Toxic Comment Classification on Toxic Comment
401.1Average TokensTopic
Evaluation results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| TopicVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 401.1 | 100 | 99.9 | 99.9 | 99.7 | |
| Random Criteria (Ablation)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 201 | 70.7 | 68.2 | 72.2 | 73 | |
| Criteria Attack (Double Criteria)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 200.3 | 93.7 | 94.2 | 95.7 | 94.2 | |
| Single Criteria (Ablation)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 165.5 | 91.9 | 92.2 | 94.8 | 92.3 | |
| No Fake Reasoning (Ablation)Victim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 54.7 | 54.8 | 55.3 | 49.7 | 57.2 | |
| Separator InjectionVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 48.9 | 78.7 | 55.3 | 57.4 | 86.6 | |
| CombinedVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 29 | 100 | 25.6 | 65.8 | 100 | |
| Fake CompletionVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 23 | 38.8 | 27.7 | 33.1 | 66.1 | |
| IgnoreVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 18.1 | 98.7 | 4.7 | 15 | 97.7 | |
| Escape SeparationVictim Model=Gemma-3-27B, Attacker Model=Qwen3-30B2026.01 | 12.1 | 47.7 | 27.8 | 29.5 | 45.5 |