## Bar Chart: Attack Success Rate (ASR) by Prompt Injection Technique
### Overview
This image displays a grid of 12 grouped bar charts comparing the "Attack Success Rate (ASR)" of five different security models against various prompt injection techniques. The Y-axis represents the ASR, ranging from 0.0 to 1.0. Each sub-chart represents a specific adversarial technique. The models are color-coded in the legend at the bottom.
### Components/Axes
* **Y-Axis:** "Attack Success Rate (ASR)", scaled from 0.0 to 1.0.
* **X-Axis (Categories):** 12 distinct prompt injection techniques:
* Deletion Characters
* Diacritics
* Emoji Smuggling
* Full Width Text
* Homoglyphs
* Numbers
* Bidirectional Text
* Spaces
* Underline Accent Marks
* Unicode Tags Smuggling
* Upside Down Text
* Zero Width
* **Legend (Bottom):**
* **Teal:** Azure Prompt Shield
* **Blue:** Protect AI v1
* **Light Green:** Meta Prompt Guard
* **Yellow:** Vijil Prompt Injection
* **Pink:** Protect AI v2
### Detailed Analysis
The following values are approximate based on visual estimation of the bar heights:
| Technique | Azure (Teal) | Protect AI v1 (Blue) | Meta (Lt. Green) | Vijil (Yellow) | Protect AI v2 (Pink) |
| :--- | :--- | :--- | :--- | :--- | :--- |
| **Deletion Characters** | ~0.5 | ~0.7 | ~0.0 | ~0.0 | ~0.1 |
| **Diacritics** | ~0.4 | ~0.85 | ~1.0 | ~1.0 | ~0.0 |
| **Emoji Smuggling** | ~1.0 | ~1.0 | ~1.0 | ~1.0 | ~1.0 |
| **Full Width Text** | ~0.5 | ~0.7 | ~0.0 | ~1.0 | ~0.2 |
| **Homoglyphs** | ~1.0 | ~0.9 | ~0.5 | ~0.6 | ~0.0 |
| **Numbers** | ~1.0 | ~0.95 | ~1.0 | ~1.0 | ~0.15 |
| **Bidirectional Text** | ~1.0 | ~0.95 | ~1.0 | ~1.0 | ~0.0 |
| **Spaces** | ~0.85 | ~0.1 | ~1.0 | ~1.0 | ~0.0 |
| **Underline Accent Marks**| ~0.95 | ~1.0 | ~0.05 | ~1.0 | ~0.0 |
| **Unicode Tags Smuggling**| ~0.5 | ~0.9 | ~1.0 | ~1.0 | ~1.0 |
| **Upside Down Text** | ~0.2 | ~0.9 | ~1.0 | ~1.0 | ~0.0 |
| **Zero Width** | ~0.85 | ~0.1 | ~1.0 | ~1.0 | ~0.0 |
### Key Observations
* **Protect AI v2 (Pink)** is the most robust model overall, showing an ASR of ~0.0 for the majority of categories (Diacritics, Homoglyphs, Bidirectional Text, Spaces, Underline Accent Marks, Upside Down Text, Zero Width). However, it fails completely (ASR ~1.0) against "Emoji Smuggling" and "Unicode Tags Smuggling."
* **Meta Prompt Guard (Light Green)** and **Vijil Prompt Injection (Yellow)** show consistently high ASRs (near 1.0) across almost all categories, suggesting they are highly susceptible to these specific injection techniques.
* **Emoji Smuggling** is the only technique where all five models show an ASR of ~1.0, indicating it is a universally effective attack vector among the tested models.
* **Protect AI v1 (Blue)** shows a significant performance variance; it is highly effective against "Spaces" and "Zero Width" (ASR ~0.1) but highly ineffective against most other categories.
### Interpretation
The data demonstrates that there is no "silver bullet" model among those tested. The security landscape is highly fragmented:
1. **Specialization vs. Generalization:** Models like "Protect AI v2" appear to have been trained or tuned to handle specific character-level obfuscations (like Zero Width or Spaces) extremely well, resulting in near-zero ASR. However, this specialization creates "blind spots" (e.g., Emoji and Unicode Tags), where the model fails entirely.
2. **The "Smuggling" Vulnerability:** The fact that all models fail at "Emoji Smuggling" suggests a fundamental limitation in how these security layers parse or tokenize input, likely treating emojis as benign or failing to normalize them before analysis.
3. **Adversarial Arms Race:** The high ASRs for Meta and Vijil across most categories suggest that these models may be struggling to keep pace with the specific adversarial techniques used in this evaluation, or that they prioritize different security parameters (e.g., false positive reduction) over blocking these specific injection types.
