{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/findings/static-defense-results-hold/",
 "asOf": "2026-09-26",
 "id": "static-defense-results-hold",
 "claim": "Published prompt-injection defenses report attack success cut to near zero, or under 10%, against most of the fixed attacks their authors tested.",
 "evidenceKind": "measured",
 "scope": "Results against fixed or known attacks, as reported by each defense's authors. StruQ's authors report 9% (TAP) and 58% (GCG) success on Llama for their strongest optimization attacks, and the instruction-hierarchy paper reports robustness gains rather than attack success rates. Says nothing about attackers who adapt to the defense.",
 "topics": [
  "prompt-injection"
 ],
 "atlas": [],
 "evidence": [
  {
   "event": "struq-structured-queries-2024"
  },
  {
   "event": "microsoft-spotlighting-2024"
  },
  {
   "event": "openai-instruction-hierarchy-2024"
  },
  {
   "event": "secalign-preference-optimization-2024"
  }
 ],
 "relations": [],
 "statusHistory": [
  {
   "status": "reported",
   "on": "2024-02-09",
   "why": "StruQ reports reduced injection success.",
   "event": "struq-structured-queries-2024",
   "kind": "evidence"
  },
  {
   "status": "corroborated",
   "on": "2024-03-20",
   "why": "Microsoft reports spotlighting cuts injection success below 2% on static attacks.",
   "event": "microsoft-spotlighting-2024",
   "kind": "evidence"
  },
  {
   "status": "contested",
   "on": "2025-05-20",
   "why": "Google DeepMind finds adaptive attacks exceed 90% success against spotlighting-style defenses on Gemini.",
   "event": "deepmind-gemini-ipi-lessons-2025",
   "kind": "evidence"
  },
  {
   "status": "qualified",
   "on": "2026-09-25",
   "why": "Correction: adaptive-attack results narrow this finding rather than dispute it, since its scope is limited to fixed attacks. The earlier entry's figure was wrong: spotlighting peaked at 82.4% under adaptive attack on Gemini, not above 90%.",
   "event": "attacker-moves-second-adaptive-attacks-2025",
   "kind": "correction"
  }
 ],
 "halfLifeDays": 365,
 "wouldChange": "Defenses that hold under independent adaptive attack.",
 "fideQuestions": [],
 "methods": [
  "indirect-prompt-injection",
  "input-delimiting",
  "instruction-priority-training"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}