Prompt Injection on MMLU (random topology)
15.5ASR (k=1)Inspector
Evaluation results
| Method | Links | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| InspectorBackbone=GPT-4o-mini, Topology=random2026.01 | 15.5 | 16.9 | 19.2 | 64.3 | 64.3 | 62.7 | — | — | |
| INFA-GUARDBackbone=GPT-4o-mini, Topology=random2026.01 | 16.3 | 15 | 15 | 83.3 | 85 | 85 | — | — | |
| G-safeguardBackbone=GPT-4o-mini, Topology=random2026.01 | 16.4 | 17.1 | 17.5 | 83.6 | 83.6 | 81.7 | — | — | |
| ChallengerBackbone=GPT-4o-mini, Topology=random2026.01 | 16.5 | 36.2 | 44.2 | 68.3 | 48.3 | 50 | — | — | |
| INFA-GUARDBackbone=Qwen3-235B-A22B, Topology=random2026.01 | 17.7 | 18.3 | 20 | 83.3 | 81.7 | 81.7 | — | — | |
| G-safeguardBackbone=Qwen3-235B-A22B, Topology=random2026.01 | 21.4 | 23 | 22.7 | 80 | 78.3 | 78.3 | — | — | |
| AgentSafeBackbone=GPT-4o-mini, Topology=random2026.01 | 24.5 | 33.2 | 35.4 | 76.7 | 66.7 | 61.7 | — | — | |
| AgentXposed-GuideBackbone=GPT-4o-mini, Topology=random2026.01 | 27.7 | 37.3 | 42 | 73.3 | 61.7 | 56.7 | — | — | |
| AgentXposed-KickBackbone=GPT-4o-mini, Topology=random2026.01 | 28 | 38.7 | 40.7 | 73.3 | 61.7 | 60 | — | — | |
| No DefenseBackbone=GPT-4o-mini, Topology=random2026.01 | 29 | 37.7 | 41 | 71.7 | 63.3 | 60 | — | — | |
| No DefenseBackbone=Qwen3-235B-A22B, Topology=random2026.01 | 33.8 | 49.3 | 58.3 | 68.3 | 53.3 | 38.3 | — | — | |
| AgentXposed-GuideBackbone=Qwen3-235B-A22B, Topology=random2026.01 | 34.3 | 47 | 56.7 | 70 | 53.3 | 46.7 | — | — | |
| AgentXposed-KickBackbone=Qwen3-235B-A22B, Topology=random2026.01 | 34.3 | 52.5 | 60 | 66.7 | 45 | 41.7 | — | — | |
| InspectorBackbone=Qwen3-235B-A22B, Topology=random2026.01 | 34.8 | 43.3 | 50.7 | 61.7 | 53 | 44 | — | — | |
| ChallengerBackbone=Qwen3-235B-A22B, Topology=random2026.01 | 36.1 | 52 | 61 | 65 | 46.7 | 35 | — | — | |
| AgentSafeBackbone=Qwen3-235B-A22B, Topology=random2026.01 | 37.5 | 55.5 | 64.2 | 65 | 40 | 38.3 | — | — | |
| LlamaGuardBase Model=GPT-4o-mini, Communication Architecture=random2026.05 | — | — | — | — | — | — | 38.7 | 63.3 | |
| No DefenseBase Model=GPT-4o-mini, Communication Architecture=random2026.05 | — | — | — | — | — | — | 44.3 | 56.7 | |
| PropGuardBase Model=GPT-4o-mini, Communication Architecture=random2026.05 | — | — | — | — | — | — | 12.3 | 88.3 | |
| Qwen3GuardBase Model=GPT-4o-mini, Communication Architecture=random2026.05 | — | — | — | — | — | — | 22 | 78.3 | |
| ThinkGuardBase Model=GPT-4o-mini, Communication Architecture=random2026.05 | — | — | — | — | — | — | 28.3 | 75 | |
| WildGuardBase Model=GPT-4o-mini, Communication Architecture=random2026.05 | — | — | — | — | — | — | 33.7 | 66.7 |