Every number on this page is measured and reproducible. It is here because a detection
rate quoted without its limits is not evidence — and because the control we would
actually stake an agent’s safety on is Capability
Containment, not the classifier.
The measured numbers
Across 2,369 benchmark samples from eight datasets, at themoderate preset, the shipped
default operating point (the threshold value itself is not published):
Precision and recall move against each other as the threshold moves, so neither means
anything without the operating point. Full dataset breakdown and confidence intervals
are in the benchmark write-up.
Over-defense: the benign number that is harder
That 1.01% is measured on the benchmark’s own benign split, which is ordinary prose. NotInject (Li et al. 2025) is the standard benchmark for the opposite property — benign text deliberately seeded with the vocabulary of an attack (“Can I ignore this warning in my code?”) — and it is much harder:
The second row is the harder corpus and the one we like least: 3,000 real persona
templates scraped from AIPRM and FlowGPT. Half of them are blocked.
Roughly a quarter of that has a defence — these are persona-installation prompts
(“I want you to act as…”) scanned on the untrusted-input path, and text whose literal
job is to install a persona is not an obvious false positive for an
instruction-override detector. The rest did not: it came from detection rules running
against a surface they were never written for, and from an injection verdict being
filed as toxicity. Both are fixed, which took this corpus from 59.9% to 49.9%.
What remains is dominated by the injection encoder at its shipped threshold — a
calibration choice, not a defect, and the one lever that trades against recall. We
publish the number because a detection vendor that only reports the benchmarks it wins
is not reporting.
Most of it is the operating point rather than the models: the injection encoder alone
accounts for roughly 38 of the 47 points, running at the shipped threshold rather
than the much stricter one needed to hold 1% FPR out of domain. We publish it because a
vendor who shows you a false-positive rate from the easy set and stays quiet about the
hard one has told you very little.
The ceiling, and why more detectors will not lift it
Nasr et al., The Attacker Moves Second (USENIX Security 2026), ran tuned search-based attacks against twelve published defences and bypassed all of them at over 90% attack success. Most had first reported near-zero attack success on static benchmarks. The paper states plainly that stacking more detectors does not fix this. The structural reason is where the input comes from. A detector reads the tool output or the retrieved document — content the attacker controls. Its accuracy is an empirical property, so an attacker who can iterate eventually finds the gap. No amount of detector quality changes that. Our own measurements agree:
The fine-tune result is the instructive one. It beat everything in-domain and collapsed
on an independent corpus — which is what overfitting to your own attack distribution
looks like, and why we do not ship it.
The judge row is the one that did not collapse. Measured in-domain the LLM-judge tier
was worth +9.0pp of recall; on 500 attacks from independent corpora it still returns
+6.6pp, keeping 73% of its effect, and the difference is one-directional — 33 attacks
caught only with the judges, none caught only without them. Where it lives matters more
than the headline: the judges add nothing where the encoders already saturate (Gandalf,
100% either way) and nothing where the task is unsolvable (SEP, at chance for everyone).
All of the gain is on agentic and tool-output corpora — AgentDojo +10.4pp, deepset
+8.8pp, InjecAgent +7.2pp. That is the indirect-injection setting, which is the one this
page is about.
It does not lift the ceiling. 86.2% against a static attacker is still a number an
adaptive attacker gets to move second against.
What does not depend on detection accuracy
Three controls answer a different question — was the agent ever authorised to do this? — and their security argument does not rest on classifying an attack correctly.Capability Containment
Derives an envelope from the user’s objective — trusted input the attacker does
not control — and refuses anything outside it, fail-closed.
Rule of Two
Reads the toolset, not the prose. An agent holding untrusted input, private data and
a way to act needs a human in the loop, whatever the classifier says.
Human approval
On the consequential step. The only control with no false-negative rate.
How to read our claims
- Detection reduces risk measurably; it does not eliminate a class of attack.
- Any figure we publish names its dataset, sample count and interval — including the ones that do not flatter us. Ask the same of anyone quoting you a detection rate.
- Where a control has a residual failure rate, we publish the residual.
gemini-2.5-prostill complies with 13.6% of adaptive attacks with marking active, so a Gemini agent doing consequential work should gate the action rather than rely on marking.