PIArena: A Unified Platform for Prompt Injection Evaluation

Core problem: the lack of a unified prompt injection evaluation platform makes it difficult to reliably compare defenses and to judge their true robustness under diverse attacks and benchmarks.

• Scenario and importance: Prompt injection can appear in untrusted contexts such as web pages, social media posts, shared documents, code repositories, and messages on collaboration platforms; OWASP lists it as the top security risk for LLM applications (as cited by the authors).
• Existing shortcomings: The authors state that many defenses (e.g., Liu et al., 2025b; Zhu et al., 2025; Chen et al., 2024/2025a; Meta, 2024; Li et al., 2025; Wang et al., 2025) report effectiveness on their original benchmarks, but later work by others found limited effectiveness on other benchmarks; existing benchmarks mostly use static attacks, lack a unified API and plug-and-play tools, and are not extensible (Table 1).
• Core observation: Static template attacks cannot reflect the real scenario in which attackers iteratively evolve attacks based on defense feedback; when the injection task is aligned with the target task, the attack degenerates into false information, and instruction-level defenses may fail.
• What the paper proposes: A unified and extensible platform, PIArena (including 13 datasets, four categories of realistic injection tasks, and a unified interface), as well as a strategy-based attack that adaptively optimizes injection prompts based on defense feedback.
• Threat model (Section 2):
  • Attacker goal: Insert an injection prompt containing injection instructions Is at any position in the context, so that the backend LLM executes the injection task instead of the target task (e.g., injecting advertisements or phishing links).
  • Attacker knowledge and capability: Inject text into the context; the strategy-based attack proposed by the authors requires only black-box access to the defense.
  • Defender goal: Keep high utility on clean contexts (low false positives) and mitigate the impact of injection; divided into detection-based (identify and block) and prevention-based (ensure the target task is still executed) categories.
  • Victim system: An application in which a backend LLM executes the target task (e.g., question answering, RAG, agent).

Prompt injection attacks

• Heuristic attacks (Willison, 2022; Perez and Ribeiro, 2022; Liu et al., 2024b, etc.): Construct injection prompts using predefined static strategies or templates, such as context ignoring and fake completion; the Combined Attack integrates multiple heuristic strategies, which the authors describe as the most effective among heuristics.
• White-box optimization attacks (GCG (Zou et al., 2023), Neural Exec (Pasquini et al., 2024), etc.): Iteratively optimize injection prompts using gradients of the target LLM; the authors point out that gradients are often unavailable in practice.
• Black-box optimization and strategy attacks (AutoDAN, GPTFuzzer, TAP, PAIR, RL-Hammer, PISmith, etc.): Require only API access; the authors state that these methods mostly target jailbreak, with strategies mainly based on character-level perturbations or semantic obfuscation, whereas this paper's strategies target prompt injection through payload splitting, authority escalation, and cognitive hijacking (Appendix C).

Prompt injection defenses

• Detection-based: DataSentinel (minimax game fine-tuning of a detection LLM), PromptGuard (fine-tuned DeBERTa), AttentionTracker (analyzes intermediate-layer attention), PIShield (uses intrinsic features such as hidden states).
• Prevention-based: SecAlign (DPO fine-tuning), Instruction Hierarchy (trains GPT-4o-mini to distinguish instruction source priority), DataFilter, PromptArmor, PISanitizer (uses attention to locate and sanitize injected content), etc.

Benchmarks

• General task benchmarks: Open-Prompt-Injection (7 classic NLP tasks), SEP (everyday questions, context-irrelevant injection tasks), etc.
• Agent benchmarks: InjecAgent, AgentDojo, AgentDyn, WASP, ASB; the authors point out that they are complex to configure, and the original papers mostly do not evaluate defenses.
• Baselines and benchmarks in this paper: Defense baselines are PISanitizer, SecAlign++, DataFilter, PromptArmor, DataSentinel, PromptGuard, AttentionTracker, PIGuard; attack baselines are Combined, Direct, GCG, PAIR, TAP; benchmarks include SQuAD v2, Dolly, NQ, MS-MARCO, HotpotQA, a LongBench subset, and OPI, SEP, InjecAgent, AgentDojo, AgentDyn, WASP.

