{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/findings/adaptive-attacks-defeat-published-defenses/",
 "asOf": "2026-09-26",
 "id": "adaptive-attacks-defeat-published-defenses",
 "claim": "Attackers who adapt to a defense defeat most published prompt-injection defenses that reported near-zero success against static attacks.",
 "evidenceKind": "measured",
 "scope": "Research defenses and research models. CaMeL-style architectural isolation was not among the defenses tested in the main adaptive-attack study.",
 "topics": [
  "prompt-injection",
  "eval-validity"
 ],
 "atlas": [
  "untrusted-content",
  "model"
 ],
 "evidence": [
  {
   "event": "us-aisi-agent-hijacking-evaluations-2025",
   "note": "Tested an undefended agent: novel attacks raised hijack rates from 11% to 81%. Shows attacks improve, not that defenses fail."
  },
  {
   "event": "deepmind-gemini-ipi-lessons-2025",
   "note": "Adaptive attacks exceeded 90% against 2 of 8 baseline defenses on Gemini 2.0; a warning defense and a user-instruction classifier held (at most 11%). Shares authors with 'The Attacker Moves Second'."
  },
  {
   "event": "attacker-moves-second-adaptive-attacks-2025",
   "note": "Adaptive attacks exceeded 90% against most of 12 defenses; human red-teamers succeeded on every challenge in the subset of defenses they were given."
  },
  {
   "event": "gray-swan-agent-red-teaming-competition-2025"
  }
 ],
 "relations": [
  {
   "type": "qualifies",
   "target": "static-defense-results-hold",
   "note": "The defenses' low static attack success does not carry over to adaptive attackers, which that finding's scope already excludes."
  },
  {
   "type": "qualifies",
   "target": "lab-defenses-reduce-not-eliminate",
   "note": "Research defenses with low static attack success failed under adaptive attack, so lab-reported rates against fixed attack sets may also overstate robustness."
  }
 ],
 "statusHistory": [
  {
   "status": "reported",
   "on": "2025-01-17",
   "why": "US AISI shows novel attacks raise hijack rates sharply.",
   "event": "us-aisi-agent-hijacking-evaluations-2025",
   "kind": "evidence"
  },
  {
   "status": "corroborated",
   "on": "2025-05-20",
   "why": "Google DeepMind independently reports adaptive attacks above 90% on Gemini.",
   "event": "deepmind-gemini-ipi-lessons-2025",
   "kind": "evidence"
  },
  {
   "status": "reported",
   "on": "2026-09-25",
   "why": "Correction: the 2025 US AISI and Google DeepMind entries did not test published defenses with near-zero reported success, and DeepMind shares authors with the primary study. 'The Attacker Moves Second' is the primary evidence; no independent replication is recorded yet.",
   "event": "attacker-moves-second-adaptive-attacks-2025",
   "kind": "correction"
  }
 ],
 "halfLifeDays": 540,
 "wouldChange": "An independent adaptive evaluation in which a published defense holds.",
 "fideQuestions": [
  "FID-075"
 ],
 "methods": [
  "adaptive-red-teaming",
  "indirect-prompt-injection",
  "injection-classifiers",
  "input-delimiting",
  "instruction-priority-training",
  "jailbreaking"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}