Text Classification on DBPedia (ACC, ASR)
97.68AccuracyICL
Evaluation results
| Method | Links | ||
|---|---|---|---|
| ICLBackbone=LLaMA-3.1-8B2026.05 | 97.68 | — | |
| ICLBackbone=Qwen-2.5-7B2026.05 | 97.32 | — | |
| ICLBackbone=Qwen-3-8B2026.05 | 97.31 | — | |
| ICLBackbone=LLaMA-2-13B2026.05 | 96.88 | — | |
| Word TriggerVictim Model=GPT-4, Trigger Type=Word2026.04 | 96.07 | 100 | |
| BADSTYLEVictim Model=GPT-4, Trigger Style=Shakespeare2026.04 | 95.71 | 100 | |
| BADSTYLEVictim Model=GPT-4, Trigger Style=Informal2026.04 | 95.71 | 93.21 | |
| BaselineVictim Model=GPT-42026.04 | 95.36 | — | |
| BADSTYLEVictim Model=GPT-4, Trigger Style=Structure2026.04 | 95.36 | 98.21 | |
| Sentence TriggerVictim Model=GPT-4, Trigger Type=Sentence2026.04 | 95 | 100 | |
| BADSTYLEVictim Model=GPT-4, Trigger Style=Bible2026.04 | 95 | 99.29 | |
| CleanModel=Deepseek-v3.2, Attack Level=word-level2026.02 | 94.89 | 7.14 | |
| BADSTYLEVictim Model=GPT-4, Trigger Style=Poetry2026.04 | 94.64 | 99.29 | |
| ICLBackbone=LLaMA-2-7B2026.05 | 94.44 | — | |
| CleanModel=Gemini-2.5, Attack Level=word-level2026.02 | 94.25 | 7.14 | |
| LTVBackbone=Qwen-3-8B2026.05 | 94.2 | — | |
| BadTemplateModel=Deepseek-v3.2, Attack Level=word-level2026.02 | 94.03 | 99.96 | |
| BadTemplateModel=Gemini-2.5, Attack Level=word-level2026.02 | 93.89 | 99.85 | |
| BADSTYLEVictim Model=GPT-4, Trigger Style=Legal2026.04 | 93.57 | 100 | |
| LTVBackbone=LLaMA-3.1-8B2026.05 | 93.36 | — | |
| LTVBackbone=LLaMA-2-13B2026.05 | 93.2 | — | |
| BaselineVictim Model=DeepSeek-32B2026.04 | 92.71 | — | |
| BaselineVictim Model=Phi-42026.04 | 92.5 | — | |
| BaselineVictim Model=GPT-3.52026.04 | 92.5 | — | |
| Sentence TriggerVictim Model=DeepSeek-32B, Trigger Type=Sentence2026.04 | 92.29 | 99.79 | |
| BADSTYLEVictim Model=DeepSeek-32B, Trigger Style=Bible2026.04 | 92.29 | 70.36 | |
| Word TriggerVictim Model=DeepSeek-32B, Trigger Type=Word2026.04 | 92.14 | 62.79 | |
| BADSTYLEVictim Model=DeepSeek-32B, Trigger Style=Poetry2026.04 | 92.14 | 91.5 | |
| BADSTYLEVictim Model=DeepSeek-32B, Trigger Style=Shakespeare2026.04 | 92.07 | 84.07 | |
| Word TriggerVictim Model=Phi-4, Trigger Type=Word2026.04 | 91.86 | 66 | |
| BADSTYLEVictim Model=GPT-3.5, Trigger Style=Informal2026.04 | 91.79 | 94.29 | |
| BADSTYLEVictim Model=DeepSeek-32B, Trigger Style=Structure2026.04 | 91.57 | 91.43 | |
| CleanModel=GPT-4o-mini, Attack Level=word-level2026.02 | 91.46 | 7.14 | |
