Triaging security alerts by evidence, not by instructions an attacker planted.

Two simulated models answer every variant several times. Accuracy hides the flaw; shifts where nothing should change expose it.

• model-a always gives the correct answer.
• model-b closes malicious alerts more often the more direct the injection: 10%, 40%, 70%, and 90%.