ai-research-survey

scan.json (29920B)

---

 {
   "paper": {
     "title": "AGENTVIGIL: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents",
     "authors": [
       "Zhun Wang",
       "Vincent Siu",
       "Zhe Ye",
       "Tianneng Shi",
       "Yuzhou Nie",
       "Xuandong Zhao",
       "Chenguang Wang",
       "Wenbo Guo",
       "Dawn Song"
     ],
     "year": 2025,
     "venue": "Preprint",
     "arxiv_id": "2505.05849"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL or code release is mentioned in the paper. The paper describes algorithms in pseudocode (Appendix C) but there is no GitHub link, Zenodo archive, or any other artifact URL provided."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper evaluates on two public benchmarks: AgentDojo (Debenedetti et al., 2024) and VWA-adv (Wu et al., 2024b). Both are publicly available. The paper also uses WebArena's shopping website for the real-world case study, which is open-source (magento2). No novel dataset was created that is unreleased."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or dependency specification is provided. The paper mentions using GPT-4o-mini as helper model for mutation and specific model checkpoints (Appendix A), but does not describe the software environment needed to reproduce experiments."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or reproduction scripts are provided. The algorithms in Appendix C describe the logic but not how to run the actual experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are reported as point estimates (e.g., '71% success rate', '70% success rate'). No confidence intervals, standard deviations, or error bars are provided for any result in Tables 1-5 or in Figure 3."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used. The paper compares AGENTVIGIL against baselines by directly comparing point-estimate success rates without any formal statistical testing (e.g., p-values, bootstrap tests)."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports percentage improvement with baseline context: '71% success rate' vs '38% baseline' with 'nearly a 100% improvement over the baseline attacks' (Section 5.1). Similar reporting for VWA-adv (70% vs 36%). Per the schema description, 'A paper that says 12% improvement over baseline (from 45% to 57%) provides enough context for YES.' The paper matches this pattern."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses 142/173 task split for fuzzing/test in AgentDojo and 99/100 for VWA-adv. The 'randomly dividing' approach is described but no justification for these split sizes or power analysis is provided."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported. All results in Tables 1-5 are single point estimates. There is no mention of multiple runs with aggregated statistics."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses handcrafted adversarial prompts from AgentDojo and VWA-adv as baselines (Section 5.1, 5.2). In Appendix B.2, additional baselines from OpenPromptInjection (Liu et al., 2024) and InjecAgent (Zhan et al., 2024) are included."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The baselines used (AgentDojo from 2024, VWA-adv from 2024, OpenPromptInjection from 2024, InjecAgent from 2024) are contemporary and represent relevant prior work. GPTFuzzer (Yu et al., 2023) is discussed but correctly positioned as a related but different approach (direct vs. indirect injection)."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 presents an ablation study isolating the contribution of three core components: (1) the initial corpus, (2) adaptive seed scoring strategy, and (3) MCTS-based seed selection. Results are shown in Figure 3."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports attack success rate (ASR) as the primary metric and uses attack coverage as an additional metric (shown in Figures 3 and 4). Utility scores for open-source models are also reported in Appendix B.1."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "This is an adversarial ML security paper evaluating automated attack success. Human evaluation of model outputs is not relevant to the core claims about attack success rates, which are measured by automated benchmark evaluation criteria."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly separates tasks into fuzzing sets (used for optimization) and test sets (held-out for final evaluation): 142/173 for AgentDojo and 99/100 for VWA-adv. Transferability is evaluated on the test set to avoid overfitting to the fuzzing set."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Appendix B.3 (Table 5) provides per-scenario breakdowns for AgentDojo (Slack, Workspace, Travel, Banking) and VWA-adv (Illusioning, Goal misdirection). Per-model results are shown throughout Table 1."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses cases where attacks fail, notably that AGENTVIGIL performs poorly against Claude-3.5-Sonnet ('both the baseline and AGENTVIGIL's prompts are ineffective against Claude-3.5-Sonnet, as it demonstrates strong robustness'). Performance degradation against defenses is also discussed in Sections 5.1 and 5.2."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that AGENTVIGIL's optimized prompts do not transfer well to Claude-3.5-Sonnet (Section 5.1: 0.03-0.04 success rate), and that when defenses are applied in VWA-adv, 'AGENTVIGIL's performance declines and converges with the baseline' (Section 5.2). These are genuine negative results."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 71% and 70% success rates on AgentDojo and VWA-adv respectively, 'nearly doubling the performance of baseline attacks' — all supported by Tables 1-3 and Figures 3-4. The claim about transferability to unseen tasks and 'promising results against defenses' is supported though somewhat hedged in body text."