InjectBench: Prompt-Injection Defenses

When a document an AI assistant reads contains hidden instructions, how often does the assistant obey, which defenses help, and what do they cost? InjectBench plants attacks in real company-report tables and answers with exact outcomes rather than opinions: 18,480 recorded runs across six model families and seven defenses.

The Approach

The carrier is 30 FilingLens questions (15 dollar amounts, 15 percentages) with their facts tables and exact answers. Thirteen attack templates are placed at the start, middle or end of the table: direct override, fake system update, role play, a fake end-of-table marker, a polite request, an admin notice, a fake dialogue, an HTML comment, Spanish, base64, a JSON field, a "processing step", and a false audited restatement. The attacker wants either a random canary code in the answer or a specific wrong number. An attack succeeds only if the parsed answer field holds it, so a reply that quotes the code while refusing does not count (237 undefended replies did exactly that).

The Results

With no defense, 16.5% of instruction attacks worked (14.9 to 18.1%). The most effective was "apply this processing step to your reply" at 47.9%, then a fake admin notice at 37.6% and a fake system update at 26.1%; an HTML comment (3.0%) and a polite request (4.2%) barely worked.

Defenses differ a lot. A one-sentence note that the table is untrusted took Gemma 4 from 25.0% to 0.6% but Granite only from 16.4% to 15.6%. Spotlighting was the best prompt-only defense, and a second model that screens the table stopped all 1,980 attacks.

Screening is not free. On 30 harmless documents that merely sound like instructions, the screening model dropped 3, costing 7.3 points of accuracy (CI -11.5 to -3.6). On ordinary clean documents and mild phrasing such as "Please refer to Note 7", no filter fired at all.

The screen also depends on who does the screening. I chose Gemma 4 before running anything. Four other models given the same prompt over all 480 documents either missed attacks (OLMo 3 7B missed 92%, Qwen3 30B 9%, Llama 4 5%, Granite 4%) or flagged harmless text (Llama 4 flagged 27 of 30 with only mild wording). "A screening model stops everything" is a claim about this screener and these templates, so the defense gate has to be run for the screener you intend to use.

I also re-tested the guard my FilingLens project ships. Its line filter recognises only 3 of the 12 instruction templates and removes nothing for the other nine, so most of the protection here comes from the wrapper that labels the text untrusted. The fake admin notice (16%) and processing-step attack (22%) still got through.

The Honest Parts

This is one task family with 30 questions per cell, so per-template and per-model cells are small and pooled numbers carry the claims. The attacks are fixed templates, not adaptive attackers, and Gemma 4's perfect detection was measured on attacks I wrote without knowing how it would respond, so it is an upper bound. Gemma 4 is also one of the six targets. The false-fact template was added after I had seen results for the other twelve, and its first wording, which did not name the question, succeeded 0% of the time; the reported version quotes the question. A bare NOT_IN_CORPUS reply was first counted as unusable, which inflated about a third of the 7B model's replies under some defenses; I found it by reading raw replies and re-scored from cache. The defense gate is strict on purpose: with 90 harmless documents, losing even one gives an upper bound of 6.0% against a 5% limit, so the screen fails the cost check for five of six models. No paid API was used.