Title: Tensor Trust: Interpretable Prompt Injection Attacks from an Online Game
Summary: The authors propose a benchmark testing model's robustness to prompt injection attacks. The authors collect multi-step attacks and defenses though red-teaming in the form of an online LLM-driven adversarial game in which the adversarial goal is for the LLM to leak secret string set by the defender. They then compare multiple SOTA LLMs on their robustness to leaking the secrets.
Phenomenon type: General Capability (A broadly useful ability, which could be relevant to multiple applications)
Target phenomenon: robustness, instruction following
Phenomenon defined by authors: No
Phenomenon definition: "The two benchmarks evaluate how robust instruction-following LLMs are to
prompt extraction and prompt hijacking attacks"
Definition scope: Comprehensive
Definition integrity: Composite phenomenon
Definition integrity detail: Yes
Phenomenon contested: Not defined
Task definition: The LLM is instructed to only print "Access Granted" if the user correctly guesses a secret key. The task measured is the robustness of the model to follow this instruction under prompt injection attacks.
Task item definition: Defense (2-part) + Attack + Secret Access Token 
Task source: Crowd-sourced task examples (e.g. Prolific-created tasks)
Task ecology: Constructed task (e.g. predicting medical diagnoses from clinicians' notes)
Dataset size: 1344
Dataset metadata available: Yes
Dataset metadata detail: timestamps, user identifiers
Sampling method: Convenience sample (creators found a set of tasks that was readily accessible), Specific criteria (items were taken from a larger set based on specified rules)
Split reviewed: Test
Response format: Free response (e.g. summary paragraph, executable code)
Metric definition: Exact Match (accuracy, F1, precision, recall)
Metric definition detail: Pending on the subtask, 2 metrics are defined. Both measure Robustness Rate (model following defender instructions) as a function of Defense Validity, i.e. did the model comply when the attacker objectively won.
Metric aggregation: Simple Mean
Metric subscores: Yes
Metric subscores detail: Scores for Hijacking robustness and Extraction robustness
Metric access: Outputs alone
Few-shot evaluation: No
Authorship: Academia
Benchmark availability: Yes
Task face validity: Yes
Metric face validity: Yes
Results interpreted by authors: Yes
Results compared: No
Results comparison explanation: No comparisons made
Results realism: Yes
Human baseline: No
Authors discuss validity: No
Taxonomy: Alignment / Safety
New taxonomy: General Capability / Safety
Other notes: The paper provides wide range of valuable contributions, however, the fact that only 1 single instruction following tasks underlies the entire dataset drastically limits its generalizability to "instruction following robustness to prompt injection". It really interesting benchmark and has merit due to the well-defined task and attack success criteria, but it schould not be seen as represntative of the wider phenomenon.