| Word TriggerVictim Model=GPT-3.5, Trigger Type=Word2026.04 | 91.43 | 71.43 | |
| BADSTYLEVictim Model=GPT-3.5, Trigger Style=Poetry2026.04 | 91.43 | 99.29 | |
| BADSTYLEVictim Model=Phi-4, Trigger Style=Poetry2026.04 | 91.21 | 82.64 | |
| Sentence TriggerVictim Model=GPT-3.5, Trigger Type=Sentence2026.04 | 91.07 | 98.57 | |
| BADSTYLEVictim Model=Phi-4, Trigger Style=Bible2026.04 | 91.07 | 52.43 | |
| BADSTYLEVictim Model=GPT-3.5, Trigger Style=Bible2026.04 | 91.07 | 94.29 | |
| BADSTYLEVictim Model=GPT-3.5, Trigger Style=Shakespeare2026.04 | 91.07 | 93.57 | |
| BADSTYLEVictim Model=DeepSeek-32B, Trigger Style=Legal2026.04 | 91.07 | 75.36 | |
| BADSTYLEVictim Model=GPT-3.5, Trigger Style=Structure2026.04 | 91.07 | 99.64 | |
| BADSTYLEVictim Model=DeepSeek-32B, Trigger Style=Informal2026.04 | 90.93 | 37.57 | |
| BADSTYLEVictim Model=Phi-4, Trigger Style=Shakespeare2026.04 | 90.79 | 58.93 | |
| BADSTYLEVictim Model=Phi-4, Trigger Style=Informal2026.04 | 90.79 | 68.64 | |
| LTVBackbone=Qwen-2.5-7B2026.05 | 90.68 | — | |
| Sentence TriggerVictim Model=Phi-4, Trigger Type=Sentence2026.04 | 90.64 | 99.64 | |
| BADSTYLEVictim Model=GPT-3.5, Trigger Style=Legal2026.04 | 90.64 | 98.93 | |
| BaselineVictim Model=LLaMA-3.12026.04 | 90.43 | — | |
| BADSTYLEVictim Model=Phi-4, Trigger Style=Legal2026.04 | 90.43 | 84.93 | |
| State VectorBackbone=LLaMA-2-7B2026.05 | 90.36 | — | |
| BADSTYLEVictim Model=Phi-4, Trigger Style=Structure2026.04 | 90.29 | 49.5 | |
| BadTemplateModel=GPT-4o-mini, Attack Level=word-level2026.02 | 90.25 | 100 | |
| BaselineVictim Model=DeepSeek-14B2026.04 | 90 | — | |
| Sentence TriggerVictim Model=LLaMA-3.1, Trigger Type=Sentence2026.04 | 89.79 | 97.79 | |
| BADSTYLEVictim Model=DeepSeek-14B, Trigger Style=Legal2026.04 | 89.57 | 43.71 | |
| Sentence TriggerVictim Model=DeepSeek-14B, Trigger Type=Sentence2026.04 | 89.5 | 96.71 | |
| BADSTYLEVictim Model=DeepSeek-14B, Trigger Style=Bible2026.04 | 89.5 | 71.93 | |
| State VectorBackbone=LLaMA-2-13B2026.05 | 89.48 | — | |
| BADSTYLEVictim Model=DeepSeek-14B, Trigger Style=Structure2026.04 | 89.43 | 88 | |
| BADSTYLEVictim Model=LLaMA-3.1, Trigger Style=Poetry2026.04 | 89.36 | 99.86 | |
| BADSTYLEVictim Model=DeepSeek-14B, Trigger Style=Shakespeare2026.04 | 89.36 | 42.21 | |
| BADSTYLEVictim Model=DeepSeek-14B, Trigger Style=Poetry2026.04 | 89.29 | 75.79 | |
| Word TriggerVictim Model=DeepSeek-14B, Trigger Type=Word2026.04 | 89.21 | 65.14 | |
