ai-research-survey

scan.json (27023B)

---

 {
   "paper": {
     "title": "AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents",
     "authors": [
       "Yanjie Li",
       "Yiming Cao",
       "Dong Wang",
       "Bin Xiao"
     ],
     "year": 2025,
     "venue": "arXiv preprint (submitted IEEE, manuscript received Oct 1, 2025)",
     "arxiv_id": "2510.04257"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No GitHub repository or archive URL is provided in the paper. The paper describes code artifacts (the ATPI algorithm, optuna-based TPE, RAG module) but provides no link or archive for reproduction."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses the publicly available VWA-Adv benchmark and VisualWebArena benchmark, which are referenced with links to their public repositories. The authors did not collect new proprietary data beyond these public benchmarks."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'eight NVIDIA RTX 3090 GPUs' and the 'optuna' library for TPE, but provides no requirements file, Dockerfile, or comprehensive list of library versions sufficient to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No README, script, or step-by-step instructions are provided. The paper describes the algorithm abstractly (Algorithm 1) but does not provide executable reproduction instructions."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables III and IV are reported as point estimates (e.g., '0.45', '0.68') with no confidence intervals, error bars, or uncertainty measures. Multiple trials per task are mentioned but only aggregate ASR is reported."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes comparative claims (e.g., 'AgentTypo significantly outperforms') but applies no statistical tests — no p-values, bootstrapped confidence intervals, or any other significance measure."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "Only raw ASR differences are reported (e.g., 23% to 45%). No standardized effect sizes (Cohen's d, etc.) or relative improvement normalized to a meaningful baseline are provided."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The VWA-Adv benchmark comprises 77 tasks. No justification is given for whether 77 tasks provide adequate statistical power to support the comparative claims made. No power analysis is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'each prompt is executed with three independent trials' but only aggregate ASR is reported. No standard deviation, variance, or spread across the three trials is provided for any result."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Four baselines are included: Raw Prompt Injection, InjecAgent, AdvAgent, and AgentAttack. These cover both text-based and image-based prior attack methods."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include AgentAttack (ICLR 2025), AdvAgent (ICML 2025), and InjecAgent (ACL 2024), which are contemporary to the 2025 submission. The baselines represent the current state of the art in multimodal agent attacks."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section VI.E presents an ablation across four configurations: ATPI alone, Strategy Library alone, Strategy+RAG, and the full AgentTypo-pro (ATPI+Strategy+RAG), clearly isolating the contribution of each component."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "Only Attack Success Rate (ASR) is reported as the evaluation metric. No secondary metrics such as query cost, number of iterations to success, stealthiness scores, or defense evasion rates are reported alongside ASR in the main results tables."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'manual human review' to validate the LLM-based scorer's accuracy, but does not conduct human evaluation of actual attack outputs or agent behavior. The primary evaluation pipeline is automated (LLM-based scorer)."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "Section VI.G tunes hyperparameters (lambda, step budget, number of retrieved examples) by measuring ASR on the same 77 VWA-Adv tasks (Figures 6, 7, 8). No separate dev/test split is mentioned. The reported numbers are on data used for hyperparameter selection decisions."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table III provides per-domain breakdowns (Classifieds, Shopping, Reddit) and per-model breakdowns (GPT-4V, GPT-4o, GPT-4o-mini, Gemini-1.5-Pro, Claude-3-Opus) for both image+text and image-only settings."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The limitations section (Section VIII) discusses the trade-off between stealth and effectiveness: 'achieving high attack success rates currently requires the embedded text to be relatively conspicuous.' Section VI.D also discusses why AgentAttack fails on complex tasks (0% ASR on email)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The ablation (Table IV) shows that using Strategy Library alone without ATPI yields lower ASR than the full system, and Section VI.G shows ASR degrades when using too many retrieved examples (beyond 5), reporting negative effects of component choices."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'raises the success rate from 23% to 45%' on GPT-4o image-only attacks, and 'achieves 68% ASR in image+text settings.' Table III confirms these numbers for GPT-4o. The abstract's main quantitative claims are backed by Table III results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes causal claims such as 'Incorporating the Strategy Library shows a substantial improvement in ASR' and attributes performance gains to specific components via ablation. The ablation controls for single variables, which is methodologically appropriate for causal attribution, but the absence of statistical tests means the claimed causal effect sizes cannot be distinguished from noise over 77 tasks."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The abstract and conclusion claim AgentTypo 'poses a practical and potent threat to multimodal agents' broadly, but experiments are only on three simulated websites (Classifieds, Shopping, Reddit) using VWA-Adv. The paper does not bound claims to this specific setting — Section VIII acknowledges limited benchmark diversity only briefly."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not consider alternative explanations for its results. For example, it does not discuss whether the observed improvement over AgentAttack is partly due to AgentAttack's known CLIP surrogate mismatch (which it states as fact rather than discussing as a confound), or whether the improvements might be task-specific. The limitations section addresses stealth vs. effectiveness but not alternative explanations for the observed gains."