Prompt Injection on Spam Email
0.3ASR (None Defense)Separator Injection
Evaluation Results
| Method | Links | ||||
|---|---|---|---|---|---|
| Separator InjectionTokens=48.9, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 0.3 | 0 | 0.3 | 0.3 | |
| Fake CompletionTokens=23, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 1.2 | 0.3 | 0.9 | 0.9 | |
| Escape SeparationTokens=12.1, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 9.1 | 7.8 | 10.6 | 9.1 | |
| IgnoreTokens=18.1, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 41.7 | 5 | 25.8 | 34 | |
| No Fake ReasoningTokens=54.7, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Variation=Ablation Study2026.01 | 59.2 | 48.9 | 48.8 | 67.2 | |
| Random CriteriaTokens=201, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Variation=Ablation Study2026.01 | 89.7 | 82.6 | 86.7 | 87.5 | |
| Single CriteriaTokens=165.5, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Variation=Ablation Study2026.01 | 90.3 | 85.4 | 92.1 | 90.3 | |
| Double CriteriaTokens=200.3, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Method Class=Criteria Attack2026.01 | 92.7 | 86.9 | 92.4 | 94.2 | |
| CombinedTokens=29, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 100 | 64.2 | 95.8 | 79 | |
| Topic AttackTokens=401.1, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 100 | 100 | 100 | 100 |