Findings/static-defense-results-hold

Published prompt-injection defenses report attack success cut to near zero, or under 10%, against most of the fixed attacks their authors tested.

Revalidatemeasured4 evidence records from 4 independent sourcesassistant-drafted

Scope: what this does not show

Results against fixed or known attacks, as reported by each defense's authors. StruQ's authors report 9% (TAP) and 58% (GCG) success on Llama for their strongest optimization attacks, and the instruction-hierarchy paper reports robustness gains rather than attack success rates. Says nothing about attackers who adapt to the defense.

Revalidate: Older than its half-life with no newer evidence. May no longer hold.

Evidence

Feb 9, 2024

StruQ proposes separating prompts and data channels to defend against prompt injection

arXiv

Mar 20, 2024

Microsoft researchers propose spotlighting to mark untrusted input against indirect prompt injection

arXiv

Apr 19, 2024

OpenAI trains models to prioritize privileged instructions via an instruction hierarchy

arXiv

Oct 7, 2024

SecAlign uses preference optimization to train LLMs against prompt injection

arXiv

How it relates to other findings

supportsqualifiescontestssupersedes

ReportedCorroboratedQualifiedContestedSupersededRevalidate· node size = evidence records · columns group by topic

Select a finding to see how it relates to others. Arrows point from the newer finding to the one it supports, qualifies, contests, or supersedes.

Attackers who adapt to a defense defeat most published prompt-injection defenses that reported near-zero success against static attacks. qualifies this findingThe defenses' low static attack success does not carry over to adaptive attackers, which that finding's scope already excludes.

Status history

2024-02-09ReportedStruQ reports reduced injection success. · record
2024-03-20CorroboratedMicrosoft reports spotlighting cuts injection success below 2% on static attacks. · record
2025-05-20ContestedGoogle DeepMind finds adaptive attacks exceed 90% success against spotlighting-style defenses on Gemini. · record
2026-09-25QualifiedcorrectionAdaptive-attack results narrow this finding rather than dispute it, since its scope is limited to fixed attacks. The earlier entry's figure was wrong: spotlighting peaked at 82.4% under adaptive attack on Gemini, not above 90%. · record
2026-09-26RevalidateComputed: 494 days since the last evidence, past the 365-day half-life.

What would change this: Defenses that hold under independent adaptive attack.
Evidence kind: measured: An experiment or evaluation produced the number.
Freshness: Evidence 494d old · past its 365-day recheckNewest evidence May 20, 2025. Half-life 365 days.
Methods tested: Indirect prompt injection Delimiting untrusted input Training models to prioritize instructions
Topics: Prompt injection

Cite this record

Fide AI. "Published prompt-injection defenses report attack success cut to near zero, or under 10%, against most of the fixed attacks their authors tested.." Agentic Cyber Explorer, record static-defense-results-hold. https://agentic-cyber-explorer.pages.dev/findings/static-defense-results-hold/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-static-defense-results-hold,
  author = {{Fide AI}},
  title = {Published prompt-injection defenses report attack success cut to near zero, or under 10\%, against most of the fixed attacks their authors tested.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/static-defense-results-hold/},
  note = {Record static-defense-results-hold; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.