The defense lattice
A defense lattice crosses defense classes with attack mutations to show whether a control depends on wording. The numerical examples on this page are a versioned historical research snapshot, not measurements of the current engine or a tenant.
A guardrail that only blocks the literal probe is a guardrail waiting to be paraphrased. The defense lattice crosses defense classes with attack mutations to show where protection depends on wording.
The lattice is a research instrument: the numerical examples published with it are a versioned snapshot used in methodology work, not a measurement of your tenant or of the current engine.
Key points
- Historical snapshot 57f15b67 crossed four synthetic defense targets with 17 locked originals and 85 Gemini-generated variants across five OWASP LLM categories.
- In that historical snapshot, keyword-level refusal defenses fell under paraphrasing; structural controls were evaluated separately.
- Current product scope is 32 probes across all ten categories (17 locked-base + 15 expansion; commit 8752ede); wording robustness for the current candidate remains N/A unless a paired evaluation is run.
- The archived record includes a small LLM07 literal/variant slice; no rate from that slice is carried forward as a tenant or current-engine result.
Lattice axes
- Defense class (rows): keyword / control-level / structural.
- Attack mutation (cols): L1 originals / L1 paraphrases.
- Cell value: block-rate (% of probes refused).
- Brittleness: paraphrases − originals (negative = brittle).
Two axes organize the grid: defense classes (the control that answered) and attack mutations (literal probes versus paraphrase families). The cell value is the observed block rate; brittleness is the paired difference between paraphrased and literal cells.
Reading the lattice
- A flat row across both columns = robust defense.
- A sharp drop right-to-left = brittle, keyword-dependent.
- Tenant results stand on their own persisted evidence and are not comparable to snapshot 57f15b67 unless the same corpus, targets, configuration, and environment are deliberately rerun.
Read cells as questions, not verdicts: a brittle cell indicates the control matched surface wording rather than intent. Tenant results come from the tenant's own persisted evidence and are never blended with the published research grid.
Related resources