# Prompt Injection Defense on Three Suites Aggregated 1.0 (test) Source: [Prompt Injection Defense on Three Suites Aggregated 1.0 (test)]() Collection index: [llms.txt]() Data updated: 2026-06-16T06:18:55.069Z Evaluation of model defense mechanisms against prompt injection attacks using the test split of the Three Suites Aggregated 1.0 dataset, measured by clean utility, utility under attack, and attack success rate. A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Prompt Injection Defense | | Dataset (including any stated split) | Three Suites Aggregated 1.0 (test) | | Metric | Clean Utility | | Unit | PERCENT | | Direction | Higher is better | | Results loaded | 32 of 32 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [Clean Utility](): Higher is better; unit: PERCENT. - [Attack Success Rate](): Lower is better; unit: PERCENT. - [Utility Under Attack](): Higher is better; unit: PERCENT. ## Recorded results | Method | Clean Utility | Result date | Report paper | | --- | --- | --- | --- | | DeepSeek-v2-Flash | 89.5 | Not recorded | 6a30d86bd33dfb23e783cad8 | | DeepSeek-v2-Flash | 89.5 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-3.5-turbo | 86 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-3.5-turbo | 86 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-3.5-turbo | 77.2 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-3.5-turbo | 77.2 | Not recorded | 6a30d86bd33dfb23e783cad8 | | Claude-3-Haiku | 70.2 | Not recorded | 6a30d86bd33dfb23e783cad8 | | Claude-3-Haiku | 70.2 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 68.4 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 68.4 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 66.7 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 66.7 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 64.9 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 64.9 | Not recorded | 6a30d86bd33dfb23e783cad8 | | Gemini-1.5-Flash | 63.2 | Not recorded | 6a30d86bd33dfb23e783cad8 | | Gemini-1.5-Flash | 63.2 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 63.2 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 63.2 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 63.2 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 63.2 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 59.6 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 59.6 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 59.6 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 59.6 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 49.1 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 49.1 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 47.4 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 47.4 | Not recorded | 6a30d86bd33dfb23e783cad8 | | Claude-3-Haiku | 45.6 | Not recorded | 6a30d86bd33dfb23e783cad8 | | Claude-3-Haiku | 45.6 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 43.9 | Not recorded | 6a30d86bd33dfb23e783cad8 | | GPT-4o-mini | 43.9 | Not recorded | 6a30d86bd33dfb23e783cad8 | ### DeepSeek-v2-Flash Clean Utility: 89.5. Result ID: 6a30e927fbc373592c2c5a34. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"No defense","Attack Type":"Static"}. This record does not assert independent reproduction. ### DeepSeek-v2-Flash Clean Utility: 89.5. Result ID: 6a30e927fbc373592c2c5a35. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"No defense","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-3.5-turbo Clean Utility: 86. Result ID: 6a30e927fbc373592c2c5a3a. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"Sandwich","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-3.5-turbo Clean Utility: 86. Result ID: 6a30e927fbc373592c2c5a3b. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"Sandwich","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-3.5-turbo Clean Utility: 77.2. Result ID: 6a30e927fbc373592c2c5a30. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"No defense","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-3.5-turbo Clean Utility: 77.2. Result ID: 6a30e927fbc373592c2c5a31. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"No defense","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### Claude-3-Haiku Clean Utility: 70.2. Result ID: 6a30e927fbc373592c2c5a36. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"No defense","Attack Type":"Static"}. This record does not assert independent reproduction. ### Claude-3-Haiku Clean Utility: 70.2. Result ID: 6a30e927fbc373592c2c5a37. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"No defense","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 68.4. Result ID: 6a30e927fbc373592c2c5a3c. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"Reminder","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 68.4. Result ID: 6a30e927fbc373592c2c5a3d. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"Reminder","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 66.7. Result ID: 6a30e927fbc373592c2c5a2e. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"No defense","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 66.7. Result ID: 6a30e927fbc373592c2c5a2f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"No defense","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 64.9. Result ID: 6a30e927fbc373592c2c5a46. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"DataFilter","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 64.9. Result ID: 6a30e927fbc373592c2c5a47. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"DataFilter","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### Gemini-1.5-Flash Clean Utility: 63.2. Result ID: 6a30e927fbc373592c2c5a32. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"No defense","Attack Type":"Static"}. This record does not assert independent reproduction. ### Gemini-1.5-Flash Clean Utility: 63.2. Result ID: 6a30e927fbc373592c2c5a33. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"No defense","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 63.2. Result ID: 6a30e927fbc373592c2c5a40. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"PromptGuard","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 63.2. Result ID: 6a30e927fbc373592c2c5a41. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"PromptGuard","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 63.2. Result ID: 6a30e927fbc373592c2c5a48. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"Progent","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 63.2. Result ID: 6a30e927fbc373592c2c5a49. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"Progent","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 59.6. Result ID: 6a30e927fbc373592c2c5a38. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"Sandwich","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 59.6. Result ID: 6a30e927fbc373592c2c5a39. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"Sandwich","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 59.6. Result ID: 6a30e927fbc373592c2c5a3e. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"Spotlighting","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 59.6. Result ID: 6a30e927fbc373592c2c5a3f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"Spotlighting","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 49.1. Result ID: 6a30e927fbc373592c2c5a4a. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"DRIFT","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 49.1. Result ID: 6a30e927fbc373592c2c5a4b. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"DRIFT","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 47.4. Result ID: 6a30e927fbc373592c2c5a44. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"ProtectAI","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 47.4. Result ID: 6a30e927fbc373592c2c5a45. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"ProtectAI","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### Claude-3-Haiku Clean Utility: 45.6. Result ID: 6a30e927fbc373592c2c5a4c. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"DRIFT","Attack Type":"Static"}. This record does not assert independent reproduction. ### Claude-3-Haiku Clean Utility: 45.6. Result ID: 6a30e927fbc373592c2c5a4d. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"DRIFT","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 43.9. Result ID: 6a30e927fbc373592c2c5a42. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"PIGuard","Attack Type":"Static"}. This record does not assert independent reproduction. ### GPT-4o-mini Clean Utility: 43.9. Result ID: 6a30e927fbc373592c2c5a43. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Defense":"PIGuard","Attack Type":"AutoDojo"}. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.