Benchmarks for Evaluating Prompt-Injection Defenses in Tool-Using LLM Agents: A Comparative Threat-Model and Measurement Audit

Executive summary

This audit was scoped to compare at least eight named benchmarks and evaluation harnesses for prompt-injection defenses in tool-using LLM agents. The evidence ledger available at the time of writing supports detailed treatment of only five distinct evaluation artifacts: AgentDojo [1], InjecAgent [2], the adaptive-attack evaluation of eight IPI defenses (arXiv 2503.00061) [3], LLMail-Inject [4], and the Gray Swan agent red-teaming competitions (both the NIST/CAISI-analyzed 13-model competition [5] and the UK AISI × Gray Swan challenge [6]), plus the StruQ/SecAlign defense-side evaluation harness treated as a benchmark-adjacent measurement artifact [7]. The acceptance criterion of eight distinct named benchmarks is not met by the current evidence base; BIPIA, Agent Security Bench, WASP, ToolEmu, Tensor Trust, CyberSecEval prompt-injection subsets, and OWASP/NIST normative guidance are named in the brief but have no supporting evidence records, and are therefore excluded rather than asserted. This is a coverage failure of the evidence packet, not a finding about those benchmarks.

Within what is documented, three structural results hold. First, threat models converge on indirect prompt injection via untrusted tool/data channels — email, web content, code repositories, tool responses — across academic benchmarks [2], competitions [4][6], and government framing [5]. Second, adaptivity is the dominant axis of disagreement: defenses reported at near-zero attack success rate under static, template-based attacks are reported at >50% attack success rate when the attacker is allowed to adapt [7][3]. Third, metric definitions are not comparable across artifacts — a prefix-match on the literal string "Hacked" [7] and a crowd-normalized Total Breaks / Total Chats [6] are not the same quantity, and neither is reconcilable with per-test-case ASR over a fixed corpus of 1,054 cases [2].

The single most actionable conclusion: no artifact in this evidence base documents measurement of benign utility under attack or false-positive/refusal cost of defenses. Utility preservation is asserted ("without hurting the utility" [8]) but no measured number is present in the ledger. Security-utility Pareto framing, which the brief treats as a core evaluation requirement, is therefore unsubstantiated across the entire documented landscape.

