Under the task-only system message, attack and defense behavior was strongly model-specific. Nameless tokenization left naive and lookalike success essentially unchanged, reduced forged turns markedly only on Ministral (100.0% to 67.2%) and slightly on Qwen (100.0% to 98.0%), reduced forged-tool success on Qwen (66.2% to 14.5%), but increased forged-system success on Gemma, Llama, and Ministral relative to no defense.

model: Gemma-4-31B · attack: Naive · defense: None

model: Gemma-4-31B · attack: Naive · defense: Strip

model: Gemma-4-31B · attack: Naive · defense: Mask

model: Gemma-4-31B · attack: Naive · defense: Escape

model: Gemma-4-31B · attack: Naive · defense: Nameless

model: Gemma-4-31B · attack: Lookalike · defense: None

model: Gemma-4-31B · attack: Lookalike · defense: Strip

model: Gemma-4-31B · attack: Lookalike · defense: Mask

model: Gemma-4-31B · attack: Lookalike · defense: Escape

model: Gemma-4-31B · attack: Lookalike · defense: Nameless

model: Gemma-4-31B · attack: Forged turn · defense: None

model: Gemma-4-31B · attack: Forged turn · defense: Strip