Reseach Article
Evaluating LLM-Based Prompt Safety Filters: A Comparative Study of Llama-3.1-8B-Instant and Llama-4-Scout-17B-16E-Instruct Classification Performance on Adversarial Prompts
| Journal of Advanced Artificial Intelligence |
| Foundation of Computer Science (FCS), NY, USA |
| Volume 2 - Number 7 |
| Year of Publication: 2026 |
| Authors: Akanksha Raghvesh, Kiran Paul Kanikaram |
Akanksha Raghvesh, Kiran Paul Kanikaram . Evaluating LLM-Based Prompt Safety Filters: A Comparative Study of Llama-3.1-8B-Instant and Llama-4-Scout-17B-16E-Instruct Classification Performance on Adversarial Prompts. Journal of Advanced Artificial Intelligence. 2, 7 ( Oct 2026), 81-86. DOI=None
Abstract
Large language models are increasingly deployed as automated safety filters, screening user prompts before they reach a downstream assistant model. This study evaluates the classification behavior of two open-weight models: Llama-3.1-8B-Instant and Llama-4-Scout-17B-16E-Instruct when used as zero-shot “safe/unsafe” classifiers for adversarial prompts. Rather than testing whether adversarial prompts succeed in eliciting harmful output from a downstream assistant, this work isolates the classifiers’ own decision behavior: how often each model labels a known-adversarial prompt as safe. Using a curated set of 25 adversarial prompts spanning five threat categories (cyber-attacks, fraud and deception, harassment and hate, economic harm, and misinformation), it was found that Llama-3.1-8B-Instant flagged all 25 prompts as unsafe, while Llama-4-Scout-17B-16E-Instruct classified 7 of 25 (28%) as safe with misinformation prompts showing the highest within-category miss rate (60%, 3 of 5). Given the differences in architecture, training data, and generation strategy between the two models, caution is advised against interpreting these results as evidence that model scale predicts filter reliability. 95% confidence intervals are reported given the small sample size, and directions for further work are outlined, including testing on benign prompts to assess false-positive rates, larger resampled prompt sets, and generation-level (rather than prompt-level) classification using the downstream model’s actual output.
References
- L. Ouyang, J. Wu, X. Jiang, et al., “Training language models to follow instructions with human feedback,” Advances in Neural Information Processing Systems, vol. 35, pp. 27730–27744, 2022.
- R. Rafailov, A. Sharma, E. Mitchell, C. D. Manning, S. Ermon, and C. Finn, “Direct Preference Optimization: Your Language Model is Secretly a Reward Model,” Advances in Neural Information Processing Systems, vol. 36, pp. 53728–53741, 2023.
- A. Grattafiori, A. Dubey, A. Jauhri, et al., “The Llama 3 Herd of Models,” arXiv preprint arXiv:2407.21783, 2024
- Meta AI, “The Llama 4 herd: The beginning of a new era of natively multimodal AI innovation,” Meta AI Blog, Apr. 2025. https://ai.meta.com/blog/llama-4-multimodal-intelligence/
- A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and Transferable Adversarial Attacks on Aligned Language Models,” arXiv preprint arXiv:2307.15043, 2023.
- M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Li, D. Forsyth, and D. Hendrycks, “HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal,” Proceedings of the 41st International Conference on Machine Learning, PMLR vol. 235, pp. 35181–35224, 2024.
- P. Chao, E. Debenedetti, A. Robey, M. Andriushchenko, F. Croce, V. Sehwag, E. Dobriban, N. Flammarion, G. J. Pappas, F. Tramèr, H. Hassani, and E. Wong, “JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models,” Advances in Neural Information Processing Systems, vol. 37, Datasets and Benchmarks Track, 2024.
- A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How Does LLM Safety Training Fail?,” Advances in Neural Information Processing Systems, vol. 36, pp. 80079–80110, 2023.
- H. Inan, K. Upasani, J. Chi, R. Rungta, K. Iyer, Y. Mao, M. Tontchev, Q. Hu, B. Fuller, D. Testuggine, and M. Khabsa, “Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations,” arXiv preprint arXiv:2312.06674, 2023.
Index Terms
Keywords