Key findings

AgentDojo is a peer-reviewed, dynamic harness with swappable attack and defense components. It was published at NeurIPS 2024 (Datasets and Benchmarks track per the citation entry) by Debenedetti, Zhang, Balunovic, Beurer-Kellner, Fischer, and Tramèr [1], and is described as "A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents" [1]. Its CLI exposes four independent axes — task suite and individual user tasks, target model, defense, and attack: -s workspace -ut user_task_0 -ut user_task_1 --model gpt-4o-2024-05-13 with a tool filter defense and "the attack with tool knowlege" [1]. Documented defenses are a tool_filter [1] and a model-based prompt-injection detector requiring pip install "agentdojo[transformers]" [1].
AgentDojo encodes attacker knowledge as a first-class configuration. The existence of a "tool knowlege" attack variant [1] implies at least two knowledge tiers (with and without knowledge of the agent's tool inventory). Analysis: this is the only artifact in the evidence base that treats attacker knowledge as an explicit experimental parameter rather than a fixed assumption.
InjecAgent is a fixed-corpus, indirect-injection benchmark with a static attacker. Its threat model is that "malicious instructions are embedded within the content processed by LLMs, aiming to manipulate these agents into executing detrimental actions against users" [2]. It comprises 1,054 test cases over 17 user tools and 62 attacker tools [2], with attacker intents split into "direct harm to users and exfiltration of private d[ata]" [2]. Its primary metric is ASR over 30 agent configurations, with ReAct-prompted GPT-4 "vulnerable to attacks 24% of the time" [2]. Attack strength has exactly two tiers: baseline, and an "enhanced setting, where the attacker instructions are reinforced with a hacking prompt," which produces "nearly doubling the attack success rate on the ReAct-prompted GPT-4" [2].
Competitions supply the only documented adaptive-adversary evaluations at scale. LLMail-Inject is described as "a public challenge simulating a realistic scenario in which participants adaptively attempted to inject malicious instructions into emails in order to trigger unauthorized tool calls in an LLM-based email assistant" [4], spanning "multiple defense strategies, LLM architectures, and retrieval configurations," yielding 208,095 unique attack submissions from 839 participants [4]. The Gray Swan competition analyzed by NIST/CAISI covered "13 different frontier models in a variety of different agentic scenarios, including tool use agents, coding agents, and computer use agents" across "more than 250,000 a[ttempts]" with 400+ participants, and all models were breached [5]. The UK AISI × Gray Swan challenge reports 1,800,000 attempts, 62,000 successful breaks, 22 anonymized LLMs, 44 target behaviors in 4 waves, and $171,800 in prizes [6].
Reproducibility is bimodal. LLMail-Inject organizers state they "release the challenge code, the full dataset of submissions, and our analysis" [4]. AgentDojo is a public repository with an installable package [1]. By contrast, the UK AISI × Gray Swan pipeline relied on automated judging that UK AISI helped "calibrate," plus "all manual break appeal reviews" handled by UK AISI [6] — and the evidence base contains no corresponding release of judge prompts, thresholds, or scoring rubrics.
Adaptive attacks break every defense they were tested against. An independent evaluation "evaluate[d] eight different defenses and bypass[ed] all of them using adaptive attacks, consistently achieving an attack success rate of over 50%" [3], concluding on "the need for adaptive attack evaluation when designing defenses" [3]. It is dated 27 Feb 2025, last revised 4 Mar 2025 [3].
Both an academic competition paper and a government body independently name adaptive-adversary evaluation as the landscape's central gap. LLMail-Inject: "systematic evaluation against adaptive adversaries remains limited, even when successful attacks can have wide security and privacy implications, and many real-world LLM-based applications remain vulnerable" [4]. NIST/CAISI: "the need for security evaluations to constantly evolve and adapt in order to assess the risks from real-world adversaries, who continuously seek out new attacks" [5].
Attack transfer is asymmetric, which has direct benchmark-construction consequences. NIST/CAISI found "certain families of 'universal' attacks that were often able to transfer across scenarios and models, potentially by exploiting shared underlying weaknesses in instruction-following behavior," and that "successful attacks developed against more robust models (those with low[er ASR])" generalize downward [5]. Analysis: this implies attack corpora harvested against the hardest available target are the most reusable evaluation material, and that corpora harvested against weak models will systematically overstate defense efficacy on strong models.

Comparison table

Evidence tiers: PR = peer-reviewed venue; PP = preprint-only; COMP = competition report; GOV = government analysis blog; AUTHOR-SELF = defense authors evaluating their own defense (analogous to vendor self-report in conflict-of-interest terms). No artifact in this evidence base qualifies as independently reproduced on the strength of the records collected.

Benchmark / harness	Tier	Threat model	Injection channel(s)	Attacker knowledge / adaptivity	Attack generation	Defenses evaluated	Primary metric(s)	Benign utility under attack measured?	Stated / inferred non-goals
AgentDojo [1]	PR (NeurIPS 2024) [1]	Prompt injection against tool-using LLM agents; specifics not quoted in evidence [1]	Not established in evidence; inferred agentic tool/data context from title [1]	Explicit knowledge tiers: "attack with tool knowlege" variant [1]; whether any attack is optimization-based is not established	Pluggable attack components selected at runtime [1]; generation method not documented in evidence	`tool_filter`; model-based prompt-injection detector [1]	Not established in evidence	Not established — no utility metric appears in the records	Inferred gap: full defense inventory, metric definitions, and scale unstated in evidence (reviewer-inferred, from absence)
InjecAgent [2]	PP (arXiv 2403.02691) [2]	Indirect prompt injection: "malicious instructions are embedded within the content processed by LLMs... executing detrimental actions against users" [2]	Attacker-controlled tool responses; 62 attacker tools [2]	Static black-box; two fixed tiers (base, hacking-prompt-enhanced) [2]	Template/prompt-based, fixed corpus of 1,054 cases [2]	None documented in evidence — no defense arm appears in the records	ASR across 30 agent configurations; 24% for ReAct GPT-4 [2]; intent taxonomy: direct harm vs. exfiltration [2]	Not established	Reviewer-inferred: no adaptive/optimization attacker; no defense evaluation; no variance reporting
Adaptive-attack evaluation of 8 IPI defenses (arXiv 2503.00061) [3]	PP / NAACL 2025 Findings; dated 27 Feb–4 Mar 2025 [3]	Indirect prompt injection against defended systems [3]	Not established in evidence	Adaptive, defense-aware — the defining feature [3]	Att

