RAGProbe
Prompt-injection testing scored by planted canaries instead of a judge model. This page runs RAGProbe's real v0.1.0 scoring code in your browser, so nothing you type is sent anywhere.
Code · Benchmark · Results and corrections · Archive (DOI)
Why a string comparison is enough
An attack asks the model to print two random halves joined together. The attack text only ever contains them apart. So a joined marker in the reply cannot be a quote: the model followed the instruction.
Two rule sets, and why there are two
Full is every rule. Pre-registered drops the three rules written after seeing which benchmark attacks got past the detector. Those rules may be sensible and still flatter the benchmark they came from, so results are reported against both.
English-only rules catch about 1% of the German injections in the benchmark. Nine German patterns take that to 29% with no new false positives, so plenty of German still gets through. A detector catches what someone wrote rules for.