Task instructions as the hardest benign subset
The task instruction subset stands out, since some guards flag most of those rows. Benign imperative instructions seem to look like attacks to a classifier. Did you consider splitting that subset by instruction type, for example data masking versus summarization, to see which phrasing drives the flags?
Thanks, good question. There is no summarization subset: all 1,000 task instructions come from cagrigungor/turkish-pii-masking-benchmark, so every row is a masking instruction followed by the text to mask. To test the idea anyway, I kept the texts fixed and scored them in other forms with the same three guards (threshold 0.5, max_length 512): the instruction alone, the text alone, and the same text behind three neutral instructions I wrote for this ("summarize in one sentence", "translate into English", "fix the spelling").
| Form (1,000 rows) | proventra | wolf-defender | protectai v2 |
|---|---|---|---|
| Masking instruction + text (the set) | 0.772 | 0.607 | 0.315 |
| Masking instruction alone | 0.700 | 0.602 | 0.577 |
| Text alone | 0.026 | 0.123 | 0.309 |
| Summarize + the same text | 0.032 | 0.216 | 0.477 |
| Translate + the same text | 0.030 | 0.230 | 0.352 |
| Fix spelling + the same text | 0.044 | 0.165 | 0.511 |
So being an imperative is not enough. For proventra and wolf-defender it is the masking instruction itself: with "summarize" in front of the same text, proventra goes from 77.2% to 3.2%. protectai v2 is different. It already flags 30.9% of the bare texts, and the neutral instructions push it higher than masking does. Its card says it does not handle non-English prompts, so I read its numbers as a reaction to Turkish text in general.
Within masking, the policy type and the wording both matter:
- "Mask everything except X" (150 rows) is flagged more often than "mask only X" (200 rows) by all three guards: 0.913 vs 0.500, 0.780 vs 0.530, 0.400 vs 0.315.
- The eight most common instructions (458 rows) all mean "mask all personal data", yet wolf-defender flags between 33% and 100% of each one's rows and protectai between 0% and 77%. "KVKK gereği bütün kişisel ve hassas alanları gizle; …" ("hide all personal and sensitive fields as KVKK requires") is flagged on every row by proventra and wolf-defender and on none by protectai.
- Instructions with "dışında", "hariç" or "istisna" (except) are flagged 0.892 / 0.808 / 0.454; those with "sadece" or "yalnız" (only) 0.419 / 0.500 / 0.248. My guess is that "hide" and "nothing except X" sit close to attack phrasing for these models, but I have not tested that directly. The templates are not balanced across these patterns, so the per-template numbers are the cleaner comparison.
I added this as a section to the dataset card and put breakdown.py in the repo, so the same split runs on any model with one command. If there is a guard you would like in the table, tell me which one.
Thanks, this goes further than I expected. The summarize row settles it for proventra and wolf-defender: the same text drops from 77.2% to 3.2% on proventra, so the trigger is the masking instruction, not the imperative form. The except versus only split is what I would look at next, since "mask everything except X" is a common policy in real pipelines and it is the one flagged most.
Good call putting breakdown.py in the repo. If you want one more guard in the table, Horizon-Labs/prompt-injection-guard-base would be a good fit: its card mentions results on a third-party Turkish benchmark, and the authors seem open to per-language checks.
