Targeted Prompt Injection on GetProduct
100Attack Success RateTIP
Evaluation results
| Method | Links | |
|---|---|---|
| TIPDefense=No Defense, Victim Model=Qwen2.5-72B-Instruct2026.03 | 100 | |
| TIPDefense=Finetuned Detector, Victim Model=Qwen2.5-72B-Instruct2026.03 | 100 | |
| TIPDefense=Perplexity Filtering, Victim Model=Qwen2.5-72B-Instruct2026.03 | 100 | |
| TIPDefense=Perplexity Filtering, Victim Model=Llama3.3-70B-Instruct2026.03 | 99 | |
| TAPDefense=No Defense, Victim Model=Qwen2.5-72B-Instruct2026.03 | 98 | |
| TIPDefense=No Defense, Victim Model=Llama3.3-70B-Instruct2026.03 | 98 | |
| TIPDefense=Sandwich Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 98 | |
| TIPDefense=Finetuned Detector, Victim Model=Llama3.3-70B-Instruct2026.03 | 98 | |
| TIPDefense=No Defense, Victim Model=Llama3.1-8B-Instruct2026.03 | 97.1 | |
| TIPDefense=Finetuned Detector, Victim Model=Llama3.1-8B-Instruct2026.03 | 97 | |
| TIPDefense=Instruction Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 95 | |
| TIPDefense=Sandwich Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 93.9 | |
| TIPDefense=Perplexity Filtering, Victim Model=Llama3.1-8B-Instruct2026.03 | 92.5 | |
| TIPDefense=Instruction Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 90.9 | |
| TIPDefense=Sandwich Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 85.1 | |
| TIPDefense=Instruction Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 70.1 | |
| FixedDefense=Finetuned Detector, Victim Model=Qwen2.5-72B-Instruct2026.03 | 50 | |
| TAPDefense=Instruction Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 49 | |
| FixedDefense=Perplexity Filtering, Victim Model=Qwen2.5-72B-Instruct2026.03 | 41 | |
| FixedDefense=No Defense, Victim Model=Qwen2.5-72B-Instruct2026.03 | 31 | |
| TAPDefense=Finetuned Detector, Victim Model=Qwen2.5-72B-Instruct2026.03 | 24 | |
| TAPDefense=Perplexity Filtering, Victim Model=Llama3.1-8B-Instruct2026.03 | 24 | |
| FixedDefense=Instruction Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 21 | |
| TAPDefense=Perplexity Filtering, Victim Model=Qwen2.5-72B-Instruct2026.03 | 17 | |
| FixedDefense=Sandwich Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 14.9 | |
| TAPDefense=Instruction Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 13.6 | |
| TAPDefense=Finetuned Detector, Victim Model=Llama3.1-8B-Instruct2026.03 | 12 | |
| TAPDefense=Finetuned Detector, Victim Model=Llama3.3-70B-Instruct2026.03 | 12 | |
| TAPDefense=Perplexity Filtering, Victim Model=Llama3.3-70B-Instruct2026.03 | 12 | |
| FixedDefense=Sandwich Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 10 | |
| TAPDefense=No Defense, Victim Model=Llama3.1-8B-Instruct2026.03 | 9 | |
| FixedDefense=Instruction Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 8.2 | |
| FixedDefense=Finetuned Detector, Victim Model=Llama3.1-8B-Instruct2026.03 | 7 | |
| TAPDefense=Sandwich Prevention, Victim Model=Llama3.1-8B-Instruct2026.03 | 5.1 | |
| FixedDefense=Perplexity Filtering, Victim Model=Llama3.1-8B-Instruct2026.03 | 5 | |
| FixedDefense=No Defense, Victim Model=Llama3.1-8B-Instruct2026.03 | 3.3 | |
| TAPDefense=Sandwich Prevention, Victim Model=Qwen2.5-72B-Instruct2026.03 | 2.3 | |
| FixedDefense=No Defense, Victim Model=Llama3.3-70B-Instruct2026.03 | 2 | |
| FixedDefense=Instruction Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 1 | |
| TAPDefense=Instruction Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 1 | |
| TAPDefense=Sandwich Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 1 | |
| FixedDefense=Finetuned Detector, Victim Model=Llama3.3-70B-Instruct2026.03 | 1 | |
| FixedDefense=Perplexity Filtering, Victim Model=Llama3.3-70B-Instruct2026.03 | 1 | |
| TAPDefense=No Defense, Victim Model=Llama3.3-70B-Instruct2026.03 | 0 | |
| FixedDefense=Sandwich Prevention, Victim Model=Llama3.3-70B-Instruct2026.03 | 0 |