ai-research-survey

scan.json (27930B)

---

 {
   "paper": {
     "title": "AegisAgent: An Autonomous Defense Agent Against Prompt Injection Attacks in LLM-HARs",
     "authors": [
       "Yihan Wang",
       "Huanqi Yang",
       "Shantanu Pal",
       "Weitao Xu"
     ],
     "year": 2025,
     "venue": "arXiv preprint",
     "arxiv_id": "2512.20986"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper states in the Ethical Considerations section: 'Upon the publication of this work, we will release our source code.' This is a promise of future release, not an actual release. No repository URL or archive is provided."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation uses three standard public benchmarks: USC-HAD, UCI HAR, and PAMAP2, all of which are publicly available datasets. The paper does not collect new proprietary data."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions experiments were run on 'a workstation equipped with three NVIDIA RTX 3090 GPUs (24GB memory each)' and uses Gemma-2-9B, but does not provide a requirements file, Dockerfile, conda environment, or a detailed listing of library versions needed to reproduce the work."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No README, reproduction scripts, or step-by-step instructions are provided. The paper describes the system design and evaluation methodology but does not include enough operational detail for a researcher to reproduce the experiments without the (unpublished) code."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All reported metrics (DA, SC, ASR, RR, HS) are point estimates only. No confidence intervals, error bars, or standard deviations are reported despite 5 repeated runs being mentioned."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims AegisAgent 'significantly' outperforms baselines and achieves higher accuracy across all conditions, but no statistical significance tests (p-values, t-tests, etc.) are performed. Comparisons are made solely by comparing point estimates."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper consistently reports before/after comparisons with baseline context: ASR drops from 62.2% to 33.4% (Table 1), DA drops from ~85% to 7-8% without the Robust Reasoner (Section 5.3), AegisAgent achieves 93.0% DA vs. 64.9% for the best baseline (Section 5.5). Per the schema example ('12% improvement from 45% to 57%' = YES), these provide sufficient context for the magnitude of effects."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper evaluates 15 attack types across 5 target models and 3 datasets but does not justify the number of test instances used per attack or provide a power analysis. The number of test examples from each dataset used in evaluation is not stated."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'each experiment is repeated five times, with average results reported' but does not report standard deviation, IQR, or any other spread measure across the 5 runs. Only averages are given."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares AegisAgent against three categories of baselines: text-only defenses (SafeDecoding), classical HAR defenses (FGSM/PGD adversarial training), and multimodal detection-only defenses (cross-modal consistency methods). Results are shown in Figure 7."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "SafeDecoding (2024) is a recent and relevant baseline. The other baselines (FGSM, PGD, multimodal detection methods) are standard and appropriate comparisons for different threat models."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 presents an ablation study (RQ2) removing each of the three components (Input Sanitizer, Consistency Verifier, Robust Reasoner) individually across all five target models. Results are shown in Figure 6."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports multiple metrics: Detection Accuracy (DA), Attack Success Rate (ASR), Recovery Rate (RR), Semantic Consistency (SC), and Harm Score (HS), providing several dimensions of evaluation."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is performed. The paper claims AegisAgent preserves 'semantic fidelity' and produces 'secure outputs,' but evaluation is entirely automated using metrics like DA, ASR, SC. Human evaluation of the repaired output quality would be relevant to validate claims about semantic correctness and practical safety."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly clarify train/test splits for the evaluation. While the target models (IMUGPT-2.0, etc.) are evaluated on their respective datasets, it is unclear whether the evaluation examples were distinct from any tuning or configuration choices made during AegisAgent setup."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 breaks down Harm Score by individual attack type and category (Signal, Text, Prompt, Hybrid). Table 1 shows per-model and per-LLM-classifier breakdowns. Figure 6 shows per-model ablation results."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss specific failure cases of AegisAgent. It mentions that 'all stripped-down versions exhibit significant performance degradation' but does not analyze cases where the full system itself fails or types of attacks it cannot handle."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "No negative results are reported. The ablation study (Section 5.3) shows component removal hurts performance, which is expected positive validation, not a negative result. No approaches that were tried and abandoned, no configurations that failed, no unexpected findings are reported. Every experiment confirms AegisAgent's effectiveness."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 85% detection accuracy on average and 30% ASR reduction — both are supported by Table 1 (average DA ~85%) and the evaluation section. The 78.6 ms latency is supported by Table 3."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Ablation studies in Section 5.3 use controlled single-component removal to justify the causal claim that each component contributes to defense performance. The design supports causal claims about which components drive the results."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes broad claims about defending 'LLM-HAR systems' but only tests on five specific systems with Gemma-2-9B as the internal model. The title and framing suggest general applicability but the evaluation is specific to particular architectures and datasets. Claims like 'AegisAgent delivers the most consistent and comprehensive defense' extend beyond the tested setting."