SCOUT-450 (LLM Judge): leaderboard
Prompt-injection detection with an LLM as the detector: 450 held-out inputs (255 attacks, 195 benign) enriched for hidden, agent-facing injections such as tool misuse and exfiltration; SCOUT-450 (Zhang et al., 2026). One query per input with a shared evaluation prompt asking for an attack-or-benign verdict; accuracy in percent, higher is better.
Metric: Accuracy (%; binary attack-or-benign verdicts on 450 held-out samples, one query per sample with a shared evaluation-only prompt). Source: arxiv.org. Saturation forecast: Not forecast. 5 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-4o | 92.4 | #741 |
| 2 | GPT-5.1 | 87.3 | #225 |
| 3 | GPT-5.2 | 80.4 | #172 |
| 4 | Gemini 3.1 Pro (Preview) | 66.9 | #91 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=scout-450-llm-judge · How It Works · Data refreshed daily, snapshot 2026-11-12.