We do not publish a percentage of attacks blocked.
Published evasion rates against commercial detectors swing wildly with the technique used. A number that moves that much is not a number, and we will not print one to make a point.
Two things are worth publishing instead. Deterministic coverage of named Unicode classes: every code point in a listed range is found, every time. And recall at a stated false-positive rate on a named corpus, with the corpus and the harness in the open.
If a class is not on the list, we do not detect it. The list is the claim.
Today the list is short and the whole of it is above: tag block, bidi overrides, variation selectors, decoded in your browser. The benchmark is open: github.com/PromptDecode/bench, corpus promptdecode-bench, 212 cases, 80 attack and 132 benign. Its reference detector finds 80 of 80 attack cases and flags none of the 132 benign cases at every operating point. The repository's own results.json is plain about what that does and does not show: "This detector separates this corpus completely. That is a fact about a corpus and a detector written in the same repository, not evidence that the detector generalises. Until the corpus contains cases this detector fails, the recall figure measures the difficulty of the corpus, not the reach of the detector."