Gray Swan Indirect Prompt Injection, attack success at 15 attempts (Gray Swan IPI (15 attempts))
We show this table for reference; we do not rank on it.
Measures how often indirect prompt-injection attacks succeed within fifteen attempts. Lower scores mean greater resistance to the tested attacks.
Benchmark score on Gray Swan IPI (15 attempts) — November 13, 2026
We compile the Gray Swan IPI (15 attempts) rows from provider self-reports. Gemini 4 Carbon leads the table at 0.0%, followed by Gemini 4 Argon (0.7%) and Claude Fable 5.1 (1.0%). We do not use these results to rank models overall.
Gemini 4 Carbon
Gemini 4 Argon
Claude Fable 5.1
Anthropic
Lab-reported, from another publisher’s document14 modelsInstruction FollowingCurrentDisplay onlyUpdated November 13, 2026
Benchmark score table (14 models)
None of the 14 results on this page has a documented run by the benchmark or an independent evaluator: 4 reported by the labs that built the models and 10 reported in another publisher’s document.
| Rank | Model / configuration | Score | Who ran it | Parameters (B) | Open / closed |
|---|---|---|---|---|---|
| 1 | Gemini 4 CarbonGoogleReported by Google | 0.0% | Reported by Google | Not reported | Closed |
| 2 | Gemini 4 ArgonGoogleReported by Google | 0.7% | Reported by Google | Not reported | Closed |
| 3 | Claude Fable 5.1AnthropicLab-reported, from another publisher’s document | 1.0% | Lab-reported, from another publisher’s document | Not reported | Closed |
| 4 | Claude Opus 5.5AnthropicLab-reported, from another publisher’s document | 1.0% | Lab-reported, from another publisher’s document | Not reported | Closed |
| 5 | Claude Opus 5AnthropicLab-reported, from another publisher’s document | 4.6% | Lab-reported, from another publisher’s document | Not reported | Closed |
| 6 | Gemini 3.8 FlashGoogleReported by Google | 5.5% | Reported by Google | Not reported | Closed |
| 7 | Gemini 3.8 Flash CyberGoogleReported by Google | 6.0% | Reported by Google | Not reported | Closed |
| 8 | GPT-6 AstraOpenAILab-reported, from another publisher’s document | 8.5% | Lab-reported, from another publisher’s document | Not reported | Closed |
| 9 | GPT-6 SolOpenAILab-reported, from another publisher’s document | 10.1% | Lab-reported, from another publisher’s document | Not reported | Closed |
| 10 | Muse Spark 1.3MetaLab-reported, from another publisher’s document | 15.9% | Lab-reported, from another publisher’s document | Not reported | Closed |
| 11 | GPT-5.6 SolOpenAILab-reported, from another publisher’s document | 27.0% | Lab-reported, from another publisher’s document | Not reported | Closed |
| 12 | GLM-5.3Z.AILab-reported, from another publisher’s document | 31.5% | Lab-reported, from another publisher’s document | Not reported | Open |
| 13 | Grok 4.6xAILab-reported, from another publisher’s document | 51.8% | Lab-reported, from another publisher’s document | Not reported | Closed |
| 14 | Kimi K3Moonshot AILab-reported, from another publisher’s document | 52.7% | Lab-reported, from another publisher’s document | Not reported | Open |
- Lab-reported
- Benchmark-run
- Independent
How to read this leaderboard
Operator receipt: 14 sourced rows are currently displayable on this page; the leading published row is Gemini 4 Carbon at 0.0%.
Honest limit: The announcement does not publish the task count, attack corpus, or full evaluation configuration. This result does not measure general instruction following.
Among the reported Gray Swan IPI (15 attempts) rows, Gemini 4 Carbon is first at 0.0%. The third row is 1.0 points higher. The broader top-10 range is 15.9 points, so the table still separates the published systems.
14 models have been evaluated on Gray Swan IPI (15 attempts). The benchmark falls in the Instruction Following category. Gray Swan IPI (15 attempts) is currently displayed for reference but excluded from the scoring formula, so it does not directly affect overall rankings.
About Gray Swan IPI (15 attempts)
Year
2026
Tasks
Indirect prompt-injection attacks
Format
Attack success rate at 15 attempts
Difficulty
Adversarial prompt injection
Google reports attack success rates supplied by Gray Swan. The launch chart labels the values above its bars as success at k=15; k=1 and k=10 are separate chart series. We store only the explicitly labeled k=15 values as provider-reported, display-only evidence.
Gray Swan IPI (15 attempts) is one of the cyber benchmarks we track. The cybersecurity benchmark comparison sets it beside the others, one table per security job.
Freshness and provenance
Version
Gray Swan IPI (15 attempts) 2026
Refresh cadence
Quarterly
Staleness state
Current
Question availability
Public benchmark set
BenchLM uses freshness metadata to decide whether a benchmark should still be treated as a strong differentiator, a benchmark to watch, or a display-only reference. For the full scoring policy, see the BenchLM methodology page.
Questions
What does Gray Swan IPI (15 attempts) measure?
Measures how often indirect prompt-injection attacks succeed within fifteen attempts. Lower scores mean greater resistance to the tested attacks.
Which model scores highest on Gray Swan IPI (15 attempts)?
Gemini 4 Carbon by Google currently leads with a score of 0.0% on Gray Swan IPI (15 attempts).
How many models are evaluated on Gray Swan IPI (15 attempts)?
14 AI models have published results on Gray Swan IPI (15 attempts) in the BenchLM catalog.
Compare top models on Gray Swan IPI (15 attempts)
Know when it’s worth switching models
The model to choose, the cheaper alternative, and the release we would wait on.
Read a sample issueJoin 7,000+ subscribers.
One email each week. Unsubscribe anytime.