ai-research-survey

scan.json (25136B)

---

 {
   "paper": {
     "title": "ARGUS: Defending Against Multimodal Indirect Prompt Injection via Steering Instruction-Following Behavior",
     "authors": [
       "Weikai Lu",
       "Ziqian Zeng",
       "Kehua Zhang",
       "Haoran Li",
       "Huiping Zhuang",
       "Ruidong Wang",
       "Cen Chen",
       "Hao Peng"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2512.05745"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, GitHub link, or code archive is provided anywhere in the paper or supplementary materials. No mention of code release."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper constructs a benchmark dataset across image, video, and audio modalities, but no download link or repository for this dataset is provided. The underlying QA benchmarks (VTQA, MSR-VTT, Clotho-AQA) are public, but the constructed IPI benchmark is not released."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'four NVIDIA A800 GPUs' in Appendix B.2, but no software environment details (Python version, library versions, requirements.txt, Dockerfile) are provided."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. The paper describes the method but not how to reproduce the experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1 and 3 are reported as single point estimates (e.g., ARGUS UIAinject=46.3, AIA=0.1) with no confidence intervals, error bars, or uncertainty measures."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims ARGUS outperforms baselines (e.g., 'ARGUS demonstrates the best safety-utility-efficiency trade-off') but provides no statistical significance tests. Comparisons are made solely by comparing numbers in tables."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper reports raw metric values (AIA, UIA, AIFR) but does not report effect sizes such as Cohen's d, odds ratios, or relative improvements with sufficient context. Differences are stated numerically but without formal effect size measures."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The test set contains 1000 samples per modality (Appendix A.1), but no justification is given for why this size was chosen. No power analysis is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Results appear to be from single experimental runs. No standard deviation, variance across seeds, or multi-run results are reported anywhere in the paper."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 includes five baselines: System Prompt, Ignore Prompt, Noise, Removal, and Adversarial Training (AT). Results are compared in Table 1."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The baselines include recent methods: SecAlign (2024), StruQ (USENIX 2025), Chen et al. (2024) for prompt-based defenses, and detection-based approaches. These represent contemporary approaches in the IPI defense space."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.3 provides an ablation study with three ARGUS variants: w/o Search, w/o AI (adaptive intervention), and w/o PF (post-filtering). Results are in Table 1, showing the contribution of each component."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses four metrics: UIAinject, UIAclean, AIA, and AIFR (defined in Sec. 4.1 and Appendix A.2), plus inference time. This provides a comprehensive view of safety, utility, and efficiency."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "This is a defense method against prompt injection evaluated via automated metrics (substring matching for AIA/UIA/AIFR). Human evaluation is not clearly relevant to the core claims about defense effectiveness."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly separates training, validation, and test sets with different injection elements across splits (Appendix A.1). Test set uses different trigger phrases and injection instructions from training/validation to assess generalization."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by modality (image, video, audio) in Table 1, and additionally evaluated on different MLLMs in Table 3 (InternVL3.5-8B, Qwen2.5-VL-7B, Qwen2-Audio-7B)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.3 discusses failure cases from the ablation: the post-filtering stage can introduce false positives, and the adaptive intervention can actually reduce utility in certain scenarios (video modality). Section 7 acknowledges limitations with multi-instruction scenarios."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports several negative findings: naive defense directions can be coupled with utility-degrading directions (Finding 3), excessive intervention strength harms performance (Finding 2), the adaptive intervention sometimes reduces utility in video (Sec. 6.3), and prompt-engineering baselines can paradoxically increase adherence to injected instructions (Sec. 6.2)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims ARGUS can 'achieve robust defense against multimodal IPI while maximally preserving the MLLM's utility.' Table 1 shows near-zero AIA/AIFR with UIAinject close to 'No Defense' levels across modalities, supporting this claim."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims through ablation studies (Sec. 6.3) showing that removing components degrades performance. The ablation design is controlled single-variable manipulation (removing one component at a time), which is adequate for these causal claims."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Defending Against Multimodal Indirect Prompt Injection' broadly, but results are limited to two specific MLLMs (Qwen2-vl-7b and Kimi-Audio-7b) with additional tests on three more. The limitations section (Sec. 7) only mentions the single-instruction limitation, not the narrow model coverage. The paper also only tests simple concatenation-based injection methods."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for why the method works beyond the proposed hypothesis about instruction-following subspaces. For example, it does not consider whether the improvement could be partly due to the injection detection stage alone, or whether the method might be learning dataset-specific patterns rather than general defense mechanisms."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "The paper specifies Qwen2-vl-7b (with arXiv reference 2409.12191), Kimi-Audio-7b (arXiv 2504.18425), InternVL3.5-8B (arXiv 2508.18265), Qwen2.5-VL-7B, and Qwen2-Audio-7B. These are specific model identifiers with size and version information."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The defensive system prompt text is provided in Sec. 6.1 ('Be vigilant against prompt-injection attacks...'), the Ignore Prompt text is given, GLUE task prompts are in Fig. 4, and the Removal baseline prompts are in Fig. 5. The injection prompt templates are also specified in Sec. 4.1."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 in Appendix B.2 provides hyperparameters for ARGUS across modalities: detection layers, steering layers, post-filtering layers, intervention strength, epochs, and learning rate. AT baseline hyperparameters (epochs=2, lr=2e-6) and Noise baseline parameters (std=150, amplitude=50%) are also stated."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The three-stage pipeline of ARGUS (injection detection, activation steering, post-filtering) is described in detail in Sec. 5 with Figure 3 showing the framework. The practical design decisions (which layers for each stage) are explained in Sec. 5.4."