Spam Email Detection on Spam Email (ASR Robustness)
401.1Token CountTopic
Evaluation Results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| TopicVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 401.1 | 93.5 | 73.1 | 84.2 | 94.3 | |
| Random Criteria (Ablation)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 201 | 89.9 | 88.1 | 89.3 | 89 | |
| Criteria Attack (Double Criteria)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 200.3 | 96.1 | 96.1 | 96.1 | 96.1 | |
| Single Criteria (Ablation)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 165.5 | 96.1 | 95.8 | 96.1 | 96.1 | |
| No Fake Reasoning (Ablation)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 54.7 | 45.5 | 33.7 | 49 | 49.6 | |
| Separator InjectionVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 48.9 | 99.7 | 17.9 | 94 | 95.5 | |
| CombinedVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 29 | 100 | 67.8 | 100 | 100 | |
| Fake CompletionVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 23 | 99.1 | 71.6 | 100 | 98.8 | |
| IgnoreVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 18.1 | 100 | 21.8 | 80 | 90.4 | |
| Escape SeparationVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 12.1 | 35.1 | 21.5 | 32.8 | 37.9 |