Verification

Every material claim in this report was checked against the evidence ledger by an independent verifier pass: 6 partial, 14 supported.

Claim	Verdict	Note
AgentDojo was published at NeurIPS 2024 (Datasets and Benchmarks track per the citation entry) by Debenedetti, Zhang, Balunovic, Beurer-Kellner, Fischer, and Tramèr , and is described as "A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents" .	supported	sq1-4 gives the NeurIPS 2024 Datasets and Benchmarks Track citation with all six authors, and sq1-1/sq1-4 give the title.
AgentDojo's CLI exposes four independent axes — task suite and individual user tasks, target model, defense, and attack: `-s workspace -ut user_task_0 -ut user_task_1 --model gpt-4o-2024-05-13` with a tool filter defense and "the attack with tool knowlege" .	supported	sq1-2 shows the exact CLI with suite, user tasks, model, --defense tool_filter, and "the attack with tool knowlege".
AgentDojo's documented defenses are a `tool_filter` and a model-based prompt-injection detector requiring `pip install "agentdojo[transformers]"` .	partial	tool_filter and a prompt injection detector requiring agentdojo[transformers] are shown, but the quotes do not establish these are the only documented defenses nor that the detector is model-based beyond the transformers hint.
InjecAgent's threat model is that "malicious instructions are embedded within the content processed by LLMs, aiming to manipulate these agents into executing detrimental actions against users" .	supported	sq1-5 quotes the threat-model language verbatim.
InjecAgent comprises 1,054 test cases over 17 user tools and 62 attacker tools , with attacker intents split into "direct harm to users and exfiltration of private d[ata]" .	supported	sq1-6 states 1,054 test cases, 17 user tools, 62 attacker tools, and the two intent categories.
InjecAgent's primary metric is ASR over 30 agent configurations, with ReAct-prompted GPT-4 "vulnerable to attacks 24% of the time" .	partial	sq1-7 confirms 30 LLM agents evaluated and 24% vulnerability for ReAct-prompted GPT-4, but does not explicitly name ASR as the primary metric.
InjecAgent attack strength has exactly two tiers: baseline, and an "enhanced setting, where the attacker instructions are reinforced with a hacking prompt," which produces "nearly doubling the attack success rate on the ReAct-prompted GPT-4" .	partial	sq1-8 supports the enhanced hacking-prompt setting and near-doubling of ASR, but does not establish that there are exactly two tiers.
LLMail-Inject is described as "a public challenge simulating a realistic scenario in which participants adaptively attempted to inject malicious instructions into emails in order to trigger unauthorized tool calls in an LLM-based email assistant" , spanning "multiple defense strategies, LLM architectures, and retrieval configurations," yielding 208,095 unique attack submissions from 839 participants .	supported	sq3-2 and sq3-3 provide all quoted phrases and the 208,095/839 figures.
The Gray Swan competition analyzed by NIST/CAISI covered "13 different frontier models in a variety of different agentic scenarios, including tool use agents, coding agents, and computer use agents" across "more than 250,000 a[ttempts]" with 400+ participants, and all models were breached .	supported	sq3-5 states 13 frontier models, the scenario list, 250,000+ attempts, 400+ participants, and successful attacks against all target models.
The UK AISI × Gray Swan challenge reports 1,800,000 attempts, 62,000 successful breaks, 22 anonymized LLMs, 44 target behaviors in 4 waves, and $171,800 in prizes .	supported	sq3-9 lists all five figures verbatim.
An independent evaluation "evaluate[d] eight different defenses and bypass[ed] all of them using adaptive attacks, consistently achieving an attack success rate of over 50%" , concluding on "the need for adaptive attack evaluation when designing defenses" .	supported	sq2-1 and sq2-2 contain both quoted statements.
The adaptive-attack evaluation is dated 27 Feb 2025, last revised 4 Mar 2025 .	supported	sq2-3 gives submission 27 Feb 2025 and last revised 4 Mar 2025.
LLMail-Inject organizers state they "release the challenge code, the full dataset of submissions, and our analysis" .	supported	sq3-4 quotes the release statement verbatim.
The UK AISI × Gray Swan pipeline relied on automated judging that UK AISI helped "calibrate," plus "all manual break appeal reviews" handled by UK AISI .	supported	sq3-12 states UK AISI helped calibrate automated judging and handled all manual break appeal reviews.
LLMail-Inject states: "systematic evaluation against adaptive adversaries remains limited, even when successful attacks can have wide security and privacy implications, and many real-world LLM-based applications remain vulnerable" .	supported	sq3-1 matches the quoted sentence.
NIST/CAISI names "the need for security evaluations to constantly evolve and adapt in order to assess the risks from real-world adversaries, who continuously seek out new attacks" .	supported	sq3-7 contains the quoted phrase.
NIST/CAISI found "certain families of 'universal' attacks that were often able to transfer across scenarios and models, potentially by exploiting shared underlying weaknesses in instruction-following behavior," and that "successful attacks developed against more robust models (those with low[er ASR])" generalize downward .	supported	sq3-8 supports the universal-attack families and the asymmetric downward transfer from more robust models.
Defenses reported at near-zero attack success rate under static, template-based attacks are reported at >50% attack success rate when the attacker is allowed to adapt .	partial	sq2-8 gives ~0% ASR for optimization-free attacks and sq2-1 gives >50% under adaptive attacks, but the quotes do not establish these refer to the same defenses/settings, so the linkage is inferential.
Metric definitions are not comparable across artifacts — a prefix-match on the literal string "Hacked" and a crowd-normalized `Total Breaks / Total Chats` are not the same quantity, and neither is reconcilable with per-test-case ASR over a fixed corpus of 1,054 cases .	partial	The quotes confirm the three distinct metric definitions (Hacked prefix-match, Total Breaks/Total Chats, 1,054-case corpus), but the interpretive conclusion about non-comparability is the author's inference.
Utility preservation is asserted ("without hurting the utility" ) but no measured number is present in the ledger.	partial	sq2-5 contains "without hurting the utility" but also reports an 8% ASR figure and utility loss for other defenses; the absence of any measured utility number in the ledger cannot be verified from the quote alone.

