Under the task-only system message, attack and defense behavior was strongly model-specific. Nameless tokenization left naive and lookalike success essentially unchanged, reduced forged turns markedly only on Ministral (100.0% to 67.2%) and slightly on Qwen (100.0% to 98.0%), reduced forged-tool success on Qwen (66.2% to 14.5%), but increased forged-system success on Gemma, Llama, and Ministral relative to no defense.

Under the task-only system message, attack and defense behavior was strongly model-specific. Nameless tokenization left naive and lookalike success essentially unchanged, reduced forged turns markedly only on Ministral (100.0% to 67.2%) and slightly on Qwen (100.0% to 98.0%), reduced forged-tool success on Qwen (66.2% to 14.5%), but increased forged-system success on Gemma, Llama, and Ministral relative to no defense. · CiteArk

Measurement results

0/110 assessed

0 supported0 disputed or conflicting110 not assessed

The complete result group stays with its claim. Assessed rows come first; their judgments do not replace the whole-claim conclusion. Expand a row for conditions, sources, and evidence history.

Each row is a measurement with its reported value, latest available observation, and cumulative evidence state.
Metric and conditions	Reported	Latest observation	Evidence judgment
model: Gemma-4-31B · attack: Naive · defense: None	58.1%	—	Not assessed
model: Gemma-4-31B · attack: Naive · defense: Strip	57.8%	—	Not assessed
model: Gemma-4-31B · attack: Naive · defense: Mask	57.8%	—	Not assessed
model: Gemma-4-31B · attack: Naive · defense: Escape	57.8%	—	Not assessed
model: Gemma-4-31B · attack: Naive · defense: Nameless	57.8%	—	Not assessed
model: Gemma-4-31B · attack: Lookalike · defense: None	94.3%	—	Not assessed
model: Gemma-4-31B · attack: Lookalike · defense: Strip	94.3%	—	Not assessed
model: Gemma-4-31B · attack: Lookalike · defense: Mask	94.3%	—	Not assessed
model: Gemma-4-31B · attack: Lookalike · defense: Escape	94.3%	—	Not assessed
model: Gemma-4-31B · attack: Lookalike · defense: Nameless	94.3%	—	Not assessed
model: Gemma-4-31B · attack: Forged turn · defense: None	99.7%	—	Not assessed
model: Gemma-4-31B · attack: Forged turn · defense: Strip	76%	—	Not assessed

Reported and observed measurements

Assessments (0)

Runs (0)

Measurement results