Prompt Injection Detection on PopUp attack (top visited websites)
99.98AccuracyWARD-0.8b
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| WARD-0.8bModel Category=Ours, Number of Parameters=0.8b2026.05 | 99.98 | 100 | 99.96 | 99.98 | |
| WARD-2bModel Category=Ours, Number of Parameters=2b2026.05 | 99.91 | 100 | 99.81 | 99.91 | |
| Claude-Sonnet-4.6Model Category=Closed-source API2026.05 | 99.66 | 99.7 | 99.63 | 99.66 | |
| Gemini-3-FlashModel Category=Closed-source API2026.05 | 98.96 | 99.78 | 98.17 | 98.96 | |
| GPT-5.4Model Category=Closed-source API2026.05 | 98.9 | 99.59 | 98.23 | 98.91 | |
| GPT-5.4-MiniModel Category=Closed-source API2026.05 | 98.21 | 96.68 | 99.73 | 98.18 | |
| Claude-Haiku-4.5Model Category=Closed-source API2026.05 | 97.86 | 98.06 | 97.66 | 97.86 | |
| WebAgentGuard-8BModel Category=Ours2026.04 | 91.13 | 90.18 | 91.31 | 90.74 | |
| Gemini-3.1-proModel Category=Closed-source API2026.05 | 91.03 | 99.48 | 85.1 | 91.73 | |
| GPT-4.1Model Category=Closed-source APIs2026.04 | 90.45 | 80.08 | 100 | 88.94 | |
| Qwen-3.5-4BModel Category=Open-source instructed model, Number of Parameters=4B2026.05 | 88.09 | 77.18 | 98.71 | 86.63 | |
| Gemma-4-31BModel Category=Open-source instructed model, Number of Parameters=31B2026.05 | 86.99 | 74.72 | 99.01 | 85.17 | |
| Qwen3.5-35B-A3BModel Category=Open-source instructed model, Number of Parameters=35B2026.05 | 86.89 | 75.58 | 97.69 | 85.22 | |
| WebAgentGuard-8bModel Category=Guard model (Prompt Injection), Number of Parameters=8b2026.05 | 86.63 | 76.14 | 96.37 | 85.07 | |
| Qwen-3.5-2BModel Category=Open-source instructed model, Number of Parameters=2B2026.05 | 84.86 | 84.65 | 85.02 | 84.83 | |
| GPT-4oModel Category=Closed-source APIs2026.04 | 82.78 | 78.86 | 99.86 | 88.13 | |
| WebAgentGuard-4BModel Category=Ours2026.04 | 82.11 | 70.55 | 89.98 | 79.09 | |
| Qwen-3.5-0.8BModel Category=Open-source instructed model, Number of Parameters=0.8B2026.05 | 76.34 | 74.31 | 77.46 | 75.85 | |
| Qwen3-VL-Instruct-4BModel Category=Open-source instructed models2026.04 | 72.21 | 44.37 | 97.03 | 60.9 | |
| GPT-4o-MiniModel Category=Closed-source APIs2026.04 | 70.06 | 41.52 | 91.78 | 57.18 | |
| WebAgentGuard-4bModel Category=Guard model (Prompt Injection), Number of Parameters=4b2026.05 | 66.93 | 37.55 | 91.05 | 53.17 | |
| Gemma-3-4BModel Category=Open-source instructed model, Number of Parameters=4B2026.05 | 65.6 | 68.94 | 64.63 | 66.71 | |
| Qwen3-VL-Instruct-8BModel Category=Open-source instructed models2026.04 | 62.8 | 22.62 | 99.09 | 36.83 | |
| Qwen2.5-VL-Instruct-7BModel Category=Open-source instructed models2026.04 | 59.53 | 21.35 | 87.44 | 34.32 | |
| Prompt-Guard-2-86MModel Category=Guard models2026.04 | 52.05 | 2.06 | 50 | 3.96 | |
| GuardReasoner-VL-7BModel Category=Guard models2026.04 | 52 | 1.34 | 50 | 2.61 | |
| Llama-Guard-3-Vision-11BModel Category=Guard models2026.04 | 51.65 | 4.02 | 45.34 | 7.39 | |
| Prompt-Guard-1-86MModel Category=Guard models2026.04 | 50.81 | 33.12 | 48.12 | 39.24 | |
| Llama-Guard-4-12BModel Category=Guard model (Jail Break), Number of Parameters=12B2026.05 | 50.04 | 0.26 | 58.33 | 0.52 | |
| GPT-Oss-Safeguard-20bModel Category=Guard model (Jail Break), Number of Parameters=20b2026.05 | 50 | 0 | 0 | 0 | |
| Prompt-Guard-1-86MModel Category=Guard model (Jail Break), Number of Parameters=86M2026.05 | 50 | 1.79 | 50 | 3.46 | |
| Prompt-Guard-2-86MModel Category=Guard model (Jail Break), Number of Parameters=86M2026.05 | 50 | 0.3 | 50 | 0.59 | |
| Llama-Guard-3-Vision-11BModel Category=Guard model (Jail Break), Number of Parameters=11B2026.05 | 50 | 0 | 0 | 0 | |
| GuardReasoner-VL-7BModel Category=Guard model (Jail Break), Number of Parameters=7B2026.05 | 50 | 0 | 0 | 0 | |
| BrowseSafeModel Category=Guard model (Prompt Injection)2026.05 | 50 | 0 | 0 | 0 | |
| SuperAgent-Guard-1.7bModel Category=Guard model (Prompt Injection), Number of Parameters=1.7b2026.05 | 50 | 0 | 0 | 0 | |
| SuperAgent-Guard-4bModel Category=Guard model (Prompt Injection), Number of Parameters=4b2026.05 | 50 | 0 | 0 | 0 | |
| DataSentinelModel Category=Guard model (Prompt Injection)2026.05 | 49.96 | 48.77 | 49.96 | 49.36 | |
| PromptArmorModel Category=Guard model (Prompt Injection)2026.05 | 49.78 | 87.92 | 49.87 | 63.64 | |
| Llama-3.2-Vision-Instruct-11BModel Category=Open-source instructed models2026.04 | 44.92 | 5.53 | 40.87 | 9.74 |