The evaluation is limited to five models, three host tasks, two injected objectives, and one defensive system-prompt sentence. The authors caution that absolute attack rates would change with different objectives or a larger item pool and should be read as a decomposition of one attack surface, not as a deployment-risk estimate.

The evaluation is limited to five models, three host tasks, two injected objectives, and one defensive system-prompt sentence. The authors caution that absolute attack rates would change with different objectives or a larger item pool and should be read as a decomposition of one attack surface, not as a deployment-risk estimate. · CiteArk

Measurement results

0/4 assessed

0 supported0 disputed or conflicting4 not assessed

The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.

Each row is a measurement with its reported value, latest available observation, and cumulative evidence state.
Reported	Latest observation	Evidence judgment
5 models	—	Not assessed
3 tasks	—	Not assessed
2 objectives	—	Not assessed
1 sentences	—	Not assessed

Reported and observed measurements

Assessments (0)

Runs (0)

Measurement results