Toward Reproducible Local Evaluation of Prompt Injection in Open-Weight LLMs: Design and Threat Model

Abstract

Open-weight language models are increasingly deployed in local and edge environments, yet their robustnessagainst prompt injection and system-prompt leakage remains poorly quantified under reproducible conditions.Existing large-scale benchmarks largely target hosted, API-served models and can be difficult to run end-to-endon consumer hardware, leaving practitioners who deploy or fine-tune models locally with few reproduciblebaselines. We present the design of a fully local, deterministic evaluation pipeline intended to measure thesevulnerabilities across multiple open-weight models without relying on proprietary APIs. The design specifiesfour modular components (model loader, attack generator, harness, and scorer), a taxonomy of four attackcategories—direct injection, multi-turn progressive injection, system-prompt leakage probes, and simulatedindirect injection—a fixed threat model, and a statistically grounded protocol for a 160-instance attack suite(40 instances per category) intended to be run against six representative instruction-tuned open-weight modelsspanning approximately 3–9B parameters. The paper’s contribution is the design, threat model, and taxonomy;implementing the pipeline, running the evaluation, and releasing the resulting code and transcripts are plannedfuture work. We discuss the statistical precision such a suite would provide, the ethical safeguards intended forthe eventual evaluation, and how the design relates to prior benchmarks aimed primarily at hosted models.Keywords: prompt injection, system-prompt leakage, open-weight models, reproducible evaluation, LLM security,red-teaming, threat modeling