Started Updated
Re-running a detector's robustness table
Its static-evaluation numbers reproduce within a tolerance declared in advance; its claim of robustness to adaptive attacks does not.
Claims that hold within the declared tolerance
Background
Reproduction is the cheapest kind of evidence and the least often collected. This entry re-runs the evaluation table of a published prompt-injection detector — every headline number — using the authors’ released checkpoint and, where available, their data.
The paper is not named while its authors review the results. The procedure is the reusable part: declare a tolerance, re-run, and let the verdicts follow from the numbers.
Threat model
A reproduction has a threat model of its own: the ways a re-run can mislead.
- A tolerance chosen after the fact. The tolerance, ±2.0 percentage points, was fixed before any number was re-run, and it is the only one used for verdicts.
- Silent protocol drift. Each item follows the paper’s protocol where it is specified. Where it is not, the choice made is recorded with the item.
- Direction. Some claims are one-sided — “at least”, “at most”. A one-sided claim holds when the reproduced number lands on the claimed side, within tolerance; doing better than claimed is not a failure.
- Adaptive claims. The paper’s claim of adaptive robustness is tested twice: with the paper’s own attack, and with a stronger adaptive attack it did not consider.
Method
Each row of the paper’s evaluation table becomes one ledger item: the claim, its direction, the number reported and the number re-run. Verdicts are computed, never typed. An item holds when the difference between the reproduced and the reported number falls inside the pass region its direction allows.
The stronger adaptive attack is the search from Calibration is not robustness, run against this detector’s released checkpoint. Its rewrites are not published:
Reproduction ledger
Reported against reproduced
4 / 6 claims hold within ±2.0 pp (declared before the re-run)
-
Accuracy on held-out benign prompts
Reported ≈ 98.2% , reproduced 97.6% −0.6 pp
holds
-
False-positive rate on benign traffic
Reported ≤ 1.0% , reproduced 1.3% +0.3 pp
holds
-
Detection of the static injection suite
Reported ≈ 95.7% , reproduced 94.9% −0.8 pp
holds
-
Detection of the paraphrased transfer set
Reported ≈ 91.2% , reproduced 87.4% −3.8 pp
fails
-
Detection under the paper's own adaptive attack
Reported ≈ 88.4% , reproduced 87.1% −1.3 pp
holds
-
Detection under a stronger adaptive attack
Reported ≥ 80.0% , reproduced 21.7% −58.3 pp
fails
Data table
| Claim | Direction | Reported | Reproduced | Difference | Verdict | Prompts |
|---|---|---|---|---|---|---|
| Accuracy on held-out benign prompts | approx | 98.2% | 97.6% | −0.6 pp | holds | 2,000 |
| False-positive rate on benign traffic | at-most | 1.0% | 1.3% | +0.3 pp | holds | 5,000 |
| Detection of the static injection suite | approx | 95.7% | 94.9% | −0.8 pp | holds | 1,200 |
| Detection of the paraphrased transfer set | approx | 91.2% | 87.4% | −3.8 pp | fails | 800 |
| Detection under the paper's own adaptive attack | approx | 88.4% | 87.1% | −1.3 pp | holds | 600 |
| Detection under a stronger adaptive attack | at-least | 80.0% | 21.7% | −58.3 pp | fails | 600 |
Results
4 of 6 claims hold at the declared tolerance. The static evaluations reproduce closely; the largest static miss is the paraphrased transfer set, at −3.8 percentage points from the reported number.
The adaptive claim is where the reproduction fails. The paper reports detection of at least 80% under adaptive attack, and its own attack reproduces within tolerance. Against the stronger adaptive attack, detection is 21.7%.
Move the tolerance in the figure to see how much the verdicts depend on it. Within any plausible range only the paraphrase item changes; the adaptive failure does not depend on the tolerance at all.
Limitations
- Released checkpoint only. If the paper’s numbers came from a different checkpoint, some differences are version drift rather than irreproducibility.
- Sampling. Each item’s re-run uses the paper’s test size where it is known. Small sets carry wide intervals; sizes are in the data table.
- A failed reproduction is not a refutation. It says the claim did not hold under this protocol. The authors have the full ledger.
Further thinking
Robustness claims should ship with the two things that decide whether they will hold: the attack budget, and what the attacker is assumed to know.
Ledgers like this one are cheap to keep. Every entry on this shelf can carry one for the claims it builds on.