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for AegisAgent's performance gains. For example, whether the improvements could be partly explained by the added computational budget (Gemma-2-9B reasoning), or whether some of the performance gains on specific attacks might be due to dataset-specific properties rather than general defense capability."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses ChatGPT-4o, Gemini, LLaMA-2, DeepSeek-V3, and Gemma-2-9B as LLMs but does not specify exact model versions, API snapshot dates, or checkpoint identifiers. 'GPT-4o' and 'Gemini' without version qualifiers are insufficient."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "Appendix B provides prompt templates for the five target LLM-HAR models (how they convert signals to prompts), but these are the TARGET SYSTEM prompts, not AegisAgent's own prompts. The actual prompts used by AegisAgent's Planning Agent, Executor Agent, and Robust Reasoner when invoking Gemma-2-9B are not provided. A reader cannot reconstruct the defense system's LLM queries."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper specifies key hyperparameters: similarity threshold tau_san=0.75, MAD threshold tau_MAD=2.5, graylist coefficient alpha=0.4, semantic mismatch threshold tau_c=0.35, semantic conflict threshold tau_sem=0.6, temporal threshold tau_temp=0.6, executor threshold tau_exec=0.85. These are described in Sections 4.2."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4 provides detailed description of the AegisAgent scaffolding, including the Input Sanitizer, Consistency Verifier, Robust Reasoner, Memory Hub, Planning Agent, and Executor Agent. The workflow is formalized mathematically and Figure 5 provides a system diagram."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not describe how raw IMU data from the three datasets was preprocessed before being fed to the LLM-HAR models. Preprocessing steps (windowing, normalization, feature extraction) are not documented with sufficient detail for reproduction."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations or threats-to-validity section. The conclusion (Section 7) is brief and does not discuss limitations. Ethical considerations mention responsible disclosure but not methodological limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats-to-validity section exists. The paper does not discuss threats specific to this study, such as limited number of attack types, restricted model coverage, or the evaluation only using simulated attacks rather than real-world adversaries."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. Claims about 'robustness against a wide range of adversarial perturbations' are not bounded to the tested setting. No explicit statements about what was NOT tested or claimed."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Only aggregated performance metrics are presented. Raw prediction results, detection outcomes per example, or the specific adversarial prompts tested are not released. The code and evaluation scripts are promised but not yet available."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses standard public datasets (USC-HAD, UCI HAR, PAMAP2) that are well-documented in prior work, and references the original publications for each dataset. Attacks are described formally in Section 3.2 and Appendix A (Table 4)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were recruited for this study. The evaluation is conducted on automated systems using pre-existing public datasets."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline from raw IMU signals through LLM-HAR models to evaluation metrics is described at a high level, but intermediate steps (data preprocessing, attack implementation details, evaluation instance selection) are not documented with sufficient detail to independently verify results."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No acknowledgments section or funding disclosure is present in the paper. There is no mention of grants, institutional funding, or corporate support."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed in the header: City University of Hong Kong and Deakin University. None of the authors appear affiliated with the commercial LLM providers (OpenAI, Google, Meta) whose models are evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funding source is disclosed, making this question inapplicable — there is no identified funder whose independence can be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "There is no competing interests statement in the paper. The absence of such a declaration cannot be taken as confirmation of no conflicts."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates a defense system against prompt injection, not a pre-trained model's benchmark performance. AegisAgent is training-free; contamination of training data is not applicable to the main evaluation claims."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The evaluation does not test knowledge recall from pre-training. The paper tests defense capabilities against attack scenarios, not benchmark accuracy that could be contaminated by training data overlap."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The public HAR datasets used are sensor datasets for activity classification, not language benchmarks that LLMs might have memorized. Contamination of this type is not a concern for this evaluation design."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study. The evaluation is entirely automated using existing LLM-HAR systems and datasets."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. The Ethical Considerations section focuses on responsible disclosure of attack vectors, not human subjects ethics."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were recruited. Demographics are not applicable."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved, so inclusion/exclusion criteria for participants are not applicable."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved and no randomization of experimental conditions over participants was required."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved. The evaluation is entirely automated with ground truth labels from the datasets."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved, so attrition is not applicable."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.6 (RQ5) reports detailed latency measurements: total 78.6 ms per query including per-module breakdowns (Input Sanitization: 6.3 ms, Consistency Verification: 31.1 ms, etc.). Hardware is specified as three NVIDIA RTX 3090 GPUs."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "While per-query latency is reported, the total computational budget for the full evaluation (total GPU hours, API costs for GPT-4o and Gemini calls across 15 attack types × 5 models × 3 datasets × 5 repeated runs) is not stated."
