{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/deepmind-gemini-ipi-lessons-2025/",
 "asOf": "2026-09-26",
 "id": "deepmind-gemini-ipi-lessons-2025",
 "date": "2025-05-20",
 "datePrecision": "day",
 "title": "Google DeepMind reports lessons from continuously attacking Gemini with adaptive prompt injections",
 "lane": "defense",
 "kind": "paper",
 "summary": "Shi and colleagues describe Google DeepMind's continuous adaptive-attack evaluation of Gemini against indirect prompt injection in tool-use settings. On Gemini 2.0, adaptive attacks generally matched or beat non-adaptive ones against eight baseline defenses, reaching 98.4% against in-context learning and 82.4% against spotlighting, while a warning defense and a user-instruction classifier held (at most 10.8% and 3.0%). Adversarial fine-tuning for Gemini 2.5 lowered but did not eliminate attack success.",
 "whyItMatters": "A frontier developer documented that static-benchmark defense numbers overstate robustness.",
 "actors": [
  "google-deepmind"
 ],
 "topics": [
  "prompt-injection",
  "eval-validity"
 ],
 "atlas": [
  "untrusted-content",
  "model",
  "tools"
 ],
 "artifacts": [
  "spotlighting",
  "gemini"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2505.14534",
   "publisher": "arXiv",
   "title": "Lessons from Defending Gemini Against Indirect Prompt Injections",
   "date": "2025-05-20",
   "type": "primary",
   "accessed": "2026-09-25"
  },
  {
   "url": "https://arxiv.org/html/2505.14534",
   "publisher": "arXiv",
   "title": "Lessons from Defending Gemini Against Indirect Prompt Injections (HTML)",
   "date": "2025-05-20",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Against undefended Gemini 2.0, at least one of three adaptive attacks succeeded on over 70% of test examples in every setting; TAP reached close to 100% in nearly all settings.",
   "locator": "Section 6, Figure 4"
  },
  {
   "fact": "Adaptive attacks on Gemini 2.0 with defenses (calendar, passport scenario): peak ASR 98.4% against ICL, 95.2% against paraphrasing and 82.4% against spotlighting; Warning at most 10.8% and the user-instruction classifier at most 3.0%.",
   "locator": "Section 8; Appendix E, Table 4"
  },
  {
   "fact": "In 16 of 24 defense-attack pairs the adaptive attack matched or beat the non-adaptive one.",
   "locator": "Section 8.2, Figure 6"
  },
  {
   "fact": "Adversarially trained Gemini 2.5 vs Gemini 2.0, no external defenses: email/passport TAP 53.6% vs 99.8% and Actor-Critic 40.8% vs 66.2%; calendar/passport TAP 94.6% vs 100%. Adding the Warning defense to Gemini 2.5 cut calendar TAP to 6.2%.",
   "locator": "Section 9.1, Table 1; Section 9.2"
  }
 ],
 "significance": 4,
 "fideQuestions": [
  "FID-075"
 ],
 "methods": [
  "adaptive-red-teaming",
  "indirect-prompt-injection",
  "injection-classifiers",
  "input-delimiting",
  "instruction-priority-training"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}