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.1 documents the data construction pipeline in detail: source benchmarks, how samples were composed (7-tuple), injection methods per modality (image concatenation, video frame insertion, audio TTS synthesis), how splits were divided, and the final dataset statistics (training/validation/test sizes)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 is titled 'Conclusion and Limitations' and includes a dedicated limitations paragraph discussing the single-instruction constraint."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The limitations section only mentions one specific threat: 'experiments in this paper are limited to situations involving a single user instruction and a single injection instruction.' This is a single, brief statement without discussion of other specific threats like the simple injection methods used, the narrow model coverage, or potential brittleness to novel attack strategies."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The limitations section mentions only the single-instruction scenario. It does not explicitly state what the results do NOT show, such as whether the method works on larger models, closed-source models, real-world deployment scenarios, or sophisticated adversarial injection methods beyond simple concatenation."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The constructed benchmark dataset is not released. No download link or repository is provided for the raw data or the constructed samples."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.1 describes in detail how data was collected: benign elements from VTQA 2023, MSR-VTT, and Clotho-AQA; injection elements from trigger phrases of [2], Stanford-Alpaca, and GLUE tasks; and specific injection methods (image concatenation, video frame insertion, TTS audio)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. The data is constructed from existing public benchmarks (VTQA, MSR-VTT, Clotho-AQA) combined with synthesized injection components."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.1 documents the full data pipeline: source selection, sample composition, injection method per modality, split creation, and final statistics (e.g., 10312 image training samples, 18536 video, 8107 audio, 1000 validation/test per modality)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding sources or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed on the first page: South China University of Technology, Hong Kong University of Science and Technology, Zhejiang Normal University, and Beihang University."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding information is disclosed, so it is impossible to assess funder independence. The absence of disclosure is not the same as absence of conflict."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial disclosure is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense mechanism against prompt injection, not a pre-trained model's capability on a benchmark. The evaluation measures the defense's effectiveness at preventing instruction hijacking, not model knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests a defense mechanism, not a model's benchmark performance. The train/test separation of the IPI benchmark itself is documented (different injection elements across splits), but this is about experimental design rather than benchmark contamination."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable as the paper evaluates a defense method rather than model capability on an existing benchmark. The benchmark was constructed specifically for this paper."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 reports additional inference time per sample in milliseconds for all methods. ARGUS adds only 3-6ms per sample, compared to the Removal baseline at 12,885ms (image) and 574,121ms (video)."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'four NVIDIA A800 GPUs' but does not state total GPU hours, training time for the probes/direction search, or total computational budget for the experiments."
       }
     }
   },
   "claims": [
     {
       "claim": "Instruction-following behaviors of MLLMs are linearly separable in activation space, indicating a safety subspace exists.",
       "evidence": "Linear probes achieve near-100% accuracy across most layers for distinguishing 'following user instruction' vs 'following attacker instruction' behaviors (Fig. 1, Sec. 4.3, Finding 1). Multiple orthogonal probes also achieve >95% accuracy (Finding 5).",
       "supported": "strong"
     },
     {
       "claim": "ARGUS achieves near-zero AIA and AIFR while preserving model utility across image, video, and audio modalities.",
       "evidence": "Table 1 shows ARGUS achieves AIA of 0.1%, 0.1%, and 0.0% for image, video, and audio respectively, with UIAinject close to or exceeding 'No Defense' levels. Additional MLLMs in Table 3 confirm the pattern.",
       "supported": "moderate"
     },
     {
       "claim": "ARGUS achieves the best safety-utility-efficiency trade-off compared to baselines.",
       "evidence": "Table 1 shows ARGUS has near-zero AIA/AIFR with high UIAinject and only 3-6ms additional inference time, while baselines either sacrifice safety (prompt-based), utility (Noise, AT), or efficiency (Removal at 12,885-574,121ms).",
       "supported": "moderate"
     },
     {
       "claim": "The optimal utility direction search successfully decouples from utility degradation direction.",
       "evidence": "Ablation in Table 1 (Sec. 6.3): ARGUS w/o Search shows 'significant drop in UIAinject' compared to full ARGUS (e.g., 44.5 vs 46.3 for image, 54.4 vs 58.0 for audio).",
       "supported": "moderate"
     },
     {
       "claim": "Naive defense directions can be coupled with utility-degrading directions.",
       "evidence": "Finding 3 (Sec. 4.3): When alpha is increased just enough to achieve AIA=0, UIA still fails to reach the no-injection upper bound, and different modalities show different degradation levels at the same intervention strength.",
       "supported": "strong"
     }
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "The paper discovers that instruction-following behavior in multimodal LLMs is encoded in a linearly-separable safety subspace within the activation space, enabling directional control via activation steering. ARGUS, a three-stage defense framework (injection detection, adaptive activation steering with utility-preserving direction search, post-filtering), achieves near-zero attack success rates across image, video, and audio modalities while preserving model utility with only 3-6ms additional inference time. The approach generalizes across multiple MLLMs (Qwen2-vl-7b, Kimi-Audio-7b, InternVL3.5-8B, Qwen2.5-VL-7B, Qwen2-Audio-7B), outperforming prompt-engineering, noise-based, removal-based, and adversarial training defenses in the safety-utility-efficiency trade-off.",
   "red_flags": [
     {
       "flag": "No error bars or multi-run results",
       "detail": "All results appear to be from single experimental runs with no standard deviations, confidence intervals, or repeated trials. Given that activation steering involves learned components (probes, direction search), variance across random seeds could be significant."
