Bypass robustness varies across student personas (32.76% to 52.05%) while FPR stays 0.00% across all personas¶
Claim · All claims
Evidence · 1 study · designr2·q2
Currency · newest study 2026 · not yet checked against its sources · not reviewed by a person · recheck by 2029: tool and model accuracy changes quickly
Subclaims¶
Reading the evidence codes
q is the design tier, i the impact, n the sample, and the kind with its r
the rigour judged within that kind: what each code means.
This claim: no standardized effect is recorded in observations/ for it yet, so no benchmark reading is possible.
q2 i? Under the multi-layer configuration, bypass ranges from 32.76% (career switcher) to 52.05% (teaching assistant), a 19.29 percentage-point spread, while FPR remains 0.00% across all personas. → Alexandre Cristovão Maiorano 2026
Evidence¶
Alexandre Cristovão Maiorano 2026¶
Alexandre Cristovão Maiorano. (2026). Evaluating Prompt Injection Defenses for Educational LLM Tutors: Security-Usability-Latency Trade-offs. https://arxiv.org/abs/2605.06669 doi:10.48550/arxiv.2605.06669
q2 · i? · design · r2
Persona-stratified holdout stress testing across five personas (deadline student, red team tester, teaching assistant, curious beginner, career switcher). The text states benign-access protection is stable across archetypes but adversarial robustness varies with persona/scenario mix.
"In the multi-layer configuration, bypass ranges from 32.76% (career switcher) to 52.05% (teaching assistant), a 19.29 percentage-point spread, while FPR remains 0.00% across all personas in this benchmark."
Discussion¶
Related Claims¶
- Multi-layer defense significantly reduces bypass relative to regex-only filtering (69.65% to 46.34%), confirmed by exact McNemar test — related
- A four-layer multi-layer defense pipeline achieves 46.34% bypass and 0.00% false positive rate on the holdout benchmark — related
- Head-to-head comparison exposes a security-usability-latency tension: NeMo reaches 0% bypass at 16.22% FPR and ~1.5 s latency while Prompt Guard yields 38.48% bypass at 3.60% FPR — related
- Multilingual gap: the multi-layer defense bypasses 73.5% of PT-BR injection samples versus 25.1% of English samples — related
- Under defense-in-depth, all 171 multi-layer bypass events are rated severity S0 (no impact) because the tutor system prompt and provider filter absorbed residual leakage — related
Page metadata
| Field | Value |
|---|---|
type |
claim |
id |
persona-stratified-bypass-heterogeneity |
title |
Bypass robustness varies across student personas (32.76% to 52.05%) while FPR stays 0.00% across all personas |
description |
Bypass robustness varies across student personas (32.76% to 52.05%) while FPR stays 0.00% across all personas |
status |
review |
evidence_strength |
moderate |
newest_evidence |
2026 |
recheck_by |
2029 |
generated |
by process:wiki-ingest on 2026-10-11 |
trust |
unverified — no one has confirmed this page's content |
sources |
1 — alexandre-cristovão-maiorano-2026 |
Frontmatter is the page's machine-readable record — see the Schema & Guide.