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The ablation study (Section 5.3) uses controlled single-variable manipulation to support causal claims about which components contribute to performance. The ablation substitutes individual components while keeping others constant, which is adequate for causal inference about the system's components."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The abstract states AGENTVIGIL is 'generic' and applicable 'across diverse LLM agents', but testing is limited to two benchmarks (AgentDojo for personal assistants, VWA-adv for web agents) and a single real-world case study. The title's claim of 'generic black-box red-teaming' overstates scope — only English-language text-based attacks are tested, and only specific types of injection goals are covered."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for its results. For example, when discussing why AGENTVIGIL's prompts do not transfer to Claude ('Claude is more vulnerable to simpler adversarial prompts'), this is presented as speculation without evidence or alternative considerations. No systematic threats-to-validity section exists."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A explicitly lists all model checkpoints: o3-mini (o3-mini-2024-12-17), GPT-4o-mini (gpt-4o-mini-2024-07-18), GPT-4o (gpt-4o-2024-08-06), Claude-3.5-Sonnet (claude-3-5-sonnet-20241022), Gemini-2-flash-exp (gemini-2.0-flash-exp). Specific version IDs are provided."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The paper describes the corpus of adversarial prompt templates as using 'placeholders to accommodate different variables' (Section 4.2) but does not provide the actual template text in the paper or appendix. The mutation prompts sent to the helper LLM are described in natural language only ('Shorten compresses the seed for conciseness', etc.) without providing the actual prompt text."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "LLM inference hyperparameters (temperature, top-p, etc.) are not reported for any of the models used. The fuzzing hyperparameters such as number of iterations (10) and seeds selected (5 top-scoring seeds) are mentioned, but LLM API parameters are absent."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "AGENTVIGIL attacks agents that are third-party black-box systems (AgentDojo's agent, VWA-adv's agent, WebArena's default agent). The paper cannot describe the internal scaffolding of these external agent systems. AGENTVIGIL itself is the attack framework, not the agent scaffold."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The initial corpus collection is described qualitatively ('collected from human heuristics, online resources, existing research'), but the number of initial templates, specific filtering criteria, and exact sources are not documented in sufficient detail to reproduce the corpus."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is an 'Impact Statement' section (before References) but no dedicated Limitations or Threats to Validity section. The Impact Statement discusses dual-use concerns but not methodological limitations of the evaluation."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats-to-validity section exists. The impact statement contains generic statements about ongoing research needs but does not address specific threats to the validity of the experimental results, such as benchmark selection bias, limited number of injection tasks, or model version sensitivity."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The threat model (Section 3) excludes 'misuse of agents to perform harmful actions, and direct attacks on the underlying infrastructure' but this defines attacker capabilities rather than result scope. The paper does not explicitly state what the results do NOT show — e.g., it does not say the attack would not generalize to non-English agents, non-text modalities, or other agent architectures beyond the two benchmarks."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The generated adversarial prompts and raw attack success logs are not released. The paper reports aggregate success rates in tables but provides no way to verify the underlying per-task results."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 describes how the initial corpus was collected ('from human heuristics, online resources, existing prompt injection research'). The benchmark task splits are described with specific counts (142/173 for AgentDojo, 99/100 for VWA-adv)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "This paper has no human participants. The evaluation uses automated benchmarks with pre-defined tasks; no recruitment of human participants was involved."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The fuzzing pipeline is documented in detail through Algorithms 1-3 (Appendix C) and Figure 2. The flow from corpus collection → seed selection → mutation → scoring → iteration is clearly described with pseudocode."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source, acknowledgments section, or grant information is present in the paper. As a preprint from UC Berkeley, Washington University, and UC Santa Barbara, funding would be expected but is not disclosed."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed on the first page: affiliations 1 (UC Berkeley), 2 (Washington University, Saint Louis), and 3 (UC Santa Barbara) are explicitly stated for each author."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Because no funding is disclosed, it is impossible to assess funder independence. This is treated as NO under the schema convention that absence of disclosure is not equivalent to absence of conflict."