Prompt Injection on MMLU
12ASR@3PropGuard
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| PropGuardArchitecture=Tree2026.05 | 12 | — | 91.7 | |
| PropGuardArchitecture=Chain2026.05 | 12.3 | — | 90 | |
| PropGuardArchitecture=Random2026.05 | 12.3 | — | 88.3 | |
| PropGuardArchitecture=Star2026.05 | 14.7 | — | 86.7 | |
| INFA-GUARDBackbone=GPT-4o-mini, Communication Iterations=3, Topology Type=Random2026.01 | 15 | — | 85 | |
| INFA-GuardArchitecture=Chain2026.05 | 15.3 | — | 86.7 | |
| G-SafeguardArchitecture=Chain2026.05 | 16.7 | — | 83.3 | |
| INFA-GuardArchitecture=Star2026.05 | 16.7 | — | 85 | |
| G-SafeguardTopology=Chain2025.12 | 17 | 0.9822 | — | |
| G-SafeguardTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 17.33 | 0.9867 | — | |
| G-SafeguardArchitecture=Tree2026.05 | 17.7 | — | 83.3 | |
| INFA-GuardArchitecture=Tree2026.05 | 17.7 | — | 83.3 | |
| INFA-GuardArchitecture=Random2026.05 | 17.7 | — | 81.7 | |
| BlindGuardTopology=Tree2025.12 | 18 | 0.8133 | — | |
| G-SafeguardTopology=Star2025.12 | 18 | 0.9911 | — | |
| G-SafeguardArchitecture=Star2026.05 | 18 | — | 81.7 | |
| XG-GuardTopology=Chain2025.12 | 18.33 | 0.9511 | — | |
| G-SafeguardTopology=Tree2025.12 | 18.33 | 0.9911 | — | |
| G-SafeguardTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 18.33 | 0.9867 | — | |
| G-SafeguardArchitecture=Random2026.05 | 18.7 | — | 81.7 | |
| G-SafeguardTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 19 | 0.9911 | — | |
| InspectorBackbone=GPT-4o-mini2026.01 | 19.2 | — | 62.7 | |
| G-SafeguardTopology=Random2025.12 | 19.33 | 0.9956 | — | |
| G-SafeguardTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 19.33 | 0.9911 | — | |
| BlindGuardTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 19.33 | 0.8578 | — | |
| DOMINANTTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 19.33 | 0.6133 | — | |
| INFA-GUARDBackbone=Qwen3-235B-A22B2026.01 | 20 | — | 81.7 | |
| BlindGuardTopology=Chain2025.12 | 20.33 | 0.84 | — | |
| BlindGuardTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 20.33 | 0.8622 | — | |
| XG-GuardTopology=Tree2025.12 | 20.67 | 0.92 | — | |
| BlindGuardTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 20.67 | 0.8356 | — | |
| GUARDIANArchitecture=Chain2026.05 | 20.7 | — | 81.7 | |
| TAMTopology=Tree2025.12 | 21 | 0.5556 | — | |
| XG-GuardTopology=Random2025.12 | 21.33 | 0.9289 | — | |
| TAMTopology=Chain2025.12 | 22 | 0.5378 | — | |
| XG-GuardTopology=Star2025.12 | 22 | 0.9289 | — | |
| TAMTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 22 | 0.5556 | — | |
| GUARDIANArchitecture=Star2026.05 | 22 | — | 80 | |
| GUARDIANArchitecture=Tree2026.05 | 22.3 | — | 80 | |
| BlindGuardTopology=Random2025.12 | 22.33 | 0.8444 | — | |
| DOMINANTTopology=Tree2025.12 | 22.67 | 0.5867 | — | |
| GUARDIANArchitecture=Random2026.05 | 23 | — | 78.3 | |
| DOMINANTTopology=Chain2025.12 | 23.33 | 0.5467 | — | |
| PREMTopology=Chain2025.12 | 23.67 | 0.4533 | — | |
| TAMTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 23.67 | 0.5289 | — | |
| PREMTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 24 | 0.4444 | — | |
| PREMTopology=Tree2025.12 | 24.33 | 0.4044 | — | |
| DOMINANTTopology=Star2025.12 | 24.33 | 0.5956 | — | |
| DOMINANTTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 24.67 | 0.5956 | — | |
| PREMTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 25 | 0.4489 | — | |
| BlindGuardTopology=Star2025.12 | 26 | 0.8311 | — | |
| DOMINANTTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 26.67 | 0.6267 | — | |
| BlindGuardTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 26.67 | 0.8533 | — | |
| TAMTopology=Star2025.12 | 27 | 0.6222 | — | |
| No DefenseTopology=Tree2025.12 | 27.67 | — | — | |
| TAMTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 28.33 | 0.6444 | — | |
| DOMINANTTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 29 | 0.5733 | — | |
| PREMTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 31 | 0.4311 | — | |
| DOMINANTTopology=Random2025.12 | 31.33 | 0.5867 | — | |
| No DefenseTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 32 | — | — | |
| PREMTopology=Star2025.12 | 33 | 0.4622 | — | |
| No DefenseTopology=Chain2025.12 | 34.33 | — | — | |
| TAMTopology=Random2025.12 | 34.67 | 0.4578 | — | |
| InspectorArchitecture=Star2026.05 | 35.7 | — | 66.7 | |
| ChallengerArchitecture=Tree2026.05 | 36.7 | — | 70 | |
| PREMTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 37 | 0.4889 | — | |
| ChallengerArchitecture=Chain2026.05 | 37 | — | 66.7 | |
| AgentXposedArchitecture=Tree2026.05 | 38 | — | 63.3 | |
| No DefenseTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 38.33 | — | — | |
| TAMTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 38.33 | 0.4933 | — | |
| No DefenseTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 39 | — | — | |
| InspectorArchitecture=Chain2026.05 | 39 | — | 61.7 | |
| InspectorArchitecture=Random2026.05 | 39 | — | 63.3 | |
| AgentXposedArchitecture=Chain2026.05 | 39.3 | — | 61.7 | |
| PREMTopology=Random2025.12 | 39.67 | 0.4667 | — | |
| AgentSafeArchitecture=Chain2026.05 | 39.7 | — | 68.3 | |
| No DefenseTopology=Star2025.12 | 40.66 | — | — | |
| No DefenseArchitecture=Chain2026.05 | 40.7 | — | 60 | |
| No DefenseTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 41 | — | — | |
| InspectorArchitecture=Tree2026.05 | 41 | — | 61.7 | |
| No DefenseArchitecture=Tree2026.05 | 42.3 | — | 61.7 | |
| ChallengerArchitecture=Star2026.05 | 44 | — | 56.7 | |
| No DefenseArchitecture=Random2026.05 | 44.3 | — | 56.7 | |
| No DefenseTopology=Random2025.12 | 44.67 | — | — | |
| AgentSafeArchitecture=Tree2026.05 | 46.7 | — | 58.3 | |
| AgentSafeArchitecture=Star2026.05 | 47 | — | 51.7 | |
| AgentXposedArchitecture=Random2026.05 | 48.3 | — | 55 | |
| ChallengerArchitecture=Random2026.05 | 48.7 | — | 50 | |
| AgentXposedArchitecture=Star2026.05 | 52 | — | 53.3 | |
| AgentSafeArchitecture=Random2026.05 | 52 | — | 51.7 | |
| No DefenseArchitecture=Star2026.05 | 55 | — | 46.7 |