# Gray Swan IPI (15 attempts) leaderboard

Instruction Following benchmark

> Every figure below is reproduced as its upstream source published it: nothing is modelled, estimated, interpolated or converted. `Unavailable` means no source published the value — it is never a zero. Each value carries its evidence state and the date it was observed.

Page: https://modelscale.dev/leaderboards/benchmarks/instruction-following-gray-swan-ipi15

Gray Swan Indirect Prompt Injection, attack success at 15 attempts. Every model the catalog carries a published Gray Swan IPI (15 attempts) value for, ranked by that value.

## Benchmark record

| Field | Value |
| --- | --- |
| Category | Instruction Following |
| Measure | Attack success rate at 15 attempts |
| Tasks | Indirect prompt-injection attacks |
| Difficulty | Adversarial prompt injection |
| Published by | [Gemini 4 Argon evaluation methodology](https://deepmind.google/models/evals-methodology/gemini-4-argon) |

Measures how often indirect prompt-injection attacks succeed within fifteen attempts. Lower scores mean greater resistance to the tested attacks.

## Gray Swan IPI (15 attempts) ranking

13 models with a published Gray Swan IPI (15 attempts) value, ordered by that value, highest first. Models the source has not scored on this benchmark are not listed — they are unmeasured, not last.

| Rank | Model | Provider | Attack success rate at 15 attempts | Evidence |
| --- | --- | --- | --- | --- |
| 1 | [Kimi K3](https://modelscale.dev/models/kimi-3) | Moonshot AI | 52.7 | Observed 2026-10-23 · source benchlm:models |
| 2 | [Grok 4.6](https://modelscale.dev/models/grok-4-6) | xAI | 51.8 | Observed 2026-10-23 · source benchlm:models |
| 3 | [GLM-5.3](https://modelscale.dev/models/glm-5-3) | Z.AI | 31.5 | Observed 2026-10-23 · source benchlm:models |
| 4 | [GPT-5.6 Sol](https://modelscale.dev/models/gpt-5-6-sol) | OpenAI | 27.0 | Observed 2026-10-23 · source benchlm:models |
| 5 | [Muse Spark 1.3](https://modelscale.dev/models/muse-spark-1-3) | Meta | 15.9 | Observed 2026-10-23 · source benchlm:models |
| 6 | [GPT-6 Sol](https://modelscale.dev/models/gpt-6-sol) | OpenAI | 10.1 | Observed 2026-10-23 · source benchlm:models |
| 7 | [GPT-6 Astra](https://modelscale.dev/models/gpt-6-astra) | OpenAI | 8.5 | Observed 2026-10-23 · source benchlm:models |
| 8 | [Gemini 3.8 Flash Cyber](https://modelscale.dev/models/gemini-3-8-flash-cyber) | Google | 6.0 | Observed 2026-10-23 · source benchlm:models |
| 9 | [Gemini 3.8 Flash](https://modelscale.dev/models/gemini-3-8-flash) | Google | 5.5 | Observed 2026-10-23 · source benchlm:models |
| 10 | [Claude Opus 5](https://modelscale.dev/models/claude-opus-5) | Anthropic | 4.6 | Observed 2026-10-23 · source benchlm:models |
| 11 | [Claude Fable 5.1](https://modelscale.dev/models/claude-fable-5-1) | Anthropic | 1.0 | Observed 2026-10-23 · source benchlm:models |
| 11 | [Claude Opus 5.5](https://modelscale.dev/models/claude-opus-5-5) | Anthropic | 1.0 | Observed 2026-10-23 · source benchlm:models |
| 13 | [Gemini 4 Argon](https://modelscale.dev/models/gemini-4-argon) | Google | 0.7 | Observed 2026-10-23 · source benchlm:models |

Rows are ordered by the value the source published, highest first. The source does not state whether a higher value is the better result, so this document does not either: for a benchmark that measures a rate of failure, read the table from the bottom.