LongPIBench - Paper Review: leaderboard
Part of LongPIBench (Liu et al., 2026), which measures prompt injection hidden in long documents: the model reviews 100 long synthetic conference papers carrying an injected authority-spoofing instruction. Attack success rate in percent, the share of reviews giving the rating of 8 or 9 the attacker asks for, with no defense; lower is better.
Metric: Attack success rate (%; share of 100 long synthetic conference papers the model must review; success when the final rating is 8 or 9 on the 1-9 scale, under the authority-spoofing prompt injection embedded in the context and the default attack goal, no defense; default inference settings, up to 20,000 output tokens (32,768 for Qwen3-8B)). Source: arxiv.org. Saturation forecast: Around March 2027. 8 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-4.1 | 79 | #495 |
| 2 | GPT-4o | 82 | #741 |
| 3 | Ministral-3-8B-Instruct-2512 | 93 | #1858 |
| 4 | deepseek-llm-7B-chat | 94 | #7056 |
| 5 | Llama 3.2 3B Instruct | 96 | #7147 |
| 6 | Llama 3.1 8B Instruct | 100 | #4246 |
| 7 | Qwen 3 8B | 100 | #1830 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=longpibench-paper-review · How It Works · Data refreshed daily, snapshot 2026-11-13.