Prompt Injection Attack on AgentDojo
64ASR@1PISmith
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| PISmithTarget Model=GPT-4.1-nano2026.03 | 64 | 81 | — | |
| PISmithTarget Model=GPT-4o-mini2026.03 | 62 | 78 | — | |
| PISmithTarget Model=GPT-5-nano2026.03 | 24 | 38 | — | |
| Imp. Instr.Target Model=GPT-4o-mini2026.03 | 23 | — | — | |
| Tool Know.Target Model=GPT-4.1-nano2026.03 | 20 | — | — | |
| Imp. Instr.Target Model=GPT-4.1-nano2026.03 | 20 | — | — | |
| Ignore Prev.Target Model=GPT-4.1-nano2026.03 | 13 | — | — | |
| Tool Know.Target Model=GPT-4o-mini2026.03 | 12 | — | — | |
| Ignore Prev.Target Model=GPT-4o-mini2026.03 | 6 | — | — | |
| InjecagentTarget Model=GPT-4.1-nano2026.03 | 5 | — | — | |
| InjecagentTarget Model=GPT-4o-mini2026.03 | 4 | — | — | |
| DirectTarget Model=GPT-4.1-nano2026.03 | 4 | — | — | |
| Sys. MsgTarget Model=GPT-4.1-nano2026.03 | 4 | — | — | |
| DirectTarget Model=GPT-4o-mini2026.03 | 3 | — | — | |
| Sys. MsgTarget Model=GPT-4o-mini2026.03 | 3 | — | — | |
| DirectTarget Model=GPT-5-nano2026.03 | 2 | — | — | |
| Sys. MsgTarget Model=GPT-5-nano2026.03 | 1 | — | — | |
| Tool Know.Target Model=GPT-5-nano2026.03 | 1 | — | — | |
| Imp. Instr.Target Model=GPT-5-nano2026.03 | 1 | — | — | |
| Ignore Prev.Target Model=GPT-5-nano2026.03 | 0 | — | — | |
| InjecagentTarget Model=GPT-5-nano2026.03 | 0 | — | — | |
| AgentVigilVictim Model=DeepSeek, Defense=No Defense2026.05 | — | — | 39.2 | |
| AgentVigilVictim Model=DeepSeek, Defense=Tool Filter2026.05 | — | — | 0.4 | |
| AgentVigilVictim Model=DeepSeek, Defense=PI Detector2026.05 | — | — | 4.1 | |
| AgentVigilVictim Model=DeepSeek, Defense=Repeat2026.05 | — | — | 14.1 | |
| AgentVigilVictim Model=DeepSeek, Defense=Delimit2026.05 | — | — | 17.8 | |
| BenchmarkVictim Model=DeepSeek, Defense=No Defense2026.05 | — | — | 32.9 | |
| BenchmarkVictim Model=DeepSeek, Defense=Tool Filter2026.05 | — | — | 0.4 | |
| BenchmarkVictim Model=DeepSeek, Defense=PI Detector2026.05 | — | — | 3.3 | |
| BenchmarkVictim Model=DeepSeek, Defense=Repeat2026.05 | — | — | 12.7 | |
| BenchmarkVictim Model=DeepSeek, Defense=Delimit2026.05 | — | — | 15.3 | |
| IterInjectVictim Model=DeepSeek, Defense=No Defense2026.05 | — | — | 47.8 | |
| IterInjectVictim Model=DeepSeek, Defense=Tool Filter2026.05 | — | — | 0.4 | |
| IterInjectVictim Model=DeepSeek, Defense=PI Detector2026.05 | — | — | 4.1 | |
| IterInjectVictim Model=DeepSeek, Defense=Repeat2026.05 | — | — | 14.9 | |
| IterInjectVictim Model=DeepSeek, Defense=Delimit2026.05 | — | — | 18.8 |