Prompt injection can cause large language models (LLMs) to deviate from their intended tasks by following instructions embedded in untrusted input. We investigate whether changing a classifier's output labels improves accuracy under such attacks, using sentiment classification as a case study. Label Disguise Defense (LDD) replaces positive/negative with alternatives such as good/bad or cat/dog, introduced through demonstrations, and maps predictions back to sentiment classes. We analyze retained aggregate results for 200 IMDb reviews, nine recorded model configurations, and eight alternative label pairs under a fixed attack that always requests the incorrect class using the original labels. Averaged over four pairs per group, sentiment-associated labels outperform the other tested labels in all nine configurations, but exceed a baseline using the original labels and the same demonstration and attack conditions in only three. At least one alternative pair improves on this baseline in seven configurations, with the best pairs identified retrospectively. These results show that a consistent advantage between label groups does not imply consistent improvement over standard labels. Missing matched evaluations on unattacked reviews prevent separating changes in ordinary classification performance from changes in the effect of the attack.

翻译：暂无翻译