       }
     }
   },
   "claims": [
     {
       "claim": "AegisAgent achieves 85% detection accuracy on average and reduces attack success rate by 30% on average across five LLM-HAR systems.",
       "evidence": "Table 1 shows DA ranging from 78.5% to 93.0% across target model and LLM classifier combinations. The average is reported as 85% DA in Section 5.2. ASR drops from approximately 59-64% (without AegisAgent) to 27-42% (with AegisAgent).",
       "supported": "strong"
     },
     {
       "claim": "AegisAgent significantly outperforms three categories of state-of-the-art defenses (text-only, classical HAR, multimodal detection-only).",
       "evidence": "Figure 7 compares DA, RR, and ASR: AegisAgent achieves 93.0% DA and 56.3% RR vs. the best baseline (multimodal detect) at 64.9% DA and 21.7% RR. No statistical significance tests are performed.",
       "supported": "moderate"
     },
     {
       "claim": "All three defense components (Input Sanitizer, Consistency Verifier, Robust Reasoner) are necessary, with the Robust Reasoner being the most critical.",
       "evidence": "Section 5.3 ablation study shows removing the Input Sanitizer reduces DA to 53-57%, removing the Consistency Verifier to 46-49%, and removing the Robust Reasoner drops DA to 7-8% (Figure 6). No variance reported.",
       "supported": "moderate"
     },
     {
       "claim": "Hybrid attacks pose the most severe threat to LLM-HAR systems, with Harm Scores reaching 3.8-4.1 compared to 2.6-2.8 for text path attacks.",
       "evidence": "Table 2 reports Harm Score averages by attack category: Text Attacks avg 2.70, Signal Attacks avg 3.55, Prompt Attacks avg 3.00, Hybrid Attacks avg 3.97. The scoring rubric (1-5 scale based on safety-critical distance between predicted and true label) is defined in Section 5.1.",
       "supported": "moderate"
     },
     {
       "claim": "AegisAgent incurs only 78.6 ms of latency overhead per query on a GPU workstation.",
       "evidence": "Table 3 provides per-module latency measurements summing to 78.6 ms. Measured on three NVIDIA RTX 3090 GPUs. Only GPU server performance reported; mobile/edge deployment performance is not assessed.",
       "supported": "strong"
     }
   ],
   "methodology_tags": [
     "benchmark-eval",
     "case-study"
   ],
   "key_findings": "AegisAgent is a training-free, model-agnostic autonomous defense agent for LLM-based human activity recognition (HAR) systems that defends against prompt injection attacks via three-stage processing: input sanitization, cross-modal consistency verification, and robust reasoning. Evaluated across 15 attack types on 5 LLM-HAR systems and 3 public datasets, it achieves 85% average detection accuracy and reduces attack success rates by approximately 30 percentage points. An ablation study shows each of the three components contributes to performance, with the Robust Reasoner (using Gemma-2-9B with chain-of-thought and multi-path voting) being the most critical. The system adds only 78.6 ms of latency overhead on a GPU workstation, suggesting practical deployment feasibility in server settings.",
   "red_flags": [
     {
       "flag": "No statistical tests for comparisons",
       "detail": "The paper makes claims of 'significantly' outperforming baselines throughout, but no statistical significance tests are applied. All comparisons are based on point estimates, making it impossible to assess whether differences are meaningful or could be due to random variation."
     },
     {
       "flag": "No variance reporting despite repeated runs",
       "detail": "Section 5.1 states experiments are repeated 5 times with average results reported, but no standard deviation, confidence intervals, or other spread measures are reported for any metric. This conceals result stability and makes it impossible to assess reliability."
     },
     {
       "flag": "Model versions not specified",
       "detail": "The paper uses ChatGPT-4o, Gemini, LLaMA-2, and DeepSeek-V3 as HAR classifiers but provides no specific version identifiers or API snapshot dates. Model behavior changes across versions, making results non-reproducible."
     },
     {
       "flag": "Code not released",
       "detail": "Code is promised 'upon publication' but not currently available. Without code, the 78.6 ms latency claim, the specific threshold values, and the Memory Hub implementation cannot be independently verified."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper has no dedicated limitations or threats-to-validity section. Important limitations — such as evaluation only under simulated white-box attacks, restriction to five specific LLM-HAR architectures, and GPU server context for latency — are not discussed."
     },
     {
       "flag": "Overgeneralized claims",
       "detail": "The paper claims to defend 'LLM-HAR systems' generally but only tests five specific architectures with Gemma-2-9B as the internal agent model. Whether the approach generalizes to other LLM-HAR architectures or different backbone LLMs is untested."