The authors position this paper as filling the gaps of existing benchmarks in defense evaluation, reproducibility, and extensibility (Table 1) through a unified API, plug-and-play tools, and adaptive attacks.

Overall approach: build a unified and extensible platform PIArena, abstracting benchmarks, attacks, defenses, and evaluators into four plug-and-play modules; also propose Generic Strategy-based Attack, which uses a strategy library for semantic "warm start" and then iteratively rewrites the injected prompt based on defense feedback.

Problem Formulation

• The backend LLM g generates a response R = g(I_t ⊕ C) for the target instruction It and context C, where ⊕ is string concatenation; the attacker injects a prompt to obtain a contaminated context C', with the goal of making g execute the injected instruction Is.
• Unified data format: each sample contains target_inst, context, injected_task, target_task_answer, injected_task_answer, category (Figure 3).

Benchmark and Injected Task Construction

• Target tasks: question answering (SQuAD v2, Dolly), information extraction and summarization (Dolly), RAG (NQ, HotpotQA, MS-MARCO), long context (HotpotQA, Qasper, GovReport, MultiNews, PassageRetrieval, LCC from LongBench).
• Injected tasks: four types of realistic attack goals—phishing injection, content promotion, access denial, infrastructure failure; each type accounts for 25% during attacks.
• Generation method: use GPT-5 to generate context-relevant injected tasks based on the target instruction, context, and attack goal, rotating attack goals and adding already-generated samples to avoid duplication (Appendix F).

Unified Evaluation Interface

• Attack interface: takes a data sample, generates an injected prompt, and inserts it at a specified position in the context (beginning, middle, or end).
• Defense interface: detection-based defenses first determine whether the context is contaminated, and if judged malicious, return a predefined refusal; prevention-based defenses (sanitization, robust fine-tuning) output safe responses according to their respective protocols.
• Evaluator: Utility uses task-relevant metrics (LLM-as-a-judge for short contexts, LongBench metrics such as F1 and ROUGE-L for long contexts); ASR uses LLM-as-a-judge to determine whether the response completes the injected task; the judge model is Qwen3-4B-Instruct (Appendix E).

Strategy-Adaptive Attack (Algorithm 1)

• Motivation: the authors state that black-box prompt optimization has a cold-start problem—starting from the original injected instruction, rewards are sparse, and optimization degenerates into costly brute-force search.
• Stage one (candidate generation): the Attacker LLM (Qwen3-4B-Instruct) uses 10 rewriting strategies (disguises such as "Author's Note" and "System Update"; full strategy prompts in Appendix G.4) to rewrite the base injected prompt into a candidate set, probing them one by one and returning on success.
• Stage two (feedback-guided rewriting): for each strategy's seed prompt, iterate for at most K rounds, with three cases based on feedback: if detected/sanitized, rewrite to improve stealth; if ignored, rewrite to increase coerciveness; in other cases, the Attacker LLM analyzes the failure reason and rewrites.
• The authors state that strategy rewriting provides a semantic "warm start", yielding higher query efficiency and ensuring attack diversity; the paper does not give specific values of N and K in the main text.

Experimental setup

• Backend LLMs under test (10): open-source Qwen3-4B-Instruct (default), Qwen3-30B-Instruct, Llama-3.3-70B-Instruct, gpt-oss-120b; closed-source GPT-4o, GPT-4o-mini, GPT-5, Claude-Sonnet-4.5, Gemini-3-Pro, Gemini-3-Flash. The main table (Table 2) uses Qwen3-4B-Instruct by default.
• Datasets: 13 self-built datasets with 1,700 samples in total (200 per set for short contexts, 100 per set for long contexts, Table 8); additionally evaluated on InjecAgent, AgentDojo, AgentDyn, WASP, OPI, and SEP.
• Defenses (8, default settings and open-source implementations): prevention-based PISanitizer, SecAlign++, DataFilter, PromptArmor; detection-based DataSentinel, PromptGuard, AttentionTracker, PIGuard.
• Attacks: Combined, Direct, Strategy (this paper, Attacker LLM is Qwen3-4B-Instruct); the appendix additionally tests GCG (white-box) and PAIR, TAP.
• Metrics and judging: Utility and ASR; ASR and short-context utility use LLM-as-a-judge (judge is Qwen3-4B-Instruct); ASR for WASP uses GPT-4o as judge; detection-based defenses do not report utility under attack (refusal makes utility meaningless).
• Judging accuracy: The authors manually spot-checked 100 random samples and report a judge accuracy of 98%.

