Inference Cost Attack on Natural Questions (NQ)
100wAA (%)No Attack
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| No AttackBackbone=Qwen-turbo2026.05 | 100 | 100 | 100 | 1 | |
| No AttackBackbone=GPT-52026.05 | 100 | 100 | 100 | 1 | |
| No AttackBackbone=Claude-Sonnet-42026.05 | 100 | 100 | 100 | 1 | |
| No AttackBackbone=Deepseek-R12026.05 | 100 | 100 | 100 | 1 | |
| No AttackRAG configuration=default2026.05 | 100 | — | 100 | 1 | |
| CREEP+ -RTaskBackbone=Qwen-turbo2026.05 | 85 | 86 | 82 | 1.19 | |
| CREEP+-RTaskMA-GRPO=true, RAG configuration=default2026.05 | 85 | 86 | 82 | 1.19 | |
| CREEP+ -GTaskBackbone=Qwen-turbo2026.05 | 79 | 81 | 74 | 1.22 | |
| CREEP+ -GTaskBackbone=Claude-Sonnet-42026.05 | 79 | 84 | 79 | 1.03 | |
| CREEP+-GTaskMA-GRPO=true, RAG configuration=default2026.05 | 79 | 81 | 74 | 1.22 | |
| CREEP+ -GContraBackbone=Qwen-turbo2026.05 | 77 | 92 | 57 | 2.52 | |
| CREEP+ -GTaskBackbone=GPT-52026.05 | 77 | 82 | 68 | 7.55 | |
| CREEP+-GContraMA-GRPO=true, RAG configuration=default2026.05 | 77 | 92 | 57 | 2.52 | |
| CREEP+ -GTaskBackbone=Deepseek-R12026.05 | 71 | 81 | 73 | 1.18 | |
| CREEP+ -RContraBackbone=Qwen-turbo2026.05 | 69 | 78 | 51 | 1.75 | |
| CREEP+-RContraMA-GRPO=true, RAG configuration=default2026.05 | 69 | 78 | 51 | 1.75 | |
| CREEP-GTaskMA-GRPO=false, RAG configuration=default2026.05 | 68 | 74 | 69 | 1.09 | |
| CREEP+ -GContraBackbone=GPT-52026.05 | 64 | 85 | 21.25 | 13.12 | |
| CREEP-RContraMA-GRPO=false, RAG configuration=default2026.05 | 60 | 77 | 50 | 1.41 | |
| CREEP-GContraMA-GRPO=false, RAG configuration=default2026.05 | 59 | 83 | 46 | 1.81 | |
| CREEP+ -GContraBackbone=Claude-Sonnet-42026.05 | 58 | 91 | 43 | 2.22 | |
| CREEP+ -GDecoyBackbone=Claude-Sonnet-42026.05 | 54 | 56 | 36 | 1.17 | |
| CREEP+ -RContraBackbone=GPT-52026.05 | 51 | 56 | 16 | 10.83 | |
| CREEP+ -RTaskBackbone=Claude-Sonnet-42026.05 | 50 | 50 | 47 | 1.25 | |
| CREEP+ -RTaskBackbone=Deepseek-R12026.05 | 49 | 51 | 44 | 1.13 | |
| CREEP+ -GDecoyBackbone=Qwen-turbo2026.05 | 46 | 48 | 38 | 1.2 | |
| CREEP+-GDecoyMA-GRPO=true, RAG configuration=default2026.05 | 46 | 48 | 38 | 1.2 | |
| CREEP+ -RTaskBackbone=GPT-52026.05 | 44 | 48 | 40 | 4.26 | |
| CREEP+ -GContraBackbone=Deepseek-R12026.05 | 44 | 86 | 29 | 1.9 | |
| CREEP+ -GDecoyBackbone=GPT-52026.05 | 42 | 43 | 14 | 4.4 | |
| CREEP+ -RContraBackbone=Claude-Sonnet-42026.05 | 42 | 63 | 18 | 2.15 | |
| CREEP+ -GDecoyBackbone=Deepseek-R12026.05 | 40 | 42 | 15 | 1.22 | |
| CREEP+ -RContraBackbone=Deepseek-R12026.05 | 36 | 60 | 12 | 1.76 | |
| PoisonedRAGRAG configuration=default2026.05 | 36 | 77 | 57 | 1.66 | |
| CREEP-GDecoyMA-GRPO=false, RAG configuration=default2026.05 | 36 | 38 | 29 | 1.14 | |
| CREEP+ -RDecoyBackbone=Qwen-turbo2026.05 | 31 | 34 | 29 | 1 | |
| CREEP+-RDecoyMA-GRPO=true, RAG configuration=default2026.05 | 31 | 34 | 29 | 1 | |
| CREEP-RTaskMA-GRPO=false, RAG configuration=default2026.05 | 19 | 19 | 16 | 1 | |
| CREEP-RDecoyMA-GRPO=false, RAG configuration=default2026.05 | 19 | 24 | 19 | 1.09 | |
| CREEP+ -RDecoyBackbone=Claude-Sonnet-42026.05 | 6 | 8 | 6 | 0.99 | |
| Context-Agnostic AttackRAG configuration=default2026.05 | 3 | 3 | 3 | 1.03 | |
| ParadoxRAG configuration=default2026.05 | 2 | 60 | 50 | 1.08 | |
| CREEP+ -RDecoyBackbone=GPT-52026.05 | 1 | 2 | 1 | 1.06 | |
| ICL-Genetic Attack (Agnostic)RAG configuration=default2026.05 | 1 | 1 | 1 | 1.01 | |
| CREEP+ -RDecoyBackbone=Deepseek-R12026.05 | 0 | 2 | 1 | 1 |