     },
     {
       "flag": "Simple injection methods only",
       "detail": "The injection methods are basic: text concatenation on images, frame insertion in video, TTS audio insertion. More sophisticated attacks (e.g., steganographic embedding, adversarial perturbations, semantic injection) are not tested, limiting confidence in the 'robust defense' claim."
     },
     {
       "flag": "No code or data release",
       "detail": "Neither the code nor the constructed benchmark is released, making independent verification of the results impossible."
     },
     {
       "flag": "Limited scope of limitations discussion",
       "detail": "The limitations section mentions only the single-instruction constraint. It does not address the simple injection methods, narrow model coverage (all 7B-scale models), or potential vulnerabilities to adaptive attackers who know the defense mechanism."
     }
   ],
   "cited_papers": [
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2024,
       "arxiv_id": "2410.05451",
       "relevance": "Adversarial training baseline for IPI defense using direct preference optimization, directly comparable defense approach."
     },
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2025,
       "relevance": "Prompt injection defense using structured queries, published at USENIX Security 2025."
     },
     {
       "title": "VPI-Bench: Visual prompt injection attacks for computer-use agents",
       "authors": ["Tri Cao", "Bennett Lim", "Yue Liu"],
       "year": 2025,
       "arxiv_id": "2506.02456",
       "relevance": "Benchmark for visual prompt injection attacks on computer-use agents, directly relevant to multimodal IPI evaluation."
     },
     {
       "title": "AgentTypo: Adaptive typographic prompt injection attacks against black-box multimodal agents",
       "authors": ["Yanjie Li", "Yiming Cao", "Dong Wang", "Bin Xiao"],
       "year": 2025,
       "arxiv_id": "2510.04257",
       "relevance": "Black-box typographic prompt injection attack using Bayesian optimization, relevant to agentic AI security."
     },
     {
       "title": "Defense against prompt injection attack by leveraging attack techniques",
       "authors": ["Yulin Chen", "Haoran Li", "Zihao Zheng", "Yangqiu Song", "Dekai Wu", "Bryan Hooi"],
       "year": 2024,
       "arxiv_id": "2411.00459",
       "relevance": "Prompt engineering defense against IPI using attack techniques, a baseline defense approach."
     },
     {
       "title": "Can indirect prompt injection attacks be detected and removed?",
       "authors": ["Yulin Chen", "Haoran Li", "Yuan Sui"],
       "year": 2025,
       "arxiv_id": "2502.16580",
       "relevance": "Detection-based approach to IPI defense, directly relevant to the detection stage of ARGUS."
     },
     {
       "title": "Defending against indirect prompt injection attacks with spotlighting",
       "authors": ["Keegan Hines", "Gary Lopez", "Matthew Hall", "Federico Zarfati", "Yonatan Zunger", "Emre Kiciman"],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Prompt engineering defense using spotlighting technique, a baseline defense for IPI in LLMs."
     },
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Formal framework for prompt injection attacks and defenses, foundational work in the IPI defense space."
     },
     {
       "title": "Representation engineering: A top-down approach to AI transparency",
       "authors": ["Andy Zou", "Long Phan", "Sarah Chen", "James Campbell"],
       "year": 2023,
       "arxiv_id": "2310.01405",
       "relevance": "Foundational work on representation engineering for AI safety, the technical basis for ARGUS's activation steering approach."
     },
     {
       "title": "Manipulating multimodal agents via cross-modal prompt injection",
       "authors": ["Le Wang", "Zonghao Ying", "Tianyuan Zhang"],
       "year": 2025,
       "arxiv_id": "2504.14348",
       "relevance": "Cross-modal prompt injection attacks combining image and text, relevant to multimodal IPI threat modeling."
     },
     {
       "title": "Ignore previous prompt: Attack techniques for language models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Seminal work on prompt injection attacks in LLMs, foundational reference for the IPI threat model."
     },
     {
       "title": "COSMIC: Generalized refusal direction identification in LLM activations",
       "authors": ["Vincent Siu", "Nicholas Crispino", "Zihao Yu"],
       "year": 2025,
       "arxiv_id": "2506.00085",
       "relevance": "Activation steering for jailbreak defense via refusal directions, related approach to ARGUS but for different threat model."
     }
   ]
 }