Targeted Attack on InjecAgent
48ASR@3No Defense
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| No DefenseTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 48 | — | — | |
| No DefenseTopology=Tree2025.12 | 47.97 | — | — | |
| No DefenseTopology=Chain2025.12 | 45.9 | — | — | |
| No DefenseTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 45.05 | — | — | |
| No DefenseTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 43.57 | — | — | |
| No DefenseTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 39.78 | — | — | |
| No DefenseTopology=Star2025.12 | 39.19 | — | — | |
| TAMTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 35.78 | 52 | — | |
| TAMTopology=Random2025.12 | 34.83 | 52 | — | |
| TAMTopology=Star2025.12 | 33.82 | 70.67 | — | |
| No DefenseTopology=Random2025.12 | 32.38 | — | — | |
| TAMTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 32.01 | 61.33 | — | |
| TAMTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 30.04 | 61.33 | — | |
| TAMTopology=Chain2025.12 | 29.89 | 60.44 | — | |
| TAMTopology=Tree2025.12 | 29.14 | 58.22 | — | |
| TAMTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 26.57 | 71.11 | — | |
| BlindGuardTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 17.69 | 79.56 | — | |
| DOMINANTTopology=Star2025.12 | 17.54 | 87.11 | — | |
| BlindGuardTopology=Tree2025.12 | 17.42 | 83.56 | — | |
| BlindGuardTopology=Chain2025.12 | 16.78 | 84.89 | — | |
| BlindGuardTopology=Random2025.12 | 16.55 | 80.44 | — | |
| BlindGuardTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 16.38 | 86.22 | — | |
| PREMTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 16.21 | 85.78 | — | |
| PREMTopology=Chain2025.12 | 15.79 | 86.22 | — | |
| DOMINANTTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 15.33 | 88.44 | — | |
| DOMINANTTopology=Chain2025.12 | 15.22 | 87.56 | — | |
| PREMTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 15.17 | 89.33 | — | |
| DOMINANTTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 14.98 | 88 | — | |
| DOMINANTTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 14.93 | 84.63 | — | |
| PREMTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 14.68 | 93.78 | — | |
| PREMTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 14.49 | 86.22 | — | |
| DOMINANTTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 14.33 | 89.33 | — | |
| PREMTopology=Tree2025.12 | 14.19 | 86.67 | — | |
| PREMTopology=Random2025.12 | 13.7 | 86.22 | — | |
| BlindGuardTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 12.59 | 93.78 | — | |
| BlindGuardTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 12.5 | 85.78 | — | |
| DOMINANTTopology=Tree2025.12 | 12.41 | 89.78 | — | |
| G-SafeguardTopology=Chain, Backbone LLM=GPT-4o-mini2025.08 | 10.24 | 100 | — | |
| PREMTopology=Star2025.12 | 9.59 | 96.44 | — | |
| XG-GuardTopology=Chain2025.12 | 9.49 | 99.56 | — | |
| G-SafeguardTopology=Chain2025.12 | 9.21 | 100 | — | |
| BlindGuardTopology=Star2025.12 | 9.15 | 94.22 | — | |
| XG-GuardTopology=Tree2025.12 | 7.93 | 99.56 | — | |
| DOMINANTTopology=Random2025.12 | 7.75 | 86.22 | — | |
| G-SafeguardTopology=Tree2025.12 | 7.07 | 100 | — | |
| G-SafeguardTopology=Star, Backbone LLM=GPT-4o-mini2025.08 | 6.87 | 100 | — | |
| XG-GuardTopology=Random2025.12 | 6.57 | 98.67 | — | |
| G-SafeguardTopology=Star2025.12 | 6.44 | 100 | — | |
| G-SafeguardTopology=Random2025.12 | 6.16 | 97.78 | — | |
| XG-GuardTopology=Star2025.12 | 5.19 | 99.11 | — | |
| G-SafeguardTopology=Random, Backbone LLM=GPT-4o-mini2025.08 | 5.14 | 98.22 | — | |
| G-SafeguardTopology=Tree, Backbone LLM=GPT-4o-mini2025.08 | 4.76 | 100 | — | |
| INFA-GUARDBackbone=Qwen3-235B-A22B2026.01 | 3.7 | — | 98.3 | |
| INFA-GUARDBackbone=GPT-4o-mini2026.01 | 2.1 | — | 98.3 | |
| AgentSafeBackbone=Qwen3-235B-A22B2026.01 | 0.3 | — | 100 |