Prompt Injection on Toxic Comment
100ASR (None)Topic Attack
Evaluation Results
| Method | Links | ||||
|---|---|---|---|---|---|
| Topic AttackTokens=401.1, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 100 | 100 | 100 | 100 | |
| Double CriteriaTokens=200.3, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Method Class=Criteria Attack2026.01 | 89.9 | 85.4 | 81.4 | 91.5 | |
| Single CriteriaTokens=165.5, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Variation=Ablation Study2026.01 | 86.6 | 83.5 | 83.7 | 85.3 | |
| Random CriteriaTokens=201, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Variation=Ablation Study2026.01 | 68.5 | 63 | 62.3 | 68.1 | |
| No Fake ReasoningTokens=54.7, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B, Variation=Ablation Study2026.01 | 61.6 | 56.9 | 49.7 | 63.7 | |
| CombinedTokens=29, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 55.2 | 7.5 | 7.2 | 30.5 | |
| IgnoreTokens=18.1, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 20.5 | 17.7 | 15.9 | 17.7 | |
| Escape SeparationTokens=12.1, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 8 | 9.5 | 9 | 9 | |
| Fake CompletionTokens=23, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 4.9 | 4.4 | 3.7 | 5.6 | |
| Separator InjectionTokens=48.9, Victim Model=Qwen3-4B, Attacker Model=Qwen3-30B2026.01 | 0 | 0 | 0 | 0.4 |