Prompt Injection on Negative Review
0ASR (None Defense)Separator Injection
Evaluation Results
| Method | Links | ||||
|---|---|---|---|---|---|
| Separator InjectionTokens=48.9, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 0 | 0.1 | 0.1 | 0.1 | |
| Fake CompletionTokens=23, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 0.3 | 0.1 | 0.3 | 0.1 | |
| Escape SeparationTokens=12.1, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 4.9 | 4 | 5.3 | 5.6 | |
| IgnoreTokens=18.1, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 9.1 | 3.7 | 8.3 | 12.2 | |
| CombinedTokens=29, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 13.8 | 1.8 | 9.6 | 5.3 | |
| No Fake ReasoningTokens=54.7, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Variation=Ablation Study2026.01 | 35.3 | 39.6 | 33.3 | 34.2 | |
| Random CriteriaTokens=201, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Variation=Ablation Study2026.01 | 42.1 | 42.8 | 40.9 | 39.9 | |
| Double CriteriaTokens=200.3, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Method Class=Criteria Attack2026.01 | 78.2 | 77.4 | 72.5 | 74.9 | |
| Single CriteriaTokens=165.5, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Variation=Ablation Study2026.01 | 91.4 | 89.6 | 90.8 | 88 | |
| Topic AttackTokens=401.1, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 100 | 100 | 100 | 100 |