Main results

The table below shows the Average row over the 13 datasets in Table 2 (backend Qwen3-4B-Instruct; utility under detection-based attacks is N/A):

Swipe horizontally to read the table

Defense	No Attack Utility	Combined ASR	Direct ASR	Strategy ASR
No Defense	0.74	0.72	0.56	0.99
PISanitizer	0.74	0.04	0.11	0.86
SecAlign++	0.58	0.07	0.04	0.21
DataFilter	0.63	0.22	0.37	0.58
PromptArmor	0.74	0.58	0.50	0.92
DataSentinel	0.55	0.12	0.26	0.45
PromptGuard	0.66	0.25	0.30	0.92
Attn.Tracker	0.15	0.0	0.0	0.01
PIGuard	0.72	0.22	0.27	0.79

• The authors state that existing defenses have limited generalization: PISanitizer is robust to Combined, but its ASR rises to 11% under Direct; SecAlign++ has low ASR but sacrifices utility (average No Attack utility drops from 74% to 58%).
• The authors state that the strategy-based attack bypasses almost all defenses: ASR is 99% with no defense and 86% against PISanitizer; AttentionTracker has low ASR (1%) but average utility of only 15%.
• Under No Attack, ASR is nonzero on some datasets; the authors explain this as judge misjudgment caused by overlap between the target task and the injection task, and state that the impact is small.

Different backend LLMs (Table 3, SQuAD v2, Direct attack)

• Closed-source models still have high ASR: GPT-4o 0.92, Gemini-3-Flash 0.88, Gemini-3-Pro 0.83, GPT-4o-mini 0.76, GPT-5 0.70; open-source models 0.61–0.86.
• Exception: Claude-Sonnet-4.5 has an ASR of 0.31, lower than other models (utility 0.97); the authors do not explain the reason.
• The authors state that GPT-4o-mini was specifically trained for injection resistance and GPT-5 deploys a multi-layer defense stack, yet they still have 76% and 70% ASR respectively, and argue that specialized training struggles to cope with the diverse injections in reality.

Alignment between injection task and target task (Table 4, NQ, knowledge corruption attack)

• What was tested: Knowledge corruption on NQ following the PoisonedRAG setting, where the injection prompt may contain no explicit instructions and degenerates into false information.
• Results: ASR with no defense is 0.81; ASR remains high for all tested defenses—PISanitizer 0.67, SecAlign++ 0.58, DataFilter 0.78, PromptArmor 0.82, DataSentinel 0.44, PromptGuard 0.74, PIGuard 0.81; only AttentionTracker is 0.01 (its No Attack utility is 0.0).
• Authors' interpretation: In this case defenses degenerate into checking information correctness, and instruction-level defenses cannot verify whether content is true or false; the authors consider this a fundamental challenge.

Transfer to other benchmarks (Tables 5, 6)

• Agent benchmarks: InjecAgent uses Llama-3.1-8B-Instruct and the "ENHANCED" attack; AgentDojo and AgentDyn use GPT-4o and its default "important message" attack; WASP takes 84 test cases for a single-webpage static evaluation. ASR with no defense is 0.29–0.42; the authors state that existing defenses either hurt utility or do not reduce ASR enough (e.g., on AgentDojo, SecAlign++ has ASR 0.0 but utility drops from 0.52 to 0.19).
• General benchmarks (OPI, SEP, backend Qwen3-4B-Instruct): Existing defenses already perform relatively well (e.g., on SEP, PISanitizer ASR 0.03, DataFilter 0.01); the authors state that this highlights the need for PIArena's more comprehensive evaluation.

