Attacks that keep answers almost correct have more success on 7 models

Researchers make NTBench, a test of prompt injection. Prompt injection is an instruction in external content that makes an AI model give an incorrect result. NTBench targets answers that look correct but are incorrect or dangerous. The authors test seven models on ten language datasets and two agent benchmarks, with three attacks for each sample. Each model has more attack success than with attacks that do not change.

How it works

Previous tests check if a model accepts an instruction that stops the task of the user. NTBench keeps most of a correct answer and changes it to be incorrect or dangerous. Each attack starts from a correct answer. Language models and persons check the changes.

The numbers

• Incorrect targets: 9.3 to 35.8 points more success.
• Dangerous targets: 1.7 to 17.3 points more success.

These results are for language tasks. The authors give no result for the agent tests.

What is not known

The report does not name the models and gives no defense. The authors tell that a good result against attacks that do not change does not show a good result against related attacks.

Insight: Defense scores are a minimum of the risk

In previous tests, GPT-4o has an attack success rate of 58% and GPT-5 mini has 47%. Meta SecAlign, a model with defense against prompt injection, has 32%. NTBench shows that tests with one target do not find related attacks. These rates read as a minimum of the risk, not a measure of it. Tell your vendor to give results for attacks that keep answers almost correct.