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are cited as 'GPT-4V', 'GPT-4o', 'GPT-4o-mini', 'Gemini-1.5-Pro', and 'Claude-3-Opus' without snapshot dates or API version strings. Per the schema, marketing names without version identifiers do not count. The attacker/scorer/summarizer LLMs are described only as 'GPT-4' without version."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "Prompts for the Attacker LLM, Scorer LLM, and Summarizer LLM are described only in natural language (e.g., 'the Attacker LLM formulates a hijacking prompt according to a specified adversarial goal'). Table V shows example injection prompts but not the system prompts used for the LLM components. No full prompt text is provided."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section VI.C reports key hyperparameters: stealthiness weight lambda=10.0, maximum 20 optimization steps, top-k=5 retrieval examples, success threshold=0.8. Table I lists the ATPI parameter ranges (font size, color, position, etc.)."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "AgentTypo-pro's multi-LLM scaffolding is described in detail in Section V: Attacker LLM, Scorer LLM, Summarizer LLM, and RAG module are each described with their roles, inputs, outputs, and interaction logic (Equations 7-10, Figure 4)."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section VI.A describes the data setup: VWA-Adv's 77 tasks across three sites, and Section III.A describes how webpages are preprocessed (JavaScript annotation of interactable elements, SoM parsing, captioning). The data pipeline from webpage to agent input is documented."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section VIII 'Limitations' is a dedicated section discussing two limitations: the stealth-effectiveness trade-off and the restricted benchmark scope (three websites)."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The limitations mentioned ('achieving high attack success rates currently requires the embedded text to be relatively conspicuous' and 'limited availability of benchmarks') are partially specific but do not address core validity threats such as the small benchmark size (77 tasks), potential cherry-picking of the threshold (0.8), or the reliability of the LLM-based scorer itself."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what results do NOT show. Section VIII mentions the benchmark is limited to three websites, but does not make explicit statements like 'these results do not imply effectiveness against text-only agents' or enumerate claims they are not making."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Raw experimental results (the individual task outcomes, LLM scorer responses, agent action logs) are not released. Only aggregate ASR tables are published. Independent verification of the reported numbers is not possible."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "The VWA-Adv benchmark is a well-described public dataset. The paper uses this existing benchmark without collecting new data. The benchmark's composition (77 tasks, three domains) is described in Section VI.A."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. The study uses automated benchmark evaluation with LLM-based agents; no participant recruitment is needed."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from benchmark task to attack execution to scoring is documented: task selection from VWA-Adv -> image modification via ATPI -> agent execution (3 trials per task) -> LLM-based scoring -> ASR calculation. The flow is clear in Sections VI.A-C."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "There is no acknowledgments section and no mention of funding sources anywhere in the paper. The absence of any funding disclosure is a concern."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All authors are affiliated with the Computing Department, Hong Kong Polytechnic University. Affiliations are listed in the author footnote. No author is affiliated with any of the evaluated commercial model providers."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed. The paper does not state it is unfunded, so we cannot confirm the 'NA if unfunded' exception applies. Absence of funding disclosure means independence cannot be verified."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "There is no competing interests statement anywhere in the paper. Absence of disclosure is not the same as absence of conflict."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses GPT-4V, GPT-4o, GPT-4o-mini, Gemini-1.5-Pro, and Claude-3-Opus as target agents but states no training cutoff dates for any of these models. This matters for assessing whether models could have seen VWA-Adv tasks."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether any VWA-Adv benchmark tasks or VisualWebArena underlying data could have been in the training data of the evaluated LVLMs. This is particularly relevant since VisualWebArena was published in 2024."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The VWA-Adv benchmark is based on VisualWebArena (2024). Several evaluated models (GPT-4o, Gemini-1.5-Pro, Claude-3-Opus) have training cutoffs that may include this benchmark. Contamination is not discussed."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. This is a purely automated benchmark evaluation study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. IRB approval is not applicable."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. Demographics are not applicable."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. Inclusion/exclusion criteria are not applicable."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. Randomization of participant assignment is not applicable."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. Blinding is not applicable."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. Attrition is not applicable."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper calls GPT-4o, GPT-4V, and other commercial APIs extensively (3 trials per task × 77 tasks × multiple attack iterations up to 20 steps) but provides no cost estimates, token counts, or API expenditure figures."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Only 'eight NVIDIA RTX 3090 GPUs' is mentioned for ATPI optimization. Total wall-clock time, GPU hours, or API budget for the full experimental suite are not reported."
