Targeted Prompt Injection on ExpediaBooking
100Attack Success RateTIP
Evaluation results
| Method | Links | |
|---|---|---|
| TIPDefense=No Defense, Victim Model=Llama3.1-8B-Instruct2026.03 | 100 | |
| TIPDefense=No Defense, Victim Model=Qwen2.5-72B-Instruct2026.03 | 100 | |
| TIPDefense=No Defense, Victim Model=Llama3.3-70B-Instruct2026.03 | 100 | |
| TIPDefense=Perplexity Filtering, Victim Model=Qwen2.5-72B-Instruct2026.03 | 100 | |
| TIPDefense=Perplexity Filtering, Victim Model=Llama3.3-70B-Instruct2026.03 | 100 | |
| TIPDefense=Perplexity Filtering, Victim Model=Llama3.1-8B-Instruct2026.03 | 98 | |
| FixedDefense=Perplexity Filtering, Victim Model=Llama3.3-70B-Instruct2026.03 | 98 | |
| TIPDefense=Sandwich Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 96 | |
| TIPDefense=Finetuned Detector, Victim Model=Qwen2.5-72B-Instruct2026.03 | 96 | |
| TIPDefense=Finetuned Detector, Victim Model=Llama3.3-70B-Instruct2026.03 | 96 | |
| TIPDefense=Finetuned Detector, Victim Model=Llama3.1-8B-Instruct2026.03 | 93 | |
| TIPDefense=Instruction Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 91.4 | |
| FixedDefense=Sandwich Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 87 | |
| TIPDefense=Sandwich Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 87 | |
| FixedDefense=No Defense, Victim Model=Llama3.1-8B-Instruct2026.03 | 85.9 | |
| TIPDefense=Instruction Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 77 | |
| FixedDefense=Instruction Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 59.6 | |
| TAPDefense=No Defense, Victim Model=Llama3.1-8B-Instruct2026.03 | 54.7 | |
| TIPDefense=Instruction Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 53.1 | |
| FixedDefense=Perplexity Filtering, Victim Model=Llama3.1-8B-Instruct2026.03 | 50 | |
| TIPDefense=Sandwich Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 49.5 | |
| TAPDefense=Finetuned Detector, Victim Model=Llama3.3-70B-Instruct2026.03 | 45 | |
| TAPDefense=Perplexity Filtering, Victim Model=Llama3.3-70B-Instruct2026.03 | 45 | |
| FixedDefense=No Defense, Victim Model=Qwen2.5-72B-Instruct2026.03 | 43 | |
| FixedDefense=Perplexity Filtering, Victim Model=Qwen2.5-72B-Instruct2026.03 | 24 | |
| TAPDefense=Finetuned Detector, Victim Model=Llama3.1-8B-Instruct2026.03 | 23 | |
| TAPDefense=Perplexity Filtering, Victim Model=Llama3.1-8B-Instruct2026.03 | 23 | |
| TAPDefense=Sandwich Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 11 | |
| FixedDefense=Sandwich Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 6 | |
| FixedDefense=Sandwich Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 5 | |
| TAPDefense=Instruction Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 4.8 | |
| FixedDefense=Instruction Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 1 | |
| TAPDefense=Finetuned Detector, Victim Model=Qwen2.5-72B-Instruct2026.03 | 1 | |
| TAPDefense=Perplexity Filtering, Victim Model=Qwen2.5-72B-Instruct2026.03 | 1 | |
| TAPDefense=No Defense, Victim Model=Qwen2.5-72B-Instruct2026.03 | 0 | |
| FixedDefense=No Defense, Victim Model=Llama3.3-70B-Instruct2026.03 | 0 | |
| TAPDefense=No Defense, Victim Model=Llama3.3-70B-Instruct2026.03 | 0 | |
| TAPDefense=Instruction Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 0 | |
| FixedDefense=Instruction Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 0 | |
| TAPDefense=Instruction Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 0 | |
| TAPDefense=Sandwich Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 0 | |
| TAPDefense=Sandwich Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 0 | |
| FixedDefense=Finetuned Detector, Victim Model=Llama3.1-8B-Instruct2026.03 | 0 | |
| FixedDefense=Finetuned Detector, Victim Model=Qwen2.5-72B-Instruct2026.03 | 0 | |
| FixedDefense=Finetuned Detector, Victim Model=Llama3.3-70B-Instruct2026.03 | 0 |