ai-research-survey

scan.json (29369B)

---

 {
   "paper": {
     "title": "BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents",
     "authors": ["Kaiyuan Zhang", "Mark Tenenholtz", "Kyle Polley", "Jerry Ma", "Denis Yarats", "Ninghui Li"],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2511.20597",
     "doi": "10.48550/arXiv.2511.20597"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper provides a HuggingFace model URL (https://huggingface.co/perplexity-ai/browsesafe) and dataset URL (https://huggingface.co/datasets/perplexity-ai/browsesafe-bench), but no source code repository is provided for the benchmark construction pipeline, evaluation scripts, or training code."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides a HuggingFace dataset link for BrowseSafe-Bench (https://huggingface.co/datasets/perplexity-ai/browsesafe-bench) and describes the dataset as comprising 14,719 samples partitioned into training (11,039) and test (3,680) sets."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, conda environment, or detailed environment setup section is provided. The paper mentions using Qwen3-30B-A3B-Instruct-2507 as the base model and states training hyperparameters (learning rate 1e-5, weight decay 0.1, one epoch) but does not specify software dependencies or environment details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README with commands, or scripts to replicate experiments are provided. The evaluation protocol is described at a high level (full HTML content, 80k token max) but lacks specific commands or procedures for reproducing results."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Table 2 and throughout the paper are reported as point estimates (e.g., F1=0.904, Precision=0.978) without confidence intervals, error bars, or uncertainty quantification."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparative claims (e.g., BrowseSafe achieves state-of-the-art, fine-tuning yields performance advantage) but no statistical significance tests are reported. Comparisons are based solely on numerical differences in metrics."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports absolute metric values with baselines, enabling effect size assessment. For example, BrowseSafe F1=0.904 vs. Sonnet 4.5 (32K) F1=0.863, with precision and recall breakdowns (Section 5.3). The generalization ablation (Table 3) shows F1 drops from 0.905 baseline to 0.788 for held-out injection strategies."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The benchmark comprises 14,719 samples (11,039 train, 3,680 test) but no justification is given for these sizes. No power analysis or discussion of whether the test set is large enough for the granular per-attack-type breakdowns (some categories have as few as n=2 for table cell rewrite)."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or results across multiple runs are reported. All results appear to be single-run evaluations. The fine-tuned BrowseSafe model results are reported without any indication of training variance across seeds."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares BrowseSafe against 23 frontier models including PromptGuard-2 (22M, 86M), gpt-oss-safeguard (20B, 120B), GPT-5, GPT-5 Mini, Haiku 4.5, and Sonnet 4.5 with various configurations (Table 2)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The baselines include the most recent frontier models available at the time of writing: GPT-5, Sonnet 4.5, Haiku 4.5, PromptGuard-2, and gpt-oss-safeguard. These are contemporary state-of-the-art models."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 presents a generalization ablation study examining BrowseSafe performance under held-out URLs, held-out attack types, and held-out injection strategies. The paper also examines the impact of reasoning settings and context window sizes on model performance (Section 5.4)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses five evaluation metrics: F1 Score, Precision, Recall, Balanced Accuracy, and Refusals (Section 5.1). All are reported in Table 2."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is included. The paper evaluates prompt injection detection using automated binary classification metrics only. Human evaluation of detection quality, false positive cases, or attack realism could strengthen the claims."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The benchmark is explicitly partitioned into a training set of 11,039 samples and a test set of 3,680 samples (Section 3). All evaluation results in Table 2 are reported on the test set."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides extensive per-category breakdowns: detection accuracy by attack type (Figure 7), by injection strategy (Figure 8), by linguistic style (Figure 9), by distractor count (Figure 10), and full heatmaps of balanced accuracy across all models and categories (Figures 12, 13)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses failure modes including: multilanguage attacks being hardest to detect (76.0% balanced accuracy, Figure 7), visible content rewriting strategies being challenging (footer rewrite 69.1%, Figure 8), stealth linguistic style evading detection (75.3%, Figure 9), and distractor elements causing accuracy drops (Section 3.6)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports several negative findings: PromptGuard-2 performs poorly (F1=0.35-0.36), held-out injection strategies cause significant degradation (F1 drops to 0.788 from 0.905 in Table 3), and Sonnet 4.5 has high refusal rates (419-669 refusals). The paper also notes that LLMs 'quickly overfit and generalize poorly to realistic attacks' without hard negatives (Section 4.5.1)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims the benchmark is comprehensive (supported by 14,719 samples across multiple dimensions in Section 3), that frontier models remain vulnerable (supported by Table 2 showing no model exceeding 0.904 F1), and that BrowseSafe achieves state-of-the-art performance (supported by Table 2 showing BrowseSafe at 0.904 F1 vs. best baseline 0.863)."