PIArena: A Platform for Prompt Injection Evaluation

Runpeng Geng; Chenlong Yin; Yanting Wang; Ying Chen; Jinyuan Jia

cs.CRApr 9, 2026

PIArena: A Platform for Prompt Injection Evaluation

Authors: Runpeng Geng, Chenlong Yin, Yanting Wang, Ying Chen, Jinyuan Jia

Organizations: The Pennsylvania State University

Abstract

Prompt injection attacks pose serious security risks across a wide range of real-world applications. While receiving increasing attention, the community faces a critical gap: the lack of a unified platform for prompt injection evaluation. This makes it challenging to reliably compare defenses, understand their true robustness under diverse attacks, or assess how well they generalize across tasks and benchmarks. For instance, many defenses initially reported as effective were later found to exhibit limited robustness on diverse datasets and attacks. To bridge this gap, we introduce PIArena, a unified and extensible platform for prompt injection evaluation that enables users to easily integrate state-of-the-art attacks and defenses and evaluate them across a variety of existing and new benchmarks. We also design a dynamic strategy-based attack that adaptively optimizes injected prompts based on defense feedback. Through comprehensive evaluation using PIArena, we uncover critical limitations of state-of-the-art defenses: limited generalizability across tasks, vulnerability to adaptive attacks, and fundamental challenges when an injected task aligns with the target task. The code and datasets are available at https://github.com/sleeepeer/PIArena.

Figures & tables

Benchmark	Attack	Defense	Unified	Plug-n-Play	Extensible
	Evaluation	Evaluation	API	Tools
OPI	Static	✓	✗	✗	✗
SEP	Static	✗	✗	✗	✗
BIPIA	Static	✓	✗	✗	✗
AlpacaFarm	Static	✗	✗	✗	✗
InjecAgent	Static	✗	✗	✗	✗

Table 1: Comparison between existing prompt injection benchmarks and PIArena .

Figure 2: Overview of PIArena Modules and Framework.

Dataset	Attack	No Defense		PISanitizer		SecAlign++		DataFilter		PromptArmor		DataSentinel		PromptGuard		Attn.Tracker		PIGuard
Dataset	Attack	Utility	ASR	Utility	ASR	Utility	ASR	Utility	ASR	Utility	ASR	Utility	ASR	Utility	ASR	Utility	ASR	Utility	ASR
SQuAD v2	No Attack	1.0	0.0	0.99	0.0	0.84	0.01	0.99	0.01	1.0	0.0	0.99	0.0	0.96	0.0	0.61	0.0	1.0	0.0
	Combined	0.52	0.97	0.95	0.01	0.78	0.01	0.69	0.24	0.74	0.60	N/A	0.15	N/A	0.0	N/A	0.0	N/A	0.0
	Direct	0.56	0.86	0.95	0.04	0.82	0.01	0.65	0.74	0.66	0.77	N/A	0.47	N/A	0.24	N/A	0.0	N/A	0.15
	Strategy	0.32	1.00	0.48	0.85	0.91	0.09	0.38	0.93	0.36	1.00	N/A	0.78	N/A	1.00	N/A	0.0	N/A	0.71
Dolly Closed QA	No Attack	0.99	0.03	0.99	0.03	0.76	0.01	0.98	0.03	0.99	0.03	0.98	0.03	0.91	0.02	0.38	0.0	0.98	0.03

Table 2: Effectiveness of state-of-the-art defenses under prompt injection attacks. For detection-based defenses, utility under attack is not reported since flagged inputs produce no responses.

LLM	No Attack		Direct
LLM	Utility	ASR	Utility	ASR
Qwen3-4B-Instruct	1.0	0.0	0.56	0.86
Qwen3-30B-Instruct	1.0	0.0	0.59	0.85
Llama3.3-70B-Instruct	0.99	0.0	0.66	0.86
gpt-oss-120b	0.99	0.0	0.51	0.61
GPT-4o	1.0	0.0	0.57	0.92

Table 3: Results of different LLMs. The tested dataset is SQuAD v2.

Defense	No Attack		Know.Corrupt.
Defense	Utility	ASR	Utility	ASR
No Defense	0.91	0.03	0.43	0.81
PISanitizer	0.91	0.03	0.48	0.67
SecAlign++	0.78	0.03	0.50	0.58
DataFilter	0.83	0.04	0.35	0.78
PromptArmor	0.91	0.03	0.42	0.82

Table 4: Results when injected tasks align with target task. The tested dataset is NQ.

Defense	InjecAgent		AgentDojo		AgentDyn		WASP
Defense	Utility	ASR	Utility	ASR	Utility	ASR	Utility	ASR
No Defense	N/A	0.29	0.52	0.42	0.56	0.40	0.62	0.37
PISanitizer	N/A	0.03	0.63	0.07	0.43	0.07	0.61	0.38
SecAlign++	N/A	0.01	0.19	0.0	0.07	0.04	0.56	0.06
DataFilter	N/A	0.0	0.68	0.08	0.25	0.03	0.06	0.27
PromptArmor	N/A	0.05	0.38	0.06	0.06	0.01	0.62	0.37

Table 5: Evaluation of defenses on agentic benchmarks using PIArena ’s portable modules.

