# Prompt Injection Defense Evaluation on AgentDojo without attack

Source: [Prompt Injection Defense Evaluation on AgentDojo without attack](<https://www.sota2.com/research/sota/prompt-injection-defense-evaluation-on-agentdojo-without-attack>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-03-27T12:08:56.357Z

Evaluation of LLM agent performance on the AgentDojo dataset under non-attack conditions, measuring utility, attack success rate (ASR), token usage, and efficiency.

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

| Scope | Recorded value |
| --- | --- |
| Task | LLM agent prompt injection defense evaluation |
| Dataset (including any stated split) | AgentDojo without attack |
| Metric | Total Tokens (M) |
| Unit | SCALAR |
| Direction | Lower is better |
| Results loaded | 8 of 8 |
| Coverage | All results currently returned for this benchmark |

Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol.

## Metrics

- [Total Tokens (M)](<https://www.sota2.com/research/sota/prompt-injection-defense-evaluation-on-agentdojo-without-attack.md?metric=Total%20Tokens%20(M)>): Lower is better; unit: SCALAR.

- [Utility](<https://www.sota2.com/research/sota/prompt-injection-defense-evaluation-on-agentdojo-without-attack.md?metric=Utility>): Higher is better; unit: PERCENT.

- [Attack Success Rate (ASR)](<https://www.sota2.com/research/sota/prompt-injection-defense-evaluation-on-agentdojo-without-attack.md?metric=Attack%20Success%20Rate%20(ASR)>): Lower is better; unit: PERCENT.

- [Efficiency Score](<https://www.sota2.com/research/sota/prompt-injection-defense-evaluation-on-agentdojo-without-attack.md?metric=Efficiency%20Score>): Higher is better; unit: SCALAR.

## Recorded results

| Method | Total Tokens (M) | Result date | Report paper |
| --- | --- | --- | --- |
| tool\_filter | 0.49 | Not recorded | 68fa79741e209131cea7db6d |
| undefended agent | 0.82 | Not recorded | 68fa79741e209131cea7db6d |
| spotlighting\_with\_delimiting | 0.88 | Not recorded | 68fa79741e209131cea7db6d |
| DRIFT | 2.37 | Not recorded | 68fa79741e209131cea7db6d |
| transformers\_pi\_detector | 2.58 | Not recorded | 68fa79741e209131cea7db6d |
| Progent | 2.6 | Not recorded | 68fa79741e209131cea7db6d |
| repeat\_user\_prompt | 5.43 | Not recorded | 68fa79741e209131cea7db6d |
| CaMeL | 6.09 | Not recorded | 68fa79741e209131cea7db6d |

### tool\_filter

Total Tokens (M): 0.49. Result ID: 69c6734747f34ce924b027cb.

[Reporting paper](<https://www.sota2.com/research/paper/68fa79741e209131cea7db6d.md>)

Recorded evaluation configuration: {"Defense Method":"tool\_filter"}. This record does not assert independent reproduction.

### undefended agent

Total Tokens (M): 0.82. Result ID: 69c6734747f34ce924b027c8.

[Reporting paper](<https://www.sota2.com/research/paper/68fa79741e209131cea7db6d.md>)

Recorded evaluation configuration: {"Defense Method":"undefended agent"}. This record does not assert independent reproduction.

### spotlighting\_with\_delimiting

Total Tokens (M): 0.88. Result ID: 69c6734747f34ce924b027ca.

[Reporting paper](<https://www.sota2.com/research/paper/68fa79741e209131cea7db6d.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa72a01e209131cea57a17.md>)

Recorded evaluation configuration: {"Defense Method":"spotlighting\_with\_delimiting"}. This record does not assert independent reproduction.

### DRIFT

Total Tokens (M): 2.37. Result ID: 69c6734747f34ce924b027cf.

[Reporting paper](<https://www.sota2.com/research/paper/68fa79741e209131cea7db6d.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa79741e209131cea7db6d.md>)

Recorded evaluation configuration: {"Defense Method":"DRIFT"}. This record does not assert independent reproduction.

### transformers\_pi\_detector

Total Tokens (M): 2.58. Result ID: 69c6734747f34ce924b027cc.

[Reporting paper](<https://www.sota2.com/research/paper/68fa79741e209131cea7db6d.md>)

Recorded evaluation configuration: {"Defense Method":"transformers\_pi\_detector"}. This record does not assert independent reproduction.

### Progent

Total Tokens (M): 2.6. Result ID: 69c6734747f34ce924b027ce.

[Reporting paper](<https://www.sota2.com/research/paper/68fa79741e209131cea7db6d.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa7af71e209131cea8604a.md>)

Recorded evaluation configuration: {"Defense Method":"Progent"}. This record does not assert independent reproduction.

### repeat\_user\_prompt

Total Tokens (M): 5.43. Result ID: 69c6734747f34ce924b027c9.

[Reporting paper](<https://www.sota2.com/research/paper/68fa79741e209131cea7db6d.md>)

Recorded evaluation configuration: {"Defense Method":"repeat\_user\_prompt"}. This record does not assert independent reproduction.

### CaMeL

Total Tokens (M): 6.09. Result ID: 69c6734747f34ce924b027cd.

[Reporting paper](<https://www.sota2.com/research/paper/68fa79741e209131cea7db6d.md>)

[Method origin paper](<https://www.sota2.com/research/paper/68fa79a71e209131cea7eb35.md>)

Recorded evaluation configuration: {"Defense Method":"CaMeL"}. This record does not assert independent reproduction.

Page 1 of 1. This is an index page, not the full collection.