     },
     {
       "flag": "No disclosure of funding",
       "detail": "No funding source or acknowledgments section is present. This omission makes it impossible to assess potential conflicts of interest or institutional support."
     }
   ],
   "cited_papers": [
     {
       "title": "IMUGPT 2.0: Language-based cross modality transfer for sensor-based human activity recognition",
       "authors": [
         "Zikang Leng",
         "Amitrajit Bhattacharjee",
         "Hrudhai Rajasekhar",
         "Lizhe Zhang",
         "Elizabeth Bruda",
         "Hyeokhyen Kwon",
         "Thomas Plötz"
       ],
       "year": 2024,
       "relevance": "Primary target LLM-HAR system evaluated; represents state-of-the-art LLM integration with IMU sensing."
     },
     {
       "title": "MotionGPT: Human motion as a foreign language",
       "authors": [
         "Yuxiao Jiang",
         "Wen Li",
         "Tianyu Liu",
         "Hao Hong",
         "Taku Komura",
         "Ziwei Liu"
       ],
       "year": 2023,
       "arxiv_id": "2306.08993",
       "relevance": "One of five target LLM-HAR systems evaluated; bidirectional text-motion generation model."
     },
     {
       "title": "HAR-GPT: Harnessing LLMs for IMU-based human activity recognition",
       "authors": [
         "Zhiwei Yang",
         "Jie Chen",
         "Rui Zhao",
         "Cheng Xu",
         "Jing Liu"
       ],
       "year": 2024,
       "arxiv_id": "2402.02354",
       "relevance": "Target system demonstrating zero-shot HAR via LLM prompting — evaluated as one of five systems."
     },
     {
       "title": "LLaSA: Large language and activity sensing agents",
       "authors": [
         "Ali Imran",
         "Yichuan Xu",
         "Dohyun Kim",
         "Longqi Chen",
         "Hao Zhang",
         "Yu Gao"
       ],
       "year": 2024,
       "arxiv_id": "2403.04567",
       "relevance": "Target LLM-HAR system with multimodal perception fusion; represents state-of-the-art activity sensing."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": [
         "Andy Zou",
         "Zhen Wang",
         "Nicholas Carlini",
         "Milad Nasr",
         "Zico Kolter",
         "Matt Fredrikson",
         "Nicolas Papernot"
       ],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Key baseline for prompt injection/jailbreak attacks against LLMs; used as baseline defense comparison."
     },
     {
       "title": "More than you've asked for: A comprehensive analysis of jailbreak attacks against large language models",
       "authors": [
         "Kai Greshake",
         "Tobias Wüchner",
         "Thomas Wolf"
       ],
       "year": 2023,
       "arxiv_id": "2309.10253",
       "relevance": "Prior work on prompt injection and jailbreak attacks in text-only LLM settings — motivates need for AegisAgent."
     },
     {
       "title": "Ignore previous prompt: Attack techniques for prompt-based LLMs",
       "authors": [
         "Ethan Perez",
         "Juliana Rando",
         "Douwe Kiela"
       ],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Foundational work on prompt injection attack techniques directly relevant to the threat model studied."
     },
     {
       "title": "SafeDecoding: Defending language models against jailbreak attacks",
       "authors": [
         "Jiapeng Zeng",
         "Yihan Zhang",
         "Bo Li"
       ],
       "year": 2024,
       "relevance": "Primary text-only defense baseline compared against AegisAgent in RQ4 evaluation."
     },
     {
       "title": "Chain-of-thought prompting elicits reasoning in large language models",
       "authors": [
         "Jason Wei",
         "Xuezhi Wang"
       ],
       "year": 2022,
       "relevance": "Key technique used in AegisAgent's Robust Reasoner module for structured multi-step reasoning under adversarial conditions."
     },
     {
       "title": "Self-consistency improves chain of thought reasoning in language models",
       "authors": [
         "Xuezhi Wang",
         "Jason Wei"
       ],
       "year": 2023,
       "relevance": "Multi-path voting mechanism used in AegisAgent's Robust Reasoning module to aggregate predictions."
     },
     {
       "title": "Prompt injection attack against LLM-integrated applications",
       "authors": [
         "Han Guo",
         "Qi Zhang",
         "Yang Ji"
       ],
       "year": 2024,
       "arxiv_id": "2403.02276",
       "relevance": "Recent work on prompt injection attacks in LLM-integrated applications — directly relevant to the attack surface studied."
     },
     {
       "title": "Gemma: Open models based on Gemini research and technology",
       "authors": [
         "Gemma Team",
         "Google DeepMind",
         "Google Research"
       ],
       "year": 2024,
       "arxiv_id": "2403.08295",
       "relevance": "Gemma-2-9B is the backbone LLM used in AegisAgent's Planning and Executor agents."
     }
   ]
 }