | 38 | |
| ISEBackbone=Llama-3.2-3B, Attack=GCG, Adversarial Training=DPO2025.05 | 46.6 | |
| ISEBackbone=Llama-3.2-3B, Attack=GCG, Adversarial Training=SFT2025.05 | 48.1 |