# Prompt-Injection Defense on Adaptive Prompt Injection (test) Source: [Prompt-Injection Defense on Adaptive Prompt Injection (test)]() Collection index: [llms.txt]() Data updated: 2026-05-28T10:05:02.225Z Evaluation of model defense mechanisms against prompt injection attacks using the test split of the Adaptive Prompt Injection dataset, measured by Attack Success Rate (ASR). A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Prompt-Injection Defense | | Dataset (including any stated split) | Adaptive Prompt Injection (test) | | Metric | Attack Success Rate (ASR) | | Unit | PERCENT | | Direction | Lower is better | | Results loaded | 15 of 15 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [Attack Success Rate (ASR)](): Lower is better; unit: PERCENT. ## Recorded results | Method | Attack Success Rate (ASR) | Result date | Report paper | | --- | --- | --- | --- | | ACT | 37 | Not recorded | 6a17cc4cdbd7150506f81558 | | BCT | 42.6 | Not recorded | 6a17cc4cdbd7150506f81558 | | ACT | 49.5 | Not recorded | 6a17cc4cdbd7150506f81558 | | BCT | 57.4 | Not recorded | 6a17cc4cdbd7150506f81558 | | ACT | 59.3 | Not recorded | 6a17cc4cdbd7150506f81558 | | ACT | 63 | Not recorded | 6a17cc4cdbd7150506f81558 | | BCT | 80.6 | Not recorded | 6a17cc4cdbd7150506f81558 | | Baseline | 90.9 | Not recorded | 6a17cc4cdbd7150506f81558 | | BCT | 94.4 | Not recorded | 6a17cc4cdbd7150506f81558 | | Baseline | 96.3 | Not recorded | 6a17cc4cdbd7150506f81558 | | ACT | 96.3 | Not recorded | 6a17cc4cdbd7150506f81558 | | BCT | 98.1 | Not recorded | 6a17cc4cdbd7150506f81558 | | Baseline | 100 | Not recorded | 6a17cc4cdbd7150506f81558 | | Baseline | 100 | Not recorded | 6a17cc4cdbd7150506f81558 | | Baseline | 100 | Not recorded | 6a17cc4cdbd7150506f81558 | ### ACT Attack Success Rate (ASR): 37. Result ID: 6a181347fbc373592c125d9e. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"GPT-OSS-20B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### BCT Attack Success Rate (ASR): 42.6. Result ID: 6a181347fbc373592c125d9c. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Phi-4-reasoning","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### ACT Attack Success Rate (ASR): 49.5. Result ID: 6a181347fbc373592c125d9b. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Phi-4-reasoning","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### BCT Attack Success Rate (ASR): 57.4. Result ID: 6a181347fbc373592c125d9f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"GPT-OSS-20B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### ACT Attack Success Rate (ASR): 59.3. Result ID: 6a181347fbc373592c125d98. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-8B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### ACT Attack Success Rate (ASR): 63. Result ID: 6a181347fbc373592c125d95. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-1.7B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### BCT Attack Success Rate (ASR): 80.6. Result ID: 6a181347fbc373592c125d96. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-1.7B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### Baseline Attack Success Rate (ASR): 90.9. Result ID: 6a181347fbc373592c125d9a. [Reporting paper]() Recorded evaluation configuration: {"Target Model":"Phi-4-reasoning","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### BCT Attack Success Rate (ASR): 94.4. Result ID: 6a181347fbc373592c125d99. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-8B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### Baseline Attack Success Rate (ASR): 96.3. Result ID: 6a181347fbc373592c125d97. [Reporting paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-8B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### ACT Attack Success Rate (ASR): 96.3. Result ID: 6a181347fbc373592c125da1. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Gemma-4-E4B-it","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### BCT Attack Success Rate (ASR): 98.1. Result ID: 6a181347fbc373592c125da2. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Gemma-4-E4B-it","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### Baseline Attack Success Rate (ASR): 100. Result ID: 6a181347fbc373592c125d94. [Reporting paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-1.7B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### Baseline Attack Success Rate (ASR): 100. Result ID: 6a181347fbc373592c125d9d. [Reporting paper]() Recorded evaluation configuration: {"Target Model":"GPT-OSS-20B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### Baseline Attack Success Rate (ASR): 100. Result ID: 6a181347fbc373592c125da0. [Reporting paper]() Recorded evaluation configuration: {"Target Model":"Gemma-4-E4B-it","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.