       }
     }
   },
   "claims": [
     {
       "claim": "AgentTypo-pro raises the image-only attack success rate against GPT-4o agents from 23% (AgentAttack) to 45%.",
       "evidence": "Table III, Section VI.D: GPT-4o image-only column shows AgentAttack ASR=0.23 average vs. AgentTypo-pro ASR=0.45 average across Classifieds/Shopping/Reddit.",
       "supported": "strong"
     },
     {
       "claim": "In image+text settings, AgentTypo-pro achieves 68% ASR on GPT-4o agents, outperforming all baselines.",
       "evidence": "Table III, GPT-4o image+text column: AgentTypo-pro=0.68 vs. AdvAgent=0.60, InjecAgent=0.35, AgentAttack=0.26, RawInject=0.05.",
       "supported": "strong"
     },
     {
       "claim": "ATPI alone (without prompt content optimization) already outperforms AgentAttack on image-only attacks.",
       "evidence": "Table IV ablation: AgentTypo-base (ATPI) achieves 0.45 vs. AgentAttack 0.24 on GPT-4V in image+text setting. However, this is shown in the high-permission setting, not a direct image-only comparison.",
       "supported": "moderate"
     },
     {
       "claim": "The proposed defense (captioning-based detection) reduces GPT-4o ASR from 0.68 to 0.21.",
       "evidence": "Section VII states this result, but no detailed experimental setup (which images, what captioner threshold) is provided for the defense evaluation.",
       "supported": "weak"
     },
     {
       "claim": "AgentTypo achieves 65% ASR on 'wrong email' tasks where AgentAttack achieves 0%.",
       "evidence": "Section VI.D mentions these figures in the text but does not break out per-task results in a table; only per-domain aggregates are tabulated.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": [
     "benchmark-eval",
     "case-study"
   ],
   "key_findings": "AgentTypo introduces typographic prompt injection attacks against multimodal LVLM agents, embedding adversarial text into webpage images via Bayesian optimization to maximize attack success while maintaining visual stealth. The full AgentTypo-pro system (combining ATPI, strategy learning, and RAG) achieves 45-75% attack success rates across five commercial models (GPT-4V, GPT-4o, GPT-4o-mini, Gemini-1.5-Pro, Claude-3-Opus) in image+text settings, substantially outperforming prior baselines including AgentAttack. The image-only variant is particularly novel, demonstrating that LVLM agents can be compromised through visual channels alone, with 31-45% ASR across models. A proposed captioning-based defense reduces ASR on GPT-4o from 68% to 21% but at significant computational cost.",
   "red_flags": [
     {
       "flag": "No statistical tests for comparative claims",
       "detail": "The paper claims AgentTypo 'significantly outperforms' baselines across all models based on comparing point estimates over only 77 tasks, with no significance tests, confidence intervals, or effect-size quantification. With 77 tasks and no uncertainty quantification, differences on the order of 5-10 percentage points may not be reliable."
     },
     {
       "flag": "LLM-based scorer reliability",
       "detail": "The primary evaluation metric (ASR) is computed by an LLM-based scorer, which is itself a proprietary model (GPT-4) with no version specified. The scorer's 'threshold of 0.8' is described as 'empirically determined.' Human validation is mentioned but only as a spot-check, not a systematic audit with inter-rater reliability."
     },
     {
       "flag": "Unspecified model versions",
       "detail": "All evaluated models (GPT-4V, GPT-4o, GPT-4o-mini, Gemini-1.5-Pro, Claude-3-Opus) and the attacker/scorer LLMs are identified by marketing names without API snapshot dates, making results unreproducible as model versions change."
     },
     {
       "flag": "No funding or competing interests disclosure",
       "detail": "The paper contains no acknowledgments section, no funding disclosure, and no competing interests statement. This omission is notable for a paper published through standard IEEE channels."
     },
     {
       "flag": "Overgeneralized threat claim",
       "detail": "The paper concludes that AgentTypo 'poses a practical and potent threat to multimodal agents' based on three simulated websites in a controlled benchmark setting. Real-world web agents face different webpage structures, security controls, and human oversight that are not captured in VWA-Adv."
     },
     {
       "flag": "Defense evaluation underspecified",
       "detail": "The captioning-based defense result (ASR reduction from 68% to 21%) is reported in Section VII with minimal experimental detail — which captioner version (Qwen2.5 — what version?), what detection threshold, which subset of tasks, and whether the attacker adapts to the defense are not stated."