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "There is no competing interests statement, patent disclosure, or financial interests declaration in the paper. The paper attacks commercial products (GPT-4o, Claude, Gemini) from a university setting, but no formal COI declaration is made."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses several LLMs (o3-mini, GPT-4o, Claude-3.5-Sonnet, Gemini-2-flash-exp) and specifies model checkpoints but does not state the training data cutoff dates for these models. The AgentDojo and VWA-adv benchmarks could potentially appear in training data."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the AgentDojo or VWA-adv benchmark tasks appeared in the training data of the evaluated LLMs. This is relevant since both benchmarks are from 2024 and some models' training cutoffs may include these datasets."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "AgentDojo was published in 2024 (arXiv:2406.13352) and VWA-adv in 2024. Models like GPT-4o (training cutoff approximately April 2024) and Claude-3.5-Sonnet may have been trained on data that includes these benchmarks. This contamination risk is not discussed."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "This paper has no human participants. All evaluation is automated using benchmark frameworks."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper does discuss ethical considerations for the real-world case study ('Due to ethical considerations, we use a local copy'), but this is not an IRB-reviewed human subjects study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses GPT-4o, o3-mini, and GPT-4o-mini extensively across hundreds of tasks and multiple fuzzing iterations, but no API costs, token counts, or latency figures are reported. The paper mentions that some defenses were excluded due to 'high computational costs' but does not quantify AGENTVIGIL's own costs."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Total computational budget is not stated. The paper notes that '10 fuzzing iterations' are conducted on 142+ tasks with multiple mutations per iteration (3 or 10), implying hundreds of LLM API calls per experiment, but no total cost or compute budget is reported."
       }
     }
   },
   "claims": [
     {
       "claim": "AGENTVIGIL achieves 71% and 70% attack success rates on AgentDojo and VWA-adv respectively, nearly doubling baseline attack performance.",
       "evidence": "Table 1 and Figure 3 show 71% ASR on AgentDojo fuzzing set (o3-mini) vs. 38% baseline, and Figure 4/Table 1 show 70% on VWA-adv fuzzing set (GPT-4o) vs. 36% baseline. Section 5.1 and 5.2.",
       "supported": "strong"
     },
     {
       "claim": "Adversarial prompts generated by AGENTVIGIL exhibit strong transferability to unseen tasks, achieving 65% and 59% success rates on o3-mini and GPT-4o respectively.",
       "evidence": "Table 1, test set row for AgentDojo: AGENTVIGIL achieves 0.65 on o3-mini and 0.59 on GPT-4o in VWA-adv. Section 5.1 and 5.2.",
       "supported": "strong"
     },
     {
       "claim": "AGENTVIGIL demonstrates strong transferability across unseen LLMs, achieving 67% success against Gemini-2-flash-exp (not used during fuzzing).",
       "evidence": "Table 1, VWA-adv test set row shows AGENTVIGIL achieves 0.67 against Gemini-2-flash-exp, compared to 0.50 for baseline. Section 5.2.",
       "supported": "strong"
     },
     {
       "claim": "Existing defenses (pi_detector, repeat, delimit, safety, paraphrase) are insufficient to stop AGENTVIGIL attacks.",
       "evidence": "Tables 2 and 3 show AGENTVIGIL maintains 12-49% ASR across defenses vs. 0-36% for baseline. Section 5.1 and 5.2.",
       "supported": "moderate"
     },
     {
       "claim": "All three components of AGENTVIGIL (initial corpus, adaptive seed scoring, MCTS-based seed selection) are necessary for performance.",
       "evidence": "Section 5.3 ablation study removes each component and shows reduced coverage in Figure 3. Without initial corpus, performance plateaus after ~4 iterations; without MCTS/scoring, improvement is markedly slower.",
       "supported": "moderate"
     },
     {
       "claim": "AGENTVIGIL can successfully mislead real-world web agents to navigate to arbitrary URLs including malicious phishing sites.",
       "evidence": "Section 5.4 real-world case study deploys attack on WebArena/magento2 shopping website; Figure 1 shows successful URL redirection. However, tested only on a locally hosted copy, not a live production system.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": [
     "benchmark-eval",
     "case-study"
   ],
   "key_findings": "AGENTVIGIL is a black-box fuzzing framework for indirect prompt injection attacks on LLM agents that uses Monte Carlo Tree Search (MCTS) for seed selection, adaptive coverage-guided scoring, and semantically diverse mutations. On two established benchmarks (AgentDojo and VWA-adv), AGENTVIGIL achieves 71% and 70% attack success rates respectively, nearly doubling the performance of handcrafted baseline attacks. The generated adversarial prompts exhibit strong transferability to unseen tasks and LLMs (including Gemini-2-flash-exp not used in fuzzing), but do not transfer well to Claude-3.5-Sonnet which appears more robust to complex adversarial prompts. Existing defenses (delimiter-based, classifier-based, repetition-based) reduce but do not eliminate attack success, highlighting persistent vulnerabilities in current agent security measures.",
   "red_flags": [
     {
       "flag": "No uncertainty quantification",
       "detail": "All results in Tables 1-5 are single point estimates with no standard deviations, confidence intervals, or error bars. Given that fuzzing involves random seed sampling and mutation, variance across runs could be substantial. The paper claims 'nearly doubling' performance without any statistical testing to establish this is not within noise."
