“It went from something like less than 3 percent to nearly a 100 percent attack success rate.”
Meta shipped Prompt-Guard-86M with Llama 3.1 to catch prompt injection and jailbreaks. Aman Priyanshu of Robust Intelligence put spaces between the letters and stripped the punctuation. Fine-tuning barely touched single English characters, so the classifier went blind. A safety filter beaten by the widest key on the keyboard is a speed bump with a model card.