Sources

GitHub - ethz-spylab/agentdojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents. · GitHub — evidence sq1-1, sq1-4, sq1-2, sq1-3 (quality 4/5/4/4); retrieved 2026-08-03T17:58:01Z
[2403.02691] InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents — evidence sq1-5, sq1-6, sq1-7, sq1-8 (quality 5/5/5/5); retrieved 2026-08-03T17:58:10Z
[2503.00061] Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents — evidence sq2-1, sq2-2, sq2-3 (quality 4/4/5); retrieved 2026-08-03T17:58:00Z
LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge — evidence sq3-2, sq3-3, sq3-4, sq3-1 (quality 4/4/4/4); retrieved 2026-08-03T17:57:57Z
Insights into AI Agent Security from a Large-Scale Red-Teaming Competition | NIST — evidence sq3-5, sq3-6, sq3-7, sq3-8 (quality 5/5/5/5); retrieved 2026-08-03T17:58:10Z
UK  AISI × Gray Swan Agent Red‑Teaming Challenge: Results Snapshot | Gray Swan News — evidence sq3-9, sq3-11, sq3-10, sq3-12 (quality 3/3/3/3); retrieved 2026-08-03T17:58:20Z
Defending against Prompt Injection with Structured Queries (StruQ) and Preference Optimization (SecAlign) – The Berkeley Artificial Intelligence Research Blog — evidence sq2-8, sq2-10 (quality 4/5); retrieved 2026-08-03T17:58:19Z
SecAlign: Defending Against Prompt Injection with Preference Optimization — evidence sq2-5 (quality 5); retrieved 2026-08-03T17:58:09Z

