Negative Review Classification on Negative Review
12.1Tokens UsedEscape Separation
Evaluation Results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| Escape SeparationVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 12.1 | 45.3 | 8.3 | 22.9 | 45.2 | |
| IgnoreVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 18.1 | 94.9 | 1.8 | 45.2 | 93.7 | |
| Fake CompletionVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 23 | 51.4 | 15 | 47.2 | 75.7 | |
| CombinedVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 29 | 100 | 1.6 | 94.8 | 100 | |
| Separator InjectionVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 48.9 | 55.3 | 30.1 | 35.5 | 44.1 | |
| No Fake Reasoning (Ablation)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 54.7 | 58.2 | 55.3 | 51.9 | 59.2 | |
| Single Criteria (Ablation)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 165.5 | 93.2 | 92.5 | 92.4 | 91 | |
| Criteria Attack (Double Criteria)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 200.3 | 93.9 | 94.4 | 94.6 | 94.3 | |
| Random Criteria (Ablation)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 201 | 75.5 | 76.7 | 76.3 | 76.5 | |
| TopicVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 401.1 | 99.9 | 45.6 | 98.7 | 47.6 |