Domain-Camouflaged Injection: leaderboard
Prompt-injection robustness of an undefended LLM agent answering from a retrieved financial, legal or general document into which an attacker model has written a payload that mimics the document's own vocabulary and authority (45 tasks from Pai, 2026, two payload variants each). Attack success rate in percent, judged by Claude Haiku; lower is better.
Metric: Attack success rate (%; share of 90 undefended trials, 45 tasks x two payload variants, in which the agent follows a domain-camouflaged injected instruction; Claude Haiku judge). Source: arxiv.org. Saturation forecast: Estimated already saturated. 3 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Haiku 4.5 | 14.4 | #568 |
| 2 | Gemini 2.0 Flash (001) | 21.1 | #724 |
| 3 | Llama 3.1 8B Instruct | 22.2 | #4277 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=domain-camouflaged-injection · How It Works · Data refreshed daily, snapshot 2026-11-12.