     }
   ],
   "cited_papers": [
     {
       "title": "Dissecting adversarial robustness of multimodal LM agents",
       "authors": [
         "C. H. Wu",
         "R. R. Shah",
         "J. Y. Koh",
         "R. Salakhutdinov",
         "D. Fried",
         "A. Raghunathan"
       ],
       "year": 2025,
       "relevance": "Introduces VWA-Adv benchmark and AgentAttack (image-based adversarial attack against multimodal agents), which is the primary baseline and evaluation dataset used in AgentTypo."
     },
     {
       "title": "AdvAgent: Controllable blackbox red-teaming on web agents",
       "authors": [
         "C. Xu",
         "M. Kang",
         "J. Zhang",
         "Z. Liao",
         "L. Mo",
         "M. Yuan",
         "H. Sun",
         "B. Li"
       ],
       "year": 2025,
       "relevance": "Proposes AdvAgent, a fine-tuning-based text prompt injection attack on web agents; used as a key baseline for comparison with AgentTypo."
     },
     {
       "title": "AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents",
       "authors": [
         "E. Debenedetti",
         "J. Zhang",
         "M. Balunovic",
         "L. Beurer-Kellner",
         "M. Fischer",
         "F. Tramer"
       ],
       "year": 2024,
       "relevance": "Provides a benchmark environment for evaluating prompt injection attacks against LLM agents, directly relevant to the survey's focus on agentic AI security evaluation."
     },
     {
       "title": "VisualWebArena: Evaluating multimodal agents on realistic visual web tasks",
       "authors": [
         "J. Y. Koh",
         "R. Lo",
         "L. Jang",
         "V. Duvvur",
         "M. C. Lim",
         "P.-Y. Huang",
         "G. Neubig",
         "S. Zhou",
         "R. Salakhutdinov",
         "D. Fried"
       ],
       "year": 2024,
       "relevance": "The base benchmark on which VWA-Adv is built; directly evaluates multimodal agent performance on realistic web tasks, core to the survey scope."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": [
         "K. Greshake",
         "S. Abdelnabi",
         "S. Mishra",
         "C. Endres",
         "T. Holz",
         "M. Fritz"
       ],
       "year": 2023,
       "relevance": "Proposes the first indirect prompt injection attack against LLM applications; foundational reference for prompt injection threat models in agentic systems."
     },
     {
       "title": "EIA: Environmental injection attack on generalist web agents for privacy leakage",
       "authors": [
         "Z. Liao",
         "L. Mo",
         "C. Xu",
         "M. Kang",
         "J. Zhang",
         "C. Xiao",
         "Y. Tian",
         "B. Li",
         "H. Sun"
       ],
       "year": 2025,
       "relevance": "Another attack on generalist web agents via HTML injection targeting privacy leakage; part of the growing literature on agentic AI security that this survey covers."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": [
         "Q. Zhan",
         "Z. Liang",
         "Z. Ying",
         "D. Kang"
       ],
       "year": 2024,
       "relevance": "Provides a benchmark specifically for indirect prompt injection in tool-integrated agents; directly relevant to methodology evaluation of agentic AI security research."
     },
     {
       "title": "UDora: A unified red teaming framework against LLM agents by dynamically hijacking their own reasoning",
       "authors": [
         "J. Zhang",
         "S. Yang",
         "B. Li"
       ],
       "year": 2025,
       "relevance": "Another red-teaming approach against LLM agents that hijacks reasoning; part of the emerging body of work on adversarial evaluation of agentic AI systems."
     },
     {
       "title": "Tree of attacks: Jailbreaking black-box LLMs automatically",
       "authors": [
         "A. Mehrotra",
         "M. Zampetakis",
         "P. Kassianik",
         "B. Nelson",
         "H. Anderson",
         "Y. Singer",
         "A. Karbasi"
       ],
       "year": 2024,
       "relevance": "Adaptive jailbreak method that AgentTypo-pro's strategy learning is inspired by; relevant to automated red-teaming methodology in agentic AI evaluation."
     },
     {
       "title": "AutoDAN-turbo: A lifelong agent for strategy self-exploration to jailbreak LLMs",
       "authors": [
         "X. Liu",
         "P. Li",
         "G. E. Suh",
         "Y. Vorobeychik",
         "Z. Mao",
         "S. Jha",
         "P. McDaniel",
         "H. Sun",
         "B. Li",
         "C. Xiao"
       ],
       "year": 2025,
       "relevance": "Combines strategy learning with RAG for LLM jailbreaking; directly informs AgentTypo-pro's design and relevant to automated evaluation methodology in the agentic AI space."
     }
   ]
 }