| Word TriggerVictim Model=LLaMA-3.1, Trigger Type=Word2026.04 | 89.07 | 72.86 | |
| BADSTYLEVictim Model=LLaMA-3.1, Trigger Style=Shakespeare2026.04 | 89 | 88.64 | |
| LTVBackbone=LLaMA-2-7B2026.05 | 88.84 | — | |
| BADSTYLEVictim Model=DeepSeek-14B, Trigger Style=Informal2026.04 | 88.79 | 20.93 | |
| BADSTYLEVictim Model=LLaMA-3.1, Trigger Style=Bible2026.04 | 88.71 | 91.71 | |
| BADSTYLEVictim Model=LLaMA-3.1, Trigger Style=Legal2026.04 | 88.43 | 68.43 | |
| BADSTYLEVictim Model=Mistral, Trigger Style=Bible2026.04 | 88.36 | 54.07 | |
| BADSTYLEVictim Model=LLaMA-3.1, Trigger Style=Informal2026.04 | 87.79 | 74.14 | |
| BADSTYLEVictim Model=Mistral, Trigger Style=Poetry2026.04 | 87.71 | 49.93 | |
| BADSTYLEVictim Model=Mistral, Trigger Style=Structure2026.04 | 87.71 | 42.14 | |
| Sentence TriggerVictim Model=Mistral, Trigger Type=Sentence2026.04 | 87.57 | 39.86 | |
| BADSTYLEVictim Model=Mistral, Trigger Style=Shakespeare2026.04 | 87.43 | 41 | |
| BaselineVictim Model=Mistral2026.04 | 87.36 | — | |
| BADSTYLEVictim Model=Mistral, Trigger Style=Legal2026.04 | 87.29 | 56.93 | |
| Word TriggerVictim Model=Mistral, Trigger Type=Word2026.04 | 87.21 | 17.93 | |
| BADSTYLEVictim Model=LLaMA-3.1, Trigger Style=Structure2026.04 | 86.93 | 99.71 | |
| BADSTYLEVictim Model=Mistral, Trigger Style=Informal2026.04 | 86.07 | 31.64 | |
| State VectorBackbone=Qwen-3-8B2026.05 | 84.4 | — | |
| Task VectorBackbone=LLaMA-3.1-8B2026.05 | 83.24 | — | |
| Task VectorBackbone=Qwen-3-8B2026.05 | 81.49 | — | |
| State VectorBackbone=LLaMA-3.1-8B2026.05 | 80.8 | — | |
| Task VectorBackbone=LLaMA-2-13B2026.05 | 80.72 | — | |
| I2CLBackbone=LLaMA-2-13B2026.05 | 79 | — | |
| Task VectorBackbone=LLaMA-2-7B2026.05 | 78.68 | — | |
| Task VectorBackbone=Qwen-2.5-7B2026.05 | 78.52 | — | |
| Function VectorBackbone=Qwen-3-8B2026.05 | 77.74 | — | |
| State VectorBackbone=Qwen-2.5-7B2026.05 | 76.88 | — | |
| Function VectorBackbone=LLaMA-2-13B2026.05 | 76.4 | — | |
| Zero-shotBackbone=LLaMA-2-13B2026.05 | 76.2 | — | |
| I2CLBackbone=LLaMA-2-7B2026.05 | 76 | — | |
| I2CLBackbone=Qwen-2.5-7B2026.05 | 75.68 | — | |
| Function VectorBackbone=Qwen-2.5-7B2026.05 | 75.56 | — | |
| Zero-shotBackbone=Qwen-2.5-7B2026.05 | 74.8 | — | |
| Zero-shotBackbone=Qwen-3-8B2026.05 | 74.6 | — | |
| I2CLBackbone=Qwen-3-8B2026.05 | 74.51 | — | |
| Function VectorBackbone=LLaMA-2-7B2026.05 | 73.88 | — |