Every defense looks perfect against the attacks it was designed around. The paper runs the full cross-product instead: five defense paradigms, five attack families, per-model. Pick a defense and watch the prefilling column — the one the prompt-time gate never sees.
Prefilling ASR
—%
Semantic attacks ≤5%
—/4
Aggregate DSR
—
Blind spot
—
Attack success rate by attack family (n=40 per cell, keyword judge):
Where these numbers come from
All cells are Table 1 of the paper: attack success rate under the keyword judge at n=40 per attack. A 0/40 cell carries a Wilson 95% CI of [0%, 9%]. The Llama prefilling headline is additionally scaled to n=200 (0–1/200 across runs) and confirmed by a Gemma-4-31B LLM judge.
Prompt-time paradigms (static steering, CAST, AlphaSteer, prompt-time probe-gating) act on the prompt's activations, before any token is generated. AlphaSteer's 50% prefilling ASR here is the current-environment number; the original paper environment measured 82% (Appendix on environment drift).
Response-halt compositions were measured on Mistral-7B and Llama-3.1-8B. "AlphaSteer + response halt" is the composition the paper's corollary prescribes: steering covers prompt-borne attacks, the first-token probe covers prefilling.
Scope: prefilling results are for the canonical prefilling-attack template family; cross-template generalisation depends on probe depth (see the paper's holdout diagnostic).