Prompt Injection Mitigation on 17 Injection Types Appendix E
94.2ComplianceQwen3-4B
Evaluation results
| Method | Links | ||
|---|---|---|---|
| Qwen3-4BDefense=No defense2026.06 | 94.2 | — | |
| Gemma3-12B-ITDefense=No defense2026.06 | 93.8 | — | |
| Qwen3-32BDefense=No defense2026.06 | 92.4 | — | |
| Gemma3-27B-ITDefense=No defense2026.06 | 92.1 | — | |
| AverageDefense=No defense2026.06 | 87.7 | — | |
| PromptArmorBase Model=Qwen3-4B2026.06 | 87.1 | 96.8 | |
| Llama3.1-8B-InstructDefense=No defense2026.06 | 83 | — | |
| PromptArmorBase Model=Qwen3-32B2026.06 | 80.3 | 99.4 | |
| PromptArmorBase Model=Llama3.1-8B-Instruct2026.06 | 74.2 | 97.5 | |
| Qwen3-1.7BDefense=No defense2026.06 | 70.5 | — | |
| PromptArmorBase Model=Qwen3-1.7B2026.06 | 67.3 | 100 | |
| PromptArmorBase Model=Average2026.06 | 66.3 | 98.4 | |
| PromptArmorBase Model=Gemma3-12B-IT2026.06 | 46.2 | 97.9 | |
| PromptArmorBase Model=Gemma3-27B-IT2026.06 | 42.5 | 98.9 | |
| DeBERTaBase Model=Gemma3-12B-IT2026.06 | 25.1 | 93 | |
| DeBERTaBase Model=Gemma3-27B-IT2026.06 | 23 | 93 | |
| DeBERTaBase Model=Qwen3-32B2026.06 | 22.4 | 93 | |
| DeBERTaBase Model=Qwen3-4B2026.06 | 22.1 | 93 | |
| DeBERTaBase Model=Average2026.06 | 22 | 93 | |
| DeBERTaBase Model=Llama3.1-8B-Instruct2026.06 | 20.6 | 93 | |
| DeBERTaBase Model=Qwen3-1.7B2026.06 | 18.8 | 93 | |
| Keyword-regex filteringBase Model=Gemma3-12B-IT2026.06 | 18.1 | 100 | |
| Keyword-regex filteringBase Model=Gemma3-27B-IT2026.06 | 15.5 | 100 | |
| Keyword-regex filteringBase Model=Qwen3-32B2026.06 | 15.2 | 100 | |
| Keyword-regex filteringBase Model=Llama3.1-8B-Instruct2026.06 | 12.8 | 100 | |
| Keyword-regex filteringBase Model=Average2026.06 | 12.6 | 100 | |
| Keyword-regex filteringBase Model=Qwen3-4B2026.06 | 8.1 | 100 | |
| Keyword-regex filteringBase Model=Qwen3-1.7B2026.06 | 5.8 | 100 |