Multilingual gap: the multi-layer defense bypasses 73.5% of PT-BR injection samples versus 25.1% of English samples¶
Claim · All claims
Evidence · 1 study · designr2·q2
Currency · newest study 2026 · not yet checked against its sources · not reviewed by a person · recheck by 2029: tool and model accuracy changes quickly
Subclaims¶
Reading the evidence codes
q is the design tier, i the impact, n the sample, and the kind with its r
the rigour judged within that kind: what each code means.
This claim: no standardized effect is recorded in observations/ for it yet, so no benchmark reading is possible.
q2 i? Portuguese (PT-BR) injection queries bypass the multi-layer defense at 73.5% versus 25.1% for English queries, a 48.3 percentage point gap attributed to Layer 1 pattern coverage gaps. → Alexandre Cristovão Maiorano 2026
Evidence¶
Alexandre Cristovão Maiorano 2026¶
Alexandre Cristovão Maiorano. (2026). Evaluating Prompt Injection Defenses for Educational LLM Tutors: Security-Usability-Latency Trade-offs. https://arxiv.org/abs/2605.06669 doi:10.48550/arxiv.2605.06669
q2 · i? · design · r2
Language-stratified analysis of the multi-layer defense on the holdout benchmark (Table 7). Failure-pattern analysis reports "34% of PT-BR injection patterns lack corresponding regex rules in Layer 1", plus accent-character and translation-artifact bypasses.
"The 48.3 percentage point gap in bypass rate between EN (25.1%) and PT-BR (73.5%) samples indicates that multilingual coverage remains an active challenge."
Discussion¶
Related Claims¶
- Head-to-head comparison exposes a security-usability-latency tension: NeMo reaches 0% bypass at 16.22% FPR and ~1.5 s latency while Prompt Guard yields 38.48% bypass at 3.60% FPR — related
- A four-layer multi-layer defense pipeline achieves 46.34% bypass and 0.00% false positive rate on the holdout benchmark — related
- Multi-layer defense significantly reduces bypass relative to regex-only filtering (69.65% to 46.34%), confirmed by exact McNemar test — related
- Bypass robustness varies across student personas (32.76% to 52.05%) while FPR stays 0.00% across all personas — related
- Under defense-in-depth, all 171 multi-layer bypass events are rated severity S0 (no impact) because the tutor system prompt and provider filter absorbed residual leakage — related
Page metadata
| Field | Value |
|---|---|
type |
claim |
id |
ptbr-bypass-gap-lexical-coverage |
title |
Multilingual gap: the multi-layer defense bypasses 73.5% of PT-BR injection samples versus 25.1% of English samples |
description |
Multilingual gap: the multi-layer defense bypasses 73.5% of PT-BR injection samples versus 25.1% of English samples |
status |
review |
evidence_strength |
moderate |
newest_evidence |
2026 |
recheck_by |
2029 |
generated |
by process:wiki-ingest on 2026-10-11 |
trust |
unverified — no one has confirmed this page's content |
sources |
1 — alexandre-cristovão-maiorano-2026 |
Frontmatter is the page's machine-readable record — see the Schema & Guide.