The paper reports that detection-based defenses exhibit an extreme false-positive/false-negative trade-off on long-context inputs, with some methods flagging benign inputs and others missing attacks.

Source: paper:pp. 9-10, Sections 5.1 and 5.4, Table 3; Appendix F