IAM-RAG - End-to-end BM25 k5: leaderboard
IAM-RAG Table 2:goal-matched exact policy-authorization attacks over eligible clean controls; denominators 53–60 differ perendpoint. Three fixed attack regimes remain separate; authority spoofing is a post-hoc five-endpoint extension of frozen inputs. Bedrock Converse us-east-1,temp 0,max 1200 output tokens,one generation. Provider-invalid and unresolved request-level cases excluded from reported denominators, never scored zero. Llama 3 explicitly Instruct; Mistral snapshot not disclosed in paper. Metric: Attack success (%).
Metric: Attack success (%). Source: arxiv.org. Saturation forecast: Estimated already saturated. 5 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Sonnet 4.5 | 0 | #148 |
| 2 | Nova Lite | 1.69 | #741 |
| 3 | Nova Pro | 3.33 | #594 |
| 4 | Llama 3 8B Instruct | 7.14 | #1116 |
No result here: #3 Claude Opus 5.5, #6 GPT-6 Astra, #7 GPT-6.1 Sol.
Interactive version: theaggregate.ai/benchmark?slug=iam-rag-end-to-end-bm25-k5 · How It Works · Data refreshed daily, snapshot 2026-11-05.