     },
     {
       "flag": "Benchmark contamination unaddressed",
       "detail": "AgentDojo (arXiv:2406.13352, June 2024) and VWA-adv (2024) are relatively recent benchmarks. Models like GPT-4o (gpt-4o-2024-08-06) and Claude-3.5-Sonnet (claude-3-5-sonnet-20241022) have training data that may include these benchmark descriptions, potentially affecting the validity of results. This risk is not discussed."
     },
     {
       "flag": "No code or prompt artifacts released",
       "detail": "The paper does not release the initial adversarial corpus, the mutation prompt templates, or experimental code. The MCTS algorithms are described in pseudocode but the actual implementation with specific prompts cannot be reproduced, making independent replication impossible."
     },
     {
       "flag": "Genericity claim overstated",
       "detail": "The paper claims AGENTVIGIL is a 'generic' framework applicable to 'diverse LLM agents', but validation is limited to two benchmarks with specific agent types (personal assistants and web agents) in English. The real-world case study uses a single locally hosted instance. The title's genericity claim is not fully supported."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper lacks a dedicated limitations or threats-to-validity section. The Impact Statement focuses on dual-use concerns rather than methodological limitations. Important scope constraints (e.g., attack effectiveness may be lower on production systems with rate limiting, the 10-minute attack window assumption, etc.) are not discussed."
     },
     {
       "flag": "Random task sampling without stability check",
       "detail": "During fuzzing, the paper 'randomly sample[s] a quarter of user and injection tasks from each suite to evaluate each newly mutated seed' (Section 5.1). This introduces stochasticity into the evaluation of each seed, but no variance analysis across different random samples is performed to verify result stability."
     }
   ],
   "cited_papers": [
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
       "authors": [
         "Debenedetti, E.",
         "Zhang, J.",
         "Balunovic, M.",
         "Beurer-Kellner, L.",
         "Fischer, M.",
         "Tramer, F."
       ],
       "year": 2024,
       "arxiv_id": "2406.13352",
       "relevance": "Primary benchmark used to evaluate AGENTVIGIL; directly relevant as a framework for assessing LLM agent security."
     },
     {
       "title": "Dissecting Adversarial Robustness of Multimodal LM Agents",
       "authors": [
         "Wu, C. H.",
         "Shah, R. R.",
         "Koh, J. Y.",
         "Salakhutdinov, R.",
         "Fried, D.",
         "Raghunathan, A."
       ],
       "year": 2024,
       "relevance": "VWA-adv benchmark paper and baseline; central to the evaluation of AGENTVIGIL on web agents with multimodal inputs."
     },
     {
       "title": "GPTFuzzer: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts",
       "authors": [
         "Yu, J.",
         "Lin, X.",
         "Xing, X."
       ],
       "year": 2023,
       "arxiv_id": "2309.10253",
       "relevance": "Prior fuzzing work for direct prompt injection that AGENTVIGIL adapts and extends to indirect injection in multi-step agents."
     },
     {
       "title": "More than you've asked for: A Comprehensive Analysis of Novel Prompt Injection Threats to Application-Integrated LLMs",
       "authors": [
         "Greshake, K.",
         "Abdelnabi, S.",
         "Mishra, S.",
         "Endres, C.",
         "Holz, T.",
         "Fritz, M."
