PIArena: A Platform for Prompt Injection Evaluation

Abstract: Prompt injection attacks pose serious security risks across a wide range of real-world applications. While receiving increasing attention, the community faces a critical gap: the lack of a unified platform for prompt injection evaluation. This makes it challenging to reliably compare defenses, understand their true robustness under diverse attacks, or assess how well they generalize across tasks and benchmarks. For instance, many defenses initially reported as effective were later found to exhibit limited robustness on diverse datasets and attacks. To bridge this gap, we introduce PIArena, a unified and extensible platform for prompt injection evaluation that enables users to easily integrate state-of-the-art attacks and defenses and evaluate them across a variety of existing and new benchmarks. We also design a dynamic strategy-based attack that adaptively optimizes injected prompts based on defense feedback. Through comprehensive evaluation using PIArena, we uncover critical limitations of state-of-the-art defenses: limited generalizability across tasks, vulnerability to adaptive attacks, and fundamental challenges when an injected task aligns with the target task. The code and datasets are available at https://github.com/sleeepeer/PIArena.

• The paper introduces a modular platform that standardizes prompt injection evaluation through plug-and-play integration of attacks, defenses, and benchmarks.
• It demonstrates that dynamic, strategy-based attacks dramatically elevate attack success rates compared to static approaches.
• Evaluation shows that current defenses, including those in commercial LLMs, suffer from poor generalizability and struggle under adaptive threat scenarios.

PIArena: A Unified Platform for Prompt Injection Evaluation

Motivation and Systemic Gaps in Prompt Injection Evaluation

Prompt injection represents a critical security vulnerability in LLM-powered applications, enabling adversaries to manipulate backend model behavior by injecting instructions through untrusted contexts. Despite a proliferation of attacks, defenses, and benchmarks, the field lacks a systematic, reproducible evaluation framework. Existing benchmarks almost exclusively rely on static attack templates and ad hoc integration protocols, precluding fair comparison of defense robustness, generalizability, and cross-benchmark transferability.

PIArena directly addresses this infrastructure deficit with a modular, unified, and extensible evaluation platform. The system enables plug-and-play integration of attacks, defenses, and benchmarks, promoting reproducibility and efficiency. The provision of standardized APIs and evaluation metrics abstracts away implementation complexity, fostering comparability and continuous extensibility by the research community.

Figure 1: Example API usage patterns of PIArena, illustrating seamless integration and evaluation abstraction.

Architecture and Module Design

PIArena consists of four principal modules: benchmark, attack, defense, and evaluator. Benchmarks encapsulate datasets that include target task instructions, context, and injected tasks, supporting a broad range of application scenarios from QA to retrieval-augmented generation (RAG) and code generation. The attack module incorporates state-of-the-art prompt injection techniques, ranging from classic static templates to optimization-based and adaptive strategies. The defense module aggregates the spectrum of detection- and prevention-based defenses, supporting both LLM-augmented classifiers and policy-driven mitigations. The evaluator implements task-specific (e.g., F1, ROUGE) and LLM-as-a-judge utility/ASR metrics, handling defense effectiveness quantification across contexts.

Figure 2: Modular overview of PIArena, highlighting the separation and standardized interaction of benchmark, attack, defense, and evaluator subsystems.

The platform supports uniform dataset structures for systematic cross-task evaluation.

Figure 3: Schematic of PIArena's dataset structure, including injected and target tasks, context, and gold-standard references.

Methodological Innovation: Dynamic Strategy-Based Attacks

A critical limitation observed in prior benchmarks is an exclusive focus on static attacks—either fixed templates or trivial instruction injections—that are not representative of adaptive, real-world threat scenarios. PIArena implements a dynamic strategy-based attack paradigm, where an attacker operates in a black-box manner, iteratively refining the injected prompt based on direct defense feedback.

The dynamic strategy-based attacker combines the following technical advances:

• Strategy Pooling: Leveraging a heterogeneous set of rewriting strategies (e.g., payload splitting, authoritative contemporary metadata, cognitive manipulations) to generate diverse candidate injections, greatly improving attack surface coverage.
• Feedback-Guided Iterative Optimization: Employing an LLM to analyze defense feedback, and recursively mutate the injected prompt to increase stealth, imperativeness, or perform general adversarial refinement.
• Context-Aware Task Synthesis: Automatically generating realistic injected tasks (phishing, content promotion, access denial, infrastructure failure) that are semantically and stylistically compatible with specific target contexts.

This attack paradigm significantly improves query efficiency relative to brute-force mutation or high-overhead reinforcement learning approaches, achieving rapid convergence through high-quality initialization and targeted refinement.