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper's causal claims are modest and generally supported. The ablation study (Table 3) uses controlled single-variable manipulation (holding out URLs, attack types, or injection strategies) to demonstrate what factors affect generalization. Claims about fine-tuning benefits are supported by comparing the same base model with and without fine-tuning."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly bounds its scope in the threat model (Section 4.2): 'we do not handle or benchmark attacks based on non-textual inputs, such as malicious images or other inputs specialized for vision-based models.' The generalization analysis (Section 5.6) explicitly tests and reports limitations for unseen injection strategies. The paper also notes small sample sizes for some categories (footer rewrite n=15, table cell rewrite n=2)."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses alternative explanations: that detection models may rely on 'shallow heuristics' rather than understanding (Section 3.4), that high accuracy on hidden attacks could reflect 'spurious correlations' (Section 3.6), and that the standard test set 'may represent a challenging sample of websites' explaining why held-out URL performance was higher (Section 5.6)."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper refers to models by marketing names without specific version IDs: 'GPT-5', 'GPT-5 Mini', 'Haiku 4.5', 'Sonnet 4.5'. No API version, snapshot date, or model checkpoint identifier is provided for any closed-weight model. The fine-tuned model uses 'Qwen3-30B-A3B-Instruct-2507' which does include a version identifier."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides the safeguard policy prompt used for gpt-oss-safeguard models (Appendix A.4) and the instruction prompt used for Anthropic/OpenAI models (Appendix A.5), both with sufficient detail to reconstruct the evaluation setup."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "For fine-tuning, the paper reports learning rate (1e-5), weight decay (0.1), and one epoch (Section 5.1). However, critical inference-time hyperparameters like temperature and top-p are not reported for any of the 23 models evaluated. Different reasoning settings (Low, Medium, High) are tested but the specific parameter values behind these labels are not disclosed."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The BrowseSafe defense architecture is described in detail across Sections 4.3-4.7, including trust boundary enforcement, content preprocessing, chunking strategy, conservative OR aggregation, and context-engineered intervention. The multi-layered design is clearly documented."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 documents the benchmark construction pipeline in four stages: (1) content extraction and anonymization from real websites, (2) HTML template wrapping with eight styles, (3) distractor element insertion, and (4) attack injection. Section 4.4 describes the raw content extraction preprocessing for the defense system."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 (Threat Model / BrowseSafe's Defense Scope) contains a dedicated discussion of limitations: 'BrowseSafe has limitations and in this work we do not handle or benchmark attacks based on non-textual inputs, such as malicious images or other inputs specialized for vision-based models.' Additional limitations are noted in Section 4.5.4 about boundary case handling."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated threats to validity section. While the paper notes specific scope limitations (no image attacks, no vision-based models), it does not discuss threats specific to the study design, such as: whether the LLM-generated attacks in the benchmark represent real-world attack distributions, whether the production data used for HTML scaffolds introduces bias, or whether the single-run evaluation design could produce unreliable results."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly states what it does NOT cover: non-textual/image-based attacks (Section 4.2), tool call scanning (Section 4.5.5, noted as 'future work'), global content analysis across chunks (Section 4.6), and the scope is bounded to text-based prompt injection in browser agents specifically."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The BrowseSafe-Bench dataset is released on HuggingFace (https://huggingface.co/datasets/perplexity-ai/browsesafe-bench), enabling independent verification of the benchmark samples and evaluation results."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 describes the data collection process: starting from 'usage data from a production browser agent with millions of active users,' filtering to 100,000 anonymized tool call outputs satisfying quality and length criteria, then using these to derive HTML scaffolds and identify variation axes."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were recruited for this study. The benchmark is constructed from production data and LLM-generated attacks, not from human subjects."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full data pipeline is documented in Section 3.2 with four explicit stages (content extraction/anonymization, HTML wrapping, distractor insertion, attack injection). The paper states the final dataset size (14,719 samples) and the train/test split (11,039/3,680). Section 3.3-3.7 detail each component of the pipeline."