We present empirical evaluation of ÞÝÐING, a proposed defense against prompt injection attacks using randomized multi-hop machine translation. In controlled experiments with n=200 attacks across two OpenAI gpt-oss models (120b and 20b), we find that the defense provides no statistically significant protection against general prompt injection (McNemar p ≈ 0.40–1.00). We identify a critical failure mode: translation acts as a deobfuscator, converting encoded attacks (Base64, hex, leetspeak) into clean natural language that models follow more readily. Both models converge to approximately 20% defended Attack Success Rate, suggesting a floor of language-invariant attacks whose malicious semantics survive any translation chain. However, indirect injection attacks showed 100% reduction on the larger model. This paper serves as an empirical follow-up to our theoretical work (DOI: 10.5281/zenodo.18438221).
Helgason et al. (Sat,) studied this question.