Benchmark Suite and Attack-Defense Integration

PIArena curates a comprehensive suite of benchmarks across diverse domains (SQuAD v2, Dolly, HotpotQA, MS-MARCO, LongBench subsets, etc.), integrating both short-text and long-context tasks. Injected tasks are crafted to guarantee context-awareness, diversity, and binary verifiability for robust LLM-as-a-judge scoring.

Defenses are synthesized from three families:

• Detection-Based: Context classifier models, attention- or feature-based injection detectors (e.g., DataSentinel, PromptGuard, PIShield, Attn.Tracker).
• Prevention-Based: Prompt structuring, model fine-tuning for injection resistance, instruction prioritization (e.g., SecAlign++, PISanitizer).
• Sanitization-Based: Content-level sanitization or localization of adversarial payloads before model inference.

The platform quantifies defense utility (task performance) and ASR (attack success rate), both in clean and contaminated scenarios, discerning trade-offs (e.g., high utility with low ASR is optimal, aggressive detection reduces ASR but often collapses utility).

Key Evaluation Insights

PIArena's systematic, multi-dimensional evaluation yields several strong claims:

• State-of-the-art defenses exhibit poor generalizability across benchmarks. Defenses tuned for specific tasks frequently degrade outside their training distributions, even when exhibiting low ASR on their nominal benchmark. For example, PISanitizer shows a marked increase in ASR (from $4\%$ to $11\%$) when exposed to dynamic direct attacks instead of combined heuristics.
• Dynamic strategy-based attacks dramatically increase ASR. For nearly all tested defenses, PIArena's adaptive attacker achieves order-of-magnitude higher attack success rates when compared to static attacks. For example, non-defended ASR rises from $56\%$ (direct) to $99\%$ (dynamic), and PISanitizer's ASR from $11\%$ to $86\%$.
• Closed-source, defense-aligned LLMs remain starkly vulnerable. Commercial models (e.g., GPT-5, Claude-Sonnet-4.5, Gemini-3-Pro) reach ASRs above $70\%$ under direct prompt injection evaluation, contradicting public claims of robust injection resistance.
• Task-alignment reduces the problem to disinformation, bypassing all tested defenses. When injected tasks are semantically aligned with the original task (e.g., knowledge corruption in QA/RAG), neither instruction-level detection nor payload sanitization are effective, and utility/ASR metrics become fundamentally confounded.

Practical and Theoretical Implications

PIArena's results invalidate the common assumption that prompt injection can be solved via simple input filtering, static pattern blocking, or one-off fine-tuning. Defenses trained and evaluated on static or narrow distributions are subject to collapse under adaptive, diverse attack strategies, necessitating community-wide adoption of broad, systematically integrable benchmarks and adaptive adversarial evaluation.

The finding that commercial, closed-source LLMs—including those explicitly trained for prompt injection resistance—remain highly susceptible to context attacks illustrates a critical gap between defense intention and operational security. Moreover, the failure of all current defenses in the knowledge corruption/disinformation regime highlights an urgent need for moving toward content-level, fact-verification-based, or system-level information flow controls.

From a reproducibility and extensibility standpoint, PIArena’s modular design promotes rapid benchmarking of both new defenses and new attack methodologies, providing a rigorous and composable testbed for subsequent research. The platform's support for integrating external benchmarks (agentic, general) and facilitating plug-and-play evaluation of defense modules underlines its role as an infrastructure enabler for security-minded LLM research.

Future Research Directions

PIArena's systemic evaluation reveals key directions:

• Standardizing comprehensive cross-benchmark evaluation should become a default in defense development, encompassing diverse contexts, task types, injected task categories, and attack mechanisms.
• Shift toward adaptive threat modeling during defense development—static-only baselines are insufficient, as demonstrated by dramatic utility/ASR variance under adaptive red-teaming.
• Fundamental reorientation toward content-level and provenance-based verification rather than instruction-level blocking is required, particularly for task-alignment and knowledge corruption scenarios.
• Integration of fact-checking, provenance, and system-level controls will be necessary to provide guarantees against subtle or semantic prompt injections, especially in agentic and retrieval-augmented contexts.

Conclusion

PIArena introduces a rigorously modular, extensible, and scalable platform for systematic evaluation of prompt injection attacks and defenses. Through unified APIs, standardized benchmarks, and advanced dynamic attack implementations, it exposes the fragility of current defenses and models, underscores pervasive vulnerabilities in both open and closed-source LLMs, and sets a precedent for the future development of robust, adaptive evaluation and mitigation frameworks for LLM security research.

(2604.08499)