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The Acknowledgements section discloses NSF funding: 'Work by Kaiyuan Zhang and Ninghui Li was supported by the U.S. National Science Foundation AI Institute for Agent-based Cyber Threat Intelligence and Operation (ACTION), with NSF grant number 2229876.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Purdue University (Kaiyuan Zhang, Ninghui Li) and Perplexity AI (Mark Tenenholtz, Kyle Polley, Jerry Ma, Denis Yarats). This is relevant since the paper evaluates browser agent security and Perplexity operates a production browser agent (Comet, referenced in Section 1)."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Four of six authors are affiliated with Perplexity AI, which operates Perplexity Comet, a production browser agent referenced in the paper. Perplexity has a direct financial interest in demonstrating that their BrowseSafe defense works well for browser agent security. The NSF funding for the Purdue authors appears independent, but the primary research effort comes from Perplexity employees."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is provided. The Perplexity AI affiliation is disclosed, but the paper does not include an explicit declaration of whether authors hold equity or other financial interests related to the findings, which is relevant given that Perplexity is a startup evaluating its own defense technology."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper evaluates multiple pre-trained models (GPT-5, Sonnet 4.5, Haiku 4.5, etc.) on the BrowseSafe-Bench benchmark but does not state training data cutoff dates for any of these models. This is relevant because the benchmark uses content derived from production data that these models may have been trained on."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the HTML content used in the benchmark overlaps with training data of the evaluated frontier models. The benchmark is constructed from anonymized production data, but there is no analysis of whether similar content appeared in the training sets of GPT-5, Sonnet 4.5, etc."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "BrowseSafe-Bench is a new benchmark, which reduces contamination risk. However, the paper does not discuss whether the attack patterns and HTML structures in the benchmark resemble training data used to build the safety capabilities of the models being evaluated. Since system cards for GPT-5 and Claude models reference internal prompt injection benchmarks, there could be indirect overlap."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. The evaluation is entirely automated using benchmark classification metrics."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Figure 11 reports median inference latency (P50) for all evaluated models. BrowseSafe achieves <1 second, GPT-5 family ~2 seconds, Sonnet 4.5 family 23-36 seconds, PromptGuard-2 0.19s on CPU. The paper explicitly analyzes the performance-latency tradeoff (Section 5.5)."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. The paper does not report GPU hours for fine-tuning, total API costs for evaluating 23 models across 3,680 test samples, hardware used for training, or total wall-clock time for the experiments."
       }
     }
   },
   "claims": [
     {
       "claim": "BrowseSafe achieves state-of-the-art F1 score of 0.904 on BrowseSafe-Bench, outperforming all 23 evaluated frontier models.",
       "evidence": "Table 2 shows BrowseSafe at F1=0.904, Precision=0.978, Recall=0.841, Balanced Accuracy=0.912. The best baseline is Sonnet 4.5 (32K) at F1=0.863.",
       "supported": "moderate"
     },
     {
       "claim": "Even the most capable frontier AI models remain vulnerable to complex and realistic prompt injection payloads in BrowseSafe-Bench.",
       "evidence": "Table 2 shows that no off-the-shelf model exceeds F1=0.863 on the benchmark. Figure 2 shows F1 scores ranging from 35% to 90.4% across all models.",
       "supported": "strong"
     },
     {
       "claim": "Current detection models rely on shallow linguistic heuristics rather than robust semantic comprehension, as evidenced by degraded performance on stealth and indirect attacks.",
       "evidence": "Figure 9 shows explicit attacks at 84.6% balanced accuracy vs. indirect at 78.1% and stealth at 75.3%. Figure 7 shows multilanguage attacks at 76.0% (lowest) vs. system prompt exfiltration at 85.0% (highest).",
       "supported": "strong"
     },
     {
       "claim": "Fine-tuning a specialized detection model on BrowseSafe-Bench yields a distinct performance advantage over general-purpose models.",
       "evidence": "Section 5.3 and Table 2: BrowseSafe (fine-tuned Qwen3-30B-A3B) achieves F1=0.904 vs. best general-purpose Sonnet 4.5 (32K) at F1=0.863. Precision improves to 0.978 vs 0.935.",
       "supported": "moderate"
     },
     {
       "claim": "Distractor elements cause a precipitous drop in detection accuracy for existing models.",
       "evidence": "Figure 10 shows average balanced accuracy drops from 90.5% with zero distractors to 81.3% with three distractors, then stabilizes in the 79.6%-83.0% range for higher distractor counts.",
       "supported": "strong"
     },
     {
       "claim": "BrowseSafe achieves sub-1-second latency while maintaining the highest F1 score.",
       "evidence": "Figure 11 plots F1 vs. P50 latency, showing BrowseSafe in the top-left quadrant with F1>90% and latency <1 second, compared to Sonnet 4.5 at 23-36 seconds.",
       "supported": "moderate"
     },
     {
       "claim": "Unseen injection strategies present the greatest generalization challenge for the fine-tuned model.",
       "evidence": "Table 3: Held-out injection strategies F1=0.788 vs. baseline 0.905, while held-out attack types only dropped to 0.863 and held-out URLs improved to 0.935