{"id":"https://openalex.org/W7125794500","doi":"https://doi.org/10.48550/arxiv.2601.17911","title":"Prompt Injection Evaluations: Refusal Boundary Instability and Artifact-Dependent Compliance in GPT-4-Series Models","display_name":"Prompt Injection Evaluations: Refusal Boundary Instability and Artifact-Dependent Compliance in GPT-4-Series Models","publication_year":2026,"publication_date":"2026-01-25","ids":{"openalex":"https://openalex.org/W7125794500","doi":"https://doi.org/10.48550/arxiv.2601.17911"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2601.17911","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.17911","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2601.17911","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5124034702","display_name":"Thomas Heverin","orcid":null},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Heverin, Thomas","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5124034702"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6564000248908997,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6564000248908997,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.06030000001192093,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.04569999873638153,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/boundary","display_name":"Boundary (topology)","score":0.48820000886917114},{"id":"https://openalex.org/keywords/instability","display_name":"Instability","score":0.415800005197525},{"id":"https://openalex.org/keywords/perturbation","display_name":"Perturbation (astronomy)","score":0.39989998936653137},{"id":"https://openalex.org/keywords/entropy","display_name":"Entropy (arrow of time)","score":0.36719998717308044},{"id":"https://openalex.org/keywords/compliance","display_name":"Compliance (psychology)","score":0.3589000105857849},{"id":"https://openalex.org/keywords/boundary-value-problem","display_name":"Boundary value problem","score":0.352400004863739}],"concepts":[{"id":"https://openalex.org/C62354387","wikidata":"https://www.wikidata.org/wiki/Q875399","display_name":"Boundary (topology)","level":2,"score":0.48820000886917114},{"id":"https://openalex.org/C207821765","wikidata":"https://www.wikidata.org/wiki/Q405372","display_name":"Instability","level":2,"score":0.415800005197525},{"id":"https://openalex.org/C177918212","wikidata":"https://www.wikidata.org/wiki/Q803623","display_name":"Perturbation (astronomy)","level":2,"score":0.39989998936653137},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.36719998717308044},{"id":"https://openalex.org/C2781460075","wikidata":"https://www.wikidata.org/wiki/Q1399332","display_name":"Compliance (psychology)","level":2,"score":0.3589000105857849},{"id":"https://openalex.org/C182310444","wikidata":"https://www.wikidata.org/wiki/Q1332643","display_name":"Boundary value problem","level":2,"score":0.352400004863739},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.349700003862381},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.3199000060558319},{"id":"https://openalex.org/C66696666","wikidata":"https://www.wikidata.org/wiki/Q17105612","display_name":"Sample entropy","level":3,"score":0.31139999628067017},{"id":"https://openalex.org/C151956035","wikidata":"https://www.wikidata.org/wiki/Q1132755","display_name":"Logistic regression","level":2,"score":0.30709999799728394},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.30140000581741333},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.28859999775886536},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.2856999933719635},{"id":"https://openalex.org/C88626702","wikidata":"https://www.wikidata.org/wiki/Q1128903","display_name":"Continuation","level":2,"score":0.2815999984741211},{"id":"https://openalex.org/C41661131","wikidata":"https://www.wikidata.org/wiki/Q220764","display_name":"Interrupt","level":3,"score":0.2603999972343445},{"id":"https://openalex.org/C146834321","wikidata":"https://www.wikidata.org/wiki/Q2979672","display_name":"Closure (psychology)","level":2,"score":0.25699999928474426}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2601.17911","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.17911","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2601.17911","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.17911","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.8110830783843994}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Prompt":[0],"injection":[1,48],"evaluations":[2,185],"typically":[3],"treat":[4],"refusal":[5,20,98,132,158,167,193],"as":[6,21,66,140],"a":[7,22,81,116,128,196,203,208],"stable,":[8],"binary":[9,205],"indicator":[10],"of":[11,96,106,131],"safety.":[12],"This":[13],"study":[14],"challenges":[15],"that":[16,90,124,183,192],"paradigm":[17],"by":[18],"modeling":[19],"local":[23],"decision":[24],"boundary":[25,199],"and":[26,38,80,102,169,216],"examining":[27],"its":[28],"stability":[29],"under":[30,120],"structured":[31,60],"perturbations.":[32],"We":[33,122,190],"evaluated":[34],"two":[35],"models,":[36],"GPT-4.1":[37],"GPT-4o,":[39],"using":[40],"3,274":[41],"perturbation":[42,135],"runs":[43],"derived":[44],"from":[45],"refusal-inducing":[46,108],"prompt":[47,52],"attempts.":[49],"Each":[50],"base":[51],"was":[53],"subjected":[54],"to":[55,118],"25":[56],"perturbations":[57],"across":[58],"five":[59],"families,":[61],"with":[62,147],"outcomes":[63],"manually":[64],"coded":[65],"Refusal,":[67],"Partial":[68],"Compliance,":[69],"or":[70],"Full":[71],"Compliance.":[72],"Using":[73],"chi-square":[74],"tests,":[75],"logistic":[76],"regression,":[77],"mixed-effects":[78],"modeling,":[79],"novel":[82],"Refusal":[83],"Boundary":[84],"Entropy":[85],"(RBE)":[86],"metric,":[87],"we":[88],"demonstrate":[89],"while":[91],"both":[92,161],"models":[93],"refuse":[94],">94%":[95],"attempts,":[97],"instability":[99],"is":[100,127,195,214],"persistent":[101],"non-uniform.":[103],"Approximately":[104],"one-third":[105],"initial":[107],"prompts":[109],"exhibited":[110,143],"at":[111],"least":[112],"one":[113],"\"refusal":[114],"escape,\"":[115],"transition":[117],"compliance":[119],"perturbation.":[121],"find":[123],"artifact":[125],"type":[126],"stronger":[129],"predictor":[130],"failure":[133],"than":[134,172,202],"style.":[136],"Textual":[137],"artifacts,":[138],"such":[139],"ransomware":[141],"notes,":[142],"significantly":[144],"higher":[145],"instability,":[146],"flip":[148],"rates":[149],"exceeding":[150],"20%.":[151],"Conversely,":[152],"executable":[153],"malware":[154],"artifacts":[155],"showed":[156],"zero":[157],"escapes":[159],"in":[160,210],"models.":[162],"While":[163],"GPT-4o":[164],"demonstrated":[165],"tighter":[166],"enforcement":[168],"lower":[170],"RBE":[171],"GPT-4.1,":[173],"it":[174],"did":[175],"not":[176],"eliminate":[177],"artifact-dependent":[178,198],"risks.":[179],"These":[180],"findings":[181],"suggest":[182],"single-prompt":[184],"systematically":[186],"overestimate":[187],"safety":[188,213],"robustness.":[189],"conclude":[191],"behavior":[194],"probabilistic,":[197],"phenomenon":[200],"rather":[201],"stable":[204],"property,":[206],"requiring":[207],"shift":[209],"how":[211],"LLM":[212],"measured":[215],"audited.":[217]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-01-28T00:00:00"}