       ],
       "year": 2023,
       "arxiv_id": "2302.12173",
       "relevance": "Foundational work characterizing indirect prompt injection threats to LLM-integrated applications."
     },
     {
       "title": "AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases",
       "authors": [
         "Chen, Z.",
         "Xiang, Z.",
         "Xiao, C.",
         "Song, D.",
         "Li, B."
       ],
       "year": 2024,
       "arxiv_id": "2407.12784",
       "relevance": "Related agent red-teaming attack that uses white-box access; contrasted with AGENTVIGIL's black-box approach."
     },
     {
       "title": "Formalizing and Benchmarking Prompt Injection Attacks and Defenses",
       "authors": [
         "Liu, Y.",
         "Jia, Y.",
         "Geng, R.",
         "Jia, J.",
         "Gong, N. Z."
       ],
       "year": 2024,
       "relevance": "OpenPromptInjection benchmark used as additional baseline in Appendix B.2; directly relevant to prompt injection evaluation."
     },
     {
       "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents",
       "authors": [
         "Zhan, Q.",
         "Liang, Z.",
         "Ying, Z.",
         "Kang, D."
       ],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Another indirect prompt injection benchmark used as baseline comparison in Appendix B.2."
     },
     {
       "title": "Defending against Indirect Prompt Injection Attacks with Spotlighting",
       "authors": [
         "Hines, K.",
         "Lopez, G.",
         "Hall, M.",
         "Zarfati, F.",
         "Zunger, Y.",
         "Kiciman, E."
       ],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Defense mechanism (delimiter-based spotlighting) tested against AGENTVIGIL; relevant to agent security survey."
     },
     {
       "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions",
       "authors": [
         "Wallace, E.",
         "Xiao, K.",
         "Leike, R.",
         "Weng, L.",
         "Heidecke, J.",
         "Beutel, A."
       ],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Training-based defense against prompt injection that AGENTVIGIL evaluates indirectly through model robustness testing."
     },
     {
       "title": "WebArena: A Realistic Web Environment for Building Autonomous Agents",
       "authors": [
         "Zhou, S.",
         "Xu, F. F.",
         "Zhu, H.",
         "Zhou, X.",
         "Lo, R.",
         "Sridhar, A.",
         "Cheng, X.",
         "Ou, T.",
         "Bisk, Y.",
         "Fried, D."
       ],
       "year": 2023,
       "arxiv_id": "2307.13854",
       "relevance": "Environment used for the real-world case study in Section 5.4; foundational web agent benchmark."
     },
     {
       "title": "VisualWebArena: Evaluating Multimodal Agents on Realistic Visual Web Tasks",
       "authors": [
         "Koh, J. Y.",
         "Lo, R.",
         "Jang, L.",
         "Duvvur, V.",
         "Lim, M. C.",
         "Huang, P.-Y.",
         "Neubig, G.",
         "Zhou, S.",
         "Salakhutdinov, R.",
         "Fried, D."
       ],
       "year": 2024,
       "arxiv_id": "2401.13649",
       "relevance": "Foundation for VWA-adv benchmark; relevant as a multimodal web agent evaluation framework."
     },
     {
       "title": "PromptFuzz: Harnessing Fuzzing Techniques for Robust Testing of Prompt Injection in LLMs",
       "authors": [
         "Yu, J.",
         "Shao, Y.",
         "Miao, H.",
         "Shi, J.",
         "Xing, X."
       ],
       "year": 2024,
       "arxiv_id": "2409.14729",
       "relevance": "Related fuzzing approach for prompt injection testing; directly comparable to AGENTVIGIL's methodology."
     },
     {
       "title": "AdvWeb: Controllable Black-box Attacks on VLM-powered Web Agents",
       "authors": [
         "Xu, C.",
         "Kang, M.",
         "Zhang, J.",
         "Liao, Z.",
         "Mo, L.",
         "Yuan, M.",
         "Sun, H.",
         "Li, B."
       ],
       "year": 2024,
       "arxiv_id": "2410.17401",
       "relevance": "Related black-box attack on web agents; contrasts with AGENTVIGIL's generic approach for indirect injection."
     }
   ]
 }