Update README.md

README.md

@@ -105,14 +105,18 @@ print("BLOCKED" if unsafe_prob >= 0.85 else "PASSED")
 
 ## Evaluation
 
-Out-of-distribution evaluation on JailbreakHub Dec 2023 (n=1000):
+Attacks: `benign request + conjunction + hidden injection` (real deepset/Gandalf payloads). 
+
+Split pipeline vs. same classifier at matched recall (0.94).
 
 | Mode | Precision | Recall | F1 |
 |:-----|----------:|-------:|---:|
-| Classifier (default) | 0.94 | 0.46 | 0.62 |
-| Pipeline (with split) | 0.79 | 0.71 | 0.75 |
+| Classifier @ matched recall | 0.85 | 0.94 | — |
+| **Pipeline (split)** | **0.98** | 0.94 | **0.96** |
+
+Splitting wins: +0.14 precision at matched recall (PR-AUC 0.97), rescuing +84 of 300 attacks with 0 added false positives.
 
-The classifier mode favors precision to avoid blocking legitimate requests. The pipeline mode trades precision for higher recall via fragment analysis.
+*Caveats:* near-best-case (split on SPID's own conjunctions); payloads overlap training data; small benign control (n=150).
 
 ## Training Details
 
@@ -139,7 +143,8 @@ The classifier mode favors precision to avoid blocking legitimate requests. The
 - Vulnerable to paraphrased attacks ("show me" vs "reveal") and obfuscation (base64, leetspeak)
 - Not designed for multi-turn or advanced jailbreak techniques
 - Intended as a cost-saving pre-filter, not a standalone security layer
-
+- Splitting helps only for conjunction-separated composite injections, measured under near-best-case, partly in-distribution conditions.
+  
 ## Citation
 
 ```bibtex