Malicious prompt detection on Meta-instruction prompts
97.1Language AccuracyDE-FIVE
Evaluation Results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| DE-FIVEModel=Phi-3, Training-Free=true2026.06 | 97.1 | 94.66 | 95.58 | 96.97 | 90.35 | 94.87 | |
| DE-FIVEModel=LLaVA-1.6, Training-Free=true2026.06 | 96.59 | 95.33 | 93.33 | 95.34 | 96.15 | 95.35 | |
| VLMGuardModel=Phi-3, Training-Free=false2026.06 | 94.31 | 92.2 | 98.75 | 93.04 | 81.28 | 92.11 | |
| VLMGuardModel=LLaVA-1.6, Training-Free=false2026.06 | 94.27 | 88.24 | 90.29 | 96.21 | 95.38 | 92.87 | |
| PerplexityModel=Phi-3, Training-Free=false2026.06 | 89.89 | 84.62 | 87.13 | 89.94 | 88.08 | 87.93 | |
| MirrorCheckModel=Phi-3, Training-Free=false2026.06 | 80.27 | 71.09 | 73.57 | 70.04 | 72.37 | 73.74 | |
| MirrorCheckModel=LLaVA-1.6, Training-Free=false2026.06 | 77.98 | 70.12 | 74.65 | 63.29 | 72.92 | 71.79 | |
| GradSafeModel=Phi-3, Training-Free=true2026.06 | 73.46 | 57.39 | 70.45 | 53.75 | 63.07 | 63.62 | |
| GradSafeModel=LLaVA-1.6, Training-Free=true2026.06 | 72.8 | 63.97 | 66.94 | 60.7 | 61.45 | 65.17 | |
| JailGuardModel=Phi-3, Training-Free=false2026.06 | 72.67 | 74.48 | 75.29 | 70.38 | 66.24 | 71.81 | |
| PerplexityModel=LLaVA-1.6, Training-Free=false2026.06 | 71.82 | 79.27 | 62.34 | 92.36 | 92.52 | 79.66 | |
| JailGuardModel=LLaVA-1.6, Training-Free=false2026.06 | 67.94 | 68.23 | 71 | 61.27 | 64.36 | 66.56 |