Other ablations and analyses

• GCG (Table 7, MultiNews, white-box): DataFilter ASR 0.04, DataSentinel 0.0, PIGuard 0.02, but SecAlign++ 0.86, PromptArmor 0.60, PromptGuard 0.56; the authors state that this paper's black-box strategy-based attack has higher ASR than this white-box attack.
• PAIR/TAP comparison (Table 10, the table note says SQuAD v2, the main text says Dolly Closed QA): The Strategy attack has higher ASR than PAIR and TAP on no defense, PISanitizer, PromptArmor, PromptGuard, and PIGuard (e.g., against PISanitizer, 0.85 vs. 0.05).
• Attack cost (Appendix G.2, Dolly Closed QA): Most defenses converge in 1.015–1.930 rounds on average, SecAlign++ in 4.555 rounds; about 8 seconds per sample on average (vLLM and batched inference).

Limitations and future directions noted by the authors

• Benchmark realism (Limitations section): The authors acknowledge that the self-built benchmark may not fully reflect real scenarios, but argue that existing defenses already struggle on these controlled benchmarks, which can serve as a first step before moving to more complex real settings.
• Cross-benchmark evaluation (Appendix D): The authors suggest that future defenses adopt comprehensive evaluation across benchmarks, injection task categories, attack types, and context lengths as standard practice.
• Adaptive threat models (Appendix D): The authors suggest that defenses incorporate adaptive threat models, in which attacks are iteratively improved based on defense feedback, during development and evaluation.
• Content-level verification (Appendix D and Section 5.4): The authors argue that instruction-level defenses have fundamental limitations in task-aligned scenarios, and that future work needs to shift toward content-level verification (e.g., cross-checking against trusted external sources) and system-level protection.

Scope of experimental coverage

• There are 10 backend LLMs under test in total (4 open-source, 6 closed-source); cross-model results (Table 3) are reported only under SQuAD v2 and the Direct attack.
• Defense evaluation covers 8 defenses (4 prevention-based, 4 detection-based), all with default settings and open-source implementations.
• The backend model for the main results (Table 2) is Qwen3-4B-Instruct; sample sizes are 200 per set for short-context datasets and 100 per set for long-context datasets, 1,700 in total; the paper does not report the number of repeated experiments.
• Attacks cover Combined, Direct, and Strategy; the appendix additionally tests GCG (MultiNews) and PAIR, TAP (a single dataset); the Attacker LLM for the strategy-based attack is Qwen3-4B-Instruct, and the paper does not report results with other Attacker LLMs.
• LLM judging uses Qwen3-4B-Instruct (ASR for WASP uses GPT-4o); the authors report a manual spot-check of 100 samples with a judge accuracy of 98%, and do not report inter-annotator agreement.

A paper on a prompt injection evaluation platform: the authors build a unified and extensible platform, PIArena, and propose a strategy-based attack that adaptively rewrites injection prompts based on defense feedback, in order to systematically evaluate existing attacks and defenses.

• Problem to solve: The authors state that the community lacks a unified evaluation platform; many defenses report effectiveness on their original benchmarks but fail after switching benchmarks, making true robustness difficult to compare.
• Method highlights: A four-module (benchmark, attack, defense, evaluator) plug-and-play architecture; 13 datasets with 1,700 samples in total, covering tasks such as question answering, RAG, and long context; GPT-5 is used to generate four categories of context-dependent injection tasks; the strategy-based attack uses 10 rewriting strategies for "warm start", then iteratively rewrites according to three types of feedback—detected/ignored/failed—requiring only black-box access.
• Main results (Table 2, backend Qwen3-4B-Instruct, average over 13 datasets): ASR of the strategy-based attack is 99% with no defense, 86% against PISanitizer, and 21% against SecAlign++ (utility drops to 45%); SecAlign++ reduces average utility from 74% to 58% under No Attack.
• Cross-model (Table 3, SQuAD v2, Direct): GPT-5 ASR 70%, GPT-4o-mini 76%, GPT-4o 92%; Claude-Sonnet-4.5 is 31%, an exception.
• Task-aligned scenario (Table 4, NQ knowledge corruption): ASR with no defense is 81%, and all tested defenses fail (0.44–0.82, except AttentionTracker, whose utility is 0).
• Authors' conclusion: Defending against prompt injection remains a fundamental challenge; the authors hope PIArena supports systematic evaluation, helps identify defense weaknesses, and plan to continuously extend the platform through community contributions.