# Prompt-Injection Defense on Adaptive Prompt Injection (train) Source: [Prompt-Injection Defense on Adaptive Prompt Injection (train)]() Collection index: [llms.txt]() Data updated: 2026-05-28T10:05:02.262Z Evaluation of model defense mechanisms against prompt injection attacks using the training split of the Adaptive Prompt Injection dataset, measured by Attack Success Rate (ASR). A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Prompt-Injection Defense | | Dataset (including any stated split) | Adaptive Prompt Injection (train) | | Metric | Attack Success Rate (ASR) | | Unit | PERCENT | | Direction | Lower is better | | Results loaded | 15 of 15 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [Attack Success Rate (ASR)](): Lower is better; unit: PERCENT. ## Recorded results | Method | Attack Success Rate (ASR) | Result date | Report paper | | --- | --- | --- | --- | | ACT | 32 | Not recorded | 6a17cc4cdbd7150506f81558 | | BCT | 42.4 | Not recorded | 6a17cc4cdbd7150506f81558 | | ACT | 50.2 | Not recorded | 6a17cc4cdbd7150506f81558 | | BCT | 52 | Not recorded | 6a17cc4cdbd7150506f81558 | | ACT | 65 | Not recorded | 6a17cc4cdbd7150506f81558 | | ACT | 73 | Not recorded | 6a17cc4cdbd7150506f81558 | | BCT | 92 | Not recorded | 6a17cc4cdbd7150506f81558 | | Baseline | 94 | Not recorded | 6a17cc4cdbd7150506f81558 | | BCT | 95 | Not recorded | 6a17cc4cdbd7150506f81558 | | Baseline | 98 | Not recorded | 6a17cc4cdbd7150506f81558 | | ACT | 99 | Not recorded | 6a17cc4cdbd7150506f81558 | | Baseline | 100 | Not recorded | 6a17cc4cdbd7150506f81558 | | Baseline | 100 | Not recorded | 6a17cc4cdbd7150506f81558 | | Baseline | 100 | Not recorded | 6a17cc4cdbd7150506f81558 | | BCT | 100 | Not recorded | 6a17cc4cdbd7150506f81558 | ### ACT Attack Success Rate (ASR): 32. Result ID: 6a181347fbc373592c125dad. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"GPT-OSS-20B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### BCT Attack Success Rate (ASR): 42.4. Result ID: 6a181347fbc373592c125dab. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Phi-4-reasoning","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### ACT Attack Success Rate (ASR): 50.2. Result ID: 6a181347fbc373592c125daa. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Phi-4-reasoning","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### BCT Attack Success Rate (ASR): 52. Result ID: 6a181347fbc373592c125dae. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"GPT-OSS-20B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### ACT Attack Success Rate (ASR): 65. Result ID: 6a181347fbc373592c125da7. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-8B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### ACT Attack Success Rate (ASR): 73. Result ID: 6a181347fbc373592c125da4. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-1.7B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### BCT Attack Success Rate (ASR): 92. Result ID: 6a181347fbc373592c125da5. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-1.7B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### Baseline Attack Success Rate (ASR): 94. Result ID: 6a181347fbc373592c125da9. [Reporting paper]() Recorded evaluation configuration: {"Target Model":"Phi-4-reasoning","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### BCT Attack Success Rate (ASR): 95. Result ID: 6a181347fbc373592c125da8. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-8B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### Baseline Attack Success Rate (ASR): 98. Result ID: 6a181347fbc373592c125da6. [Reporting paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-8B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### ACT Attack Success Rate (ASR): 99. Result ID: 6a181347fbc373592c125db0. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Gemma-4-E4B-it","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### Baseline Attack Success Rate (ASR): 100. Result ID: 6a181347fbc373592c125da3. [Reporting paper]() Recorded evaluation configuration: {"Target Model":"Qwen3-1.7B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### Baseline Attack Success Rate (ASR): 100. Result ID: 6a181347fbc373592c125dac. [Reporting paper]() Recorded evaluation configuration: {"Target Model":"GPT-OSS-20B","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### Baseline Attack Success Rate (ASR): 100. Result ID: 6a181347fbc373592c125daf. [Reporting paper]() Recorded evaluation configuration: {"Target Model":"Gemma-4-E4B-it","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. ### BCT Attack Success Rate (ASR): 100. Result ID: 6a181347fbc373592c125db1. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Gemma-4-E4B-it","Attacker suffixes":"best-of-8"}. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.