4/ How the bench works — no LLM judge. 22 attack cases. A deterministic judge (regex + canary token) scores each run: VULNERABLE / BLOCKED / REVIEW. Canary token injected into context — if the model…