Appending one sentence that labels the user message as data had model-specific effects: it nearly stopped naive injection on Gemma and Ministral but not GPT-OSS. With standard tokenization, forged turns still succeeded at 98.3% on Llama and 99.0% on Ministral despite naive rates of 4.1% and 0.0%; nameless tokenization reduced those forged-turn rates to 50.0% and 23.3%. For Qwen's forged-tool attack, nameless reduced success from 53.4% to 0.7%.

Appending one sentence that labels the user message as data had model-specific effects: it nearly stopped naive injection on Gemma and Ministral but not GPT-OSS. With standard tokenization, forged turns still succeeded at 98.3% on Llama and 99.0% on Ministral despite naive rates of 4.1% and 0.0%; nameless tokenization reduced those forged-turn rates to 50.0% and 23.3%. For Qwen's forged-tool attack, nameless reduced success from 53.4% to 0.7%. · CiteArk

Measurement results

0/85 assessed

0 supported0 disputed or conflicting85 not assessed

The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.

Each row is a measurement with its reported value, latest available observation, and cumulative evidence state.
Metric and conditions	Reported	Latest observation	Evidence judgment
model: Gemma-4-31B · attack: Naive · defense: None	0%	—	Not assessed
model: Gemma-4-31B · attack: Naive · defense: Strip	0%	—	Not assessed
model: Gemma-4-31B · attack: Naive · defense: Mask	0%	—	Not assessed
model: Gemma-4-31B · attack: Naive · defense: Escape	0%	—	Not assessed
model: Gemma-4-31B · attack: Naive · defense: Nameless	0%	—	Not assessed
model: Gemma-4-31B · attack: Lookalike · defense: None	2%	—	Not assessed
model: Gemma-4-31B · attack: Lookalike · defense: Strip	2%	—	Not assessed
model: Gemma-4-31B · attack: Lookalike · defense: Mask	2%	—	Not assessed
model: Gemma-4-31B · attack: Lookalike · defense: Escape	2%	—	Not assessed
model: Gemma-4-31B · attack: Lookalike · defense: Nameless	2%	—	Not assessed
model: Gemma-4-31B · attack: Forged turn · defense: None	8.1%	—	Not assessed
model: Gemma-4-31B · attack: Forged turn · defense: Strip	0.7%	—	Not assessed

Reported and observed measurements

Assessments (0)

Runs (0)

Measurement results