Preprint finds task-aligned prompt injections defeat more model defenses

Researchers report that prompt injections designed to preserve much of a legitimate answer while introducing incorrect or harmful changes succeeded more often than fixed-target attacks across every model and setting they evaluated. Their preprint introduces NTBench, a benchmark that uses legitimate reference outcomes to construct these attacks. The evaluation covered seven language models, ten language-task datasets and two agent benchmarks, with three attack executions per sample. On language tasks, attack success increased by 9.3 to 35.8 percentage points for incorrect targets and 1.7 to 17.3 percentage points for harmful targets. The tests excluded deviations already observed without injection; the findings concern the evaluated attacks and settings.