Defense	OPI		SEP
Defense	Utility	ASR	Utility	ASR
No Defense	0.50	0.44	0.58	0.72
PISanitizer	0.62	0.04	0.90	0.03
SecAlign++	0.56	0.01	0.66	0.01
DataFilter	0.65	0.07	0.98	0.01
PromptArmor	0.71	0.31	0.60	0.69

Table 6: Evaluation of defenses on general prompt injection benchmarks using PIArena .

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Defense	No Attack		GCG
Defense	Utility	ASR	Utility	ASR
No Defense	0.19	0.0	0.11	0.63
PISanitizer	0.19	0.0	0.19	0.11
SecAlign++	0.20	0.02	0.20	0.86
DataFilter	0.20	0.0	0.19	0.04
PromptArmor	0.19	0.0	0.12	0.60

Appendix

Table 7: Some defenses fail to defend against strong optimization-based attacks. The tested dataset is MultiNews.

Dataset	Task Type	Utility Metric	Avg Len	#Samples
SQuAD v2 Rajpurkar et al. (2018)	Question Answering	LLM-as-a-Judge	706	200
Dolly (QA) Conover et al. (2023)	Question Answering	LLM-as-a-Judge	1,062	200
Dolly (Info Extraction) Conover et al. (2023)	Information Extraction	LLM-as-a-Judge	1,086	200
Dolly (Summarization) Conover et al. (2023)	Summarization	LLM-as-a-Judge	1,567	200
NQ Kwiatkowski et al. (2019)	RAG	LLM-as-a-Judge	5,432	100
MS-MARCO Bajaj et al. (2016)	RAG	LLM-as-a-Judge	5,089	100

Appendix

Table 8: Dataset statistics and evaluation metrics in PIArena .

Defense	Avg. Iterations
PISanitizer	1.500
SecAlign++	4.555
DataFilter	1.135
PromptArmor	1.015
DataSentinel	1.930
PromptGuard	1.040

Appendix

Table 9: Number of iterations per sample for the strategy-based attack on Dolly Closed QA.

Defense	PAIR		TAP		Strategy
Defense	Utility	ASR	Utility	ASR	Utility	ASR
No Defense	0.56	0.87	0.58	0.85	0.32	1.00
PISanitizer	0.96	0.05	0.96	0.05	0.48	0.85
SecAlign++	0.86	0.01	0.86	0.03	0.91	0.09
DataFilter	0.67	0.71	0.73	0.66	0.38	0.93
PromptArmor	0.58	0.82	0.67	0.76	0.36	1.00

Appendix

Table 10: Comparison of our strategy-based attack with existing search-based attacks on SQuAD v2.

Figure 3: Dataset structure of PIArena .

Explore similar work

PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses
Mar 13, 2026Chenlong Yin, Runpeng Geng, Yanting Wang +1Prompt Injection Attacks on LLMs LLM Red Teaming
The Pennsylvania State University
PIDS-Bench: Evaluating Prompt-Injection Detectors Under Over-Defense, Obfuscation, and Distribution Shift
Sep 14, 2026Yusuf Khalid Shire, Sang-Chul KimDistribution Shift Robustness Prompt Injection Detection
Department of Software Convergence, Kookmin University, Seoul, Republic of Korea
LongPIBench: A Long-Context Benchmark for Prompt Injection
Aug 28, 2026Yupei Liu, Yuqi Jia, Neil Zhenqiang Gong +1Prompt Injection Prompt Injection Attacks
The Pennsylvania State University · Duke University

Mar 13, 2026J/K move · Enter open · S save

PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses

Chenlong Yin, Runpeng Geng, Yanting Wang, Jinyuan Jia

The Pennsylvania State University

Prompt Injection Attacks on LLMs LLM Red Teaming Prompt Injection Defense Prompt Injection Attacks on AI Agents Black-Box Adversarial Attacks

Open paper AskPDF arXiv

Prompt injection poses serious security risks to real-world LLM applications, particularly autonomous agents. Although many defenses have been proposed, their robustness against adaptive attacks remains insufficiently evaluated, potentially creating a false sense of security. In this work, we propose PISmith, a reinforcement learning (RL)-based red-teaming framework that systematically assesses existing prompt-injection defenses by training an attack LLM to optimize injected prompts in a practical black-box setting, where the attacker can only query the defended LLM and observe its outputs. We find that directly applying standard GRPO to attack strong defenses leads to sub-optimal performance due to extreme reward sparsity -- most generated injected prompts are blocked by the defense, causing the policy's entropy to collapse before discovering effective attack strategies, while the rare successes cannot be learned effectively. In response, we introduce adaptive entropy regularization and dynamic advantage weighting to sustain exploration and amplify learning from scarce successes. Extensive evaluation on 13 benchmarks demonstrates that state-of-the-art prompt injection defenses remain vulnerable to adaptive attacks. We also compare PISmith with 7 baselines across static, search-based, and RL-based attack categories, showing that PISmith consistently achieves the highest attack success rates. Furthermore, PISmith achieves strong performance in agentic settings on InjecAgent and AgentDojo against both open-source and closed-source LLMs (e.g., GPT-4o-mini and GPT-5-nano). Our code is available at https://github.com/albert-y1n/PISmith.

Abstract

Explore similar work

PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses

PIDS-Bench: Evaluating Prompt-Injection Detectors Under Over-Defense, Obfuscation, and Distribution Shift

LongPIBench: A Long-Context Benchmark for Prompt Injection