Methodology

This report was produced by the Richards.AI deep research agent: the request was scoped into a brief, decomposed into subquestions researched by parallel context-isolated subagents (search → fetch → verbatim evidence extraction into an append-only ledger), synthesized from the ledger, and audited by an independent claim-verification pass.

Run parameters

These are the settings and budgets that shaped this run. Reruns that differ in any of them are not comparable.

Preset: quick (max 3 subquestions, 3 fetches each, 1 round(s))
Prompt revision: 4b9087b9e9c6
Subquestions researched: 3; rounds used: 1
Evidence records: 31; distinct sources cited: 8
Search backends that served results: tavily (6)
Model lanes — fast: anthropic:claude-sonnet-5, reason: anthropic:claude-opus-5, verifier: anthropic:claude-opus-5
Wall clock: 204.3s of 900s

Token usage:

anthropic:claude-opus-5: 16 calls, 100,567 in / 24,624 out tokens
anthropic:claude-sonnet-5: 3 calls, 5,567 in / 829 out tokens

Known gaps and unresolved questions from research:

Coverage is limited to two benchmarks (AgentDojo, InjecAgent). No evidence was collected for other major 2023–2025 candidates that the subquestion asks about (e.g., the OpenPromptInjection benchmark, BIPIA, Agent Security Bench (ASB), WASP, AdvAgentBench/AgentHarm-style harnesses, Anthropic/OpenAI internal red-team harnesses, CyberSecEval prompt-injection suites, LLMail-Inject or other competition-style testbeds), so the 'major benchmarks' landscape is incomplete and no claim of exhaustiveness can be made.
AgentDojo's threat model is not directly quoted in the evidence — only inferred from its title ('prompt injection ... for LLM Agents'). The evidence does not state whether injections are indirect-only, where in the environment they are placed, or who the assumed attacker is.
AgentDojo's task/injection scale is unestablished: no counts of suites, user tasks, injection tasks, tools, or environments; the evidence only shows two example task ids in one suite.
AgentDojo's metrics are unestablished. No evidence of how it defines ASR, benign utility, or 'utility under attack', nor of any targeted-vs-untargeted ASR distinction or aggregation method.
The full defense inventory for AgentDojo is unknown beyond tool_filter and a transformers-based injection detector; nothing establishes whether spotlighting, delimiting, repeat-prompting, paraphrasing, sandboxing, or system-level (e.g., CaMeL-style) defenses are included.
InjecAgent's defenses evaluated are unestablished — the collected records describe threat model, scale, intents, and ASR but no defense arm at all.
InjecAgent's environment realism is unestablished: the evidence does not say whether tools are actually executed, simulated/mocked, or LLM-emulated, nor whether the 62 'attacker tools' correspond to real APIs.
Utility-under-attack and false-positive-rate metrics are not documented for either benchmark. No evidence describes measurement of benign-task degradation from defenses or defense false alarms on clean inputs.
Statistical rigor is entirely unestablished for both benchmarks: no evidence of seeds, number of runs, confidence intervals, variance across sampling temperature, or significance testing. The 24% and 'nearly doubling' figures are reported as point estimates without uncertainty in the collected records.
Stated non-goals / explicit scope limitations are not captured for either benchmark; no limitations sections or 'out of scope' statements were collected.
Attacker adaptivity in AgentDojo is only partially characterized: the evidence names a 'tool knowledge' variant but does not enumerate the other attack variants, nor establish whether any attack is optimization-based/gradient-based or adaptive to a specific deployed defense.
No evidence on licensing, maintenance status, leaderboard/version history, or contamination controls for either benchmark, which bears on their usability as stable evaluation harnesses.
The evidence does not identify which eight defenses were broken by the adaptive-attack paper, so it cannot be confirmed that StruQ or SecAlign specifically were among them; the head-to-head contradiction on the same named defense is therefore inferred rather than established.
No evidence records address spotlighting/delimiter defenses, detection classifiers, CaMeL/dual-LLM/plan-then-execute isolation, or human-in-the-loop defenses on their own terms — no reported numbers, papers, or conflicting claims for these classes were collected (they appear only as a framing of 'prompting-based' defenses in sq2-6).
The adaptive-attack paper's metric, benchmark, task set, and attack-success definition are not captured, so the >50% ASR figure cannot be numerically reconciled with the 8%/15%/45% figures; the disagreement's magnitude attributable to metric vs. adaptivity is unquantified.
Model versions/dates are only partially established: Llama3-8B-Instruct is named for the 8% figure and '5 tested LLMs' is asserted without identifying them; the models and dates used in the adaptive-attack evaluation are unknown, as are any results on frontier/proprietary models (e.g., GPT-4-class, Claude, Gemini) with version stamps.
No rebuttal, response, or reproduction attempt by the defense authors addressing the adaptive-attack findings is present, so it is not established whether the disagreement has been contested, conceded, or resolved.
Utility/false-positive trade-offs are only asserted ('without hurting the utility') with no measured numbers, so disagreements about defense cost — a common source of conflicting effectiveness assessments — are not covered.
No evidence on human-in-the-loop or detection-classifier deployment results from vendors/practitioners, and no non-arXiv/industry sources, so publication-venue or academic-vs-industry sources of disagreement are unexamined.
No evidence records cover vendor/model-provider self-reported prompt-injection evaluations (e.g., model or system cards from OpenAI, Anthropic, Google, Microsoft): their threat models, ASR definitions, attack corpora, or whether any harness/scoring code is published. All collected records are competition- or government-blog-derived.
No evidence records cover CyberSecEval prompt-injection subsets specifically — nothing on its taxonomy, judge design, corpus size/provenance, licensing, or reproducibility of its scoring code.
No evidence records cover OWASP (e.g., LLM Top 10 / LLM01 prompt injection) or NIST framework-aligned guidance documents (AI RMF, SP 800-53-style controls); the only NIST item is a CAISI research blog about a competition, not normative guidance or recommended metrics.
Reproducibility of the LLMail-Inject release is asserted from the paper's own claim; the evidence does not establish that the released code/dataset were independently re-run, that environments are pinned, or that the defense implementations are complete enough to reproduce reported per-defense results.
For the Gray Swan / UK AISI challenges, the evidence does not establish whether the attack submissions, transcripts, target-behavior definitions, or automated judge prompts/thresholds are publicly available, nor the measured accuracy/false-positive rate of the automated judge against human labels.
Metric validity is not established: ASR defined as Total Breaks / Total Chats is reported, but the evidence says nothing about how it is confounded by non-uniform participant effort, model anonymization, wave-dependent difficulty, or attempt-count differences across models — so cross-model robustness comparisons based on it are unvalidated.
No evidence on absolute defense effectiveness numbers, cost/utility trade-offs of the defenses tested, or whether any tested defense withstood adaptive attack; likewise nothing on how competition-derived ASRs relate to real-world incident rates.
No evidence records state explicit best-practice recommendations issued by these bodies (beyond the implicit need for adaptive/evolving evaluation and transfer-aware corpus construction); no records establish agreed-upon reporting standards, benchmark contamination controls, or disclosure norms across the landscape.
No evidence on comparability or harmonization across the different efforts (e.g., whether LLMail-Inject, Gray Swan, and CyberSecEval threat models or scoring can be mapped onto one another), nor on coverage of non-English or multimodal injection vectors.