NUWA Evidence record
GPT-4 Turbo
AgentDojo · Evidence record
Original source charts and materials
Reported results
Source order · reported configurations
Select systems
Targeted attack success
0–100%
GPT-4 TurboValues describe the measured outcome under the source protocol, not a general safety score.
Table 3. Baseline agents on 629 security cases covering 97 user tasks. Error bars are the source-reported 95% confidence intervals; cases are not 629 independent trials. Evaluation date not specified; publication / record dates are shown below.
Evaluation conditions and system configurations
- GPT-4 Turbo
- 629 security test cases; 97 distinct user tasks. Not 629 independent repetitions. · 629 security cases / 97 user tasks
- modelVersion: not specified · harness: Paper's baseline tool-calling agent (§3.2) · tools: Workspace, Slack, banking and travel task suites · budget: not specified
| System / configuration | Benign utility | Utility under attack | Targeted attack success | Publication / verification |
|---|---|---|---|---|
| GPT-4 TurboPaper's baseline tool-calling agent (§3.2) | 63.43%± 3.76 pp (95% CI) | 54.05%± 3.89 pp (95% CI) | 28.62%± 3.53 pp (95% CI) | Published2024-11-24 |
Method and scope
Targeted attack success and user-task utility in a tool-use environment.
- Evidence type
- Benchmark
- Assessment subject
- Defender agent under injected tool output
- Primary dimension
- Behavior
- Evidence snapshot
- 2026-10-29.1
Primary dimension follows the source’s measured construct. Metric-level interpretations may differ.
Source finding
The source reports these three outcomes for the named baseline agent.
NUWA interpretation
Read the attack outcome together with utility; the model name alone does not specify a reproducible system.
Limitations
Attack success must be read alongside benign utility and the tested attack setup.
Historical paper result. Immutable model revision and a comparable resource budget are not normalized in this catalogue; no automatic ranking is enabled.
Related research questions
Cybersecurity / Agent compromise through untrusted input →
The source directly measures the stated construct under its protocol.
References
Numerical results are reported by the cited authors.
- [1] Edoardo Debenedetti, Jie Zhang, et al.. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. 2024-11-24. v3 ; Author affiliations on the original paper title page; Appendix C, Table 3