Targeted Attack Detection on Alpaca OnlyTarget Medium
100TPRPPL
Evaluation results
| Method | Links | ||
|---|---|---|---|
| PPLModel=LlaMA2 13B, Attacks=Ignore2026.03 | 100 | 100 | |
| CleanGenModel=LlaMA2 13B, Attacks=Ignore2026.03 | 100 | 100 | |
| PPLModel=LlaMA2 13B, Attacks=Complete2026.03 | 100 | 100 | |
| CleanGenModel=LlaMA2 13B, Attacks=Complete2026.03 | 100 | 100 | |
| ConfGuardModel=LlaMA2 13B, Attacks=Complete2026.03 | 100 | 31.7 | |
| PPLModel=LlaMA2 13B, Attacks=Tree2026.03 | 100 | 100 | |
| CleanGenModel=LlaMA2 13B, Attacks=Tree2026.03 | 100 | 100 | |
| ONIONModel=LlaMA2 13B, Attacks=System2026.03 | 100 | 67.1 | |
| CleanGenModel=LlaMA2 13B, Attacks=System2026.03 | 100 | 100 | |
| ConfGuardModel=LlaMA2 13B, Attacks=System2026.03 | 100 | 31.7 | |
| CleanGenModel=Qwen2.5 7B, Attacks=Word2026.03 | 100 | 76.92 | |
| CleanGenModel=Qwen2.5 7B, Attacks=Phrase2026.03 | 100 | 79.6 | |
| CleanGenModel=Qwen2.5 7B, Attacks=Sentence2026.03 | 100 | 77.73 | |
| ConfGuardModel=Qwen2.5 7B, Attacks=Sentence2026.03 | 100 | 19.71 | |
| STRIPModel=Qwen2.5 7B, Attacks=Joint2026.03 | 100 | 70.61 | |
| CleanGenModel=Qwen2.5 7B, Attacks=Joint2026.03 | 100 | 82.66 | |
| ConfGuardModel=Qwen2.5 7B, Attacks=Joint2026.03 | 100 | 19.47 | |
| ConfGuardModel=Qwen2.5 7B, Attacks=Word2026.03 | 99.79 | 17.9 | |
| DualSentinelModel=Qwen2.5 7B, Attacks=Joint2026.03 | 99.79 | 8.66 | |
| DualSentinelModel=LlaMA2 13B, Attacks=Complete2026.03 | 99.6 | 16 | |
| STRIPModel=Qwen2.5 7B, Attacks=Word2026.03 | 99.6 | 75.4 | |
| PPLModel=Qwen2.5 7B, Attacks=Joint2026.03 | 99.6 | 34.28 | |
| ConfGuardModel=Qwen2.5 7B, Attacks=Phrase2026.03 | 99.59 | 20.8 | |
| ConfGuardModel=LlaMA2 13B, Attacks=Tree2026.03 | 99.2 | 31.7 | |
| DualSentinelModel=Qwen2.5 7B, Attacks=Word2026.03 | 99.19 | 8.26 | |
| DualSentinelModel=Qwen2.5 7B, Attacks=Sentence2026.03 | 99 | 7.48 | |
| PPLModel=Qwen2.5 7B, Attacks=Phrase2026.03 | 98.79 | 34 | |
| STRIPModel=Qwen2.5 7B, Attacks=Phrase2026.03 | 98.79 | 76.11 | |
| ConfGuardModel=LlaMA2 13B, Attacks=Ignore2026.03 | 98.7 | 31.7 | |
| DualSentinelModel=Qwen2.5 7B, Attacks=Phrase2026.03 | 98.59 | 9.41 | |
| STRIPModel=Qwen2.5 7B, Attacks=Sentence2026.03 | 98.39 | 78.83 | |
| PPLModel=LlaMA2 13B, Attacks=System2026.03 | 97.59 | 100 | |
| DualSentinelModel=LlaMA2 13B, Attacks=Ignore2026.03 | 95.23 | 16 | |
| DualSentinelModel=LlaMA2 13B, Attacks=System2026.03 | 93.25 | 16 | |
| PPLModel=Qwen2.5 7B, Attacks=Word2026.03 | 92.4 | 34.01 | |
| STRIPModel=LlaMA2 13B, Attacks=Tree2026.03 | 89.5 | 74 | |
| ONIONModel=LlaMA2 13B, Attacks=Complete2026.03 | 86.81 | 67.1 | |
| DualSentinelModel=LlaMA2 13B, Attacks=Tree2026.03 | 86.65 | 16 | |
| STRIPModel=LlaMA2 13B, Attacks=System2026.03 | 82.78 | 74 | |
| PPLModel=Qwen2.5 7B, Attacks=Sentence2026.03 | 76.7 | 33.6 | |
| STRIPModel=LlaMA2 13B, Attacks=Complete2026.03 | 75.82 | 74 | |
| STRIPModel=LlaMA2 13B, Attacks=Ignore2026.03 | 70.39 | 74 | |
| ONIONModel=Qwen2.5 7B, Attacks=Word2026.03 | 66 | 0.81 | |
| ONIONModel=Qwen2.5 7B, Attacks=Joint2026.03 | 51.2 | 0.81 | |
| ONIONModel=LlaMA2 13B, Attacks=Tree2026.03 | 49.56 | 67.1 | |
| ONIONModel=LlaMA2 13B, Attacks=Ignore2026.03 | 46.67 | 67.1 | |
| ParagraphModel=Qwen2.5 7B, Attacks=Phrase2026.03 | 43.54 | 40.48 | |
| ParagraphModel=Qwen2.5 7B, Attacks=Word2026.03 | 43.2 | 47.54 | |
| ParagraphModel=Qwen2.5 7B, Attacks=Sentence2026.03 | 23.29 | 45.64 | |
| ParagraphModel=LlaMA2 13B, Attacks=Ignore2026.03 | 9.21 | 6 | |
| ParagraphModel=LlaMA2 13B, Attacks=Complete2026.03 | 4.74 | 6 | |
| ParagraphModel=Qwen2.5 7B, Attacks=Joint2026.03 | 3.2 | 45.71 | |
| ParagraphModel=LlaMA2 13B, Attacks=System2026.03 | 3.07 | 6 | |
| ONIONModel=Qwen2.5 7B, Attacks=Phrase2026.03 | 1.61 | 0.8 | |
| ParagraphModel=LlaMA2 13B, Attacks=Tree2026.03 | 1.44 | 6 | |
| ONIONModel=Qwen2.5 7B, Attacks=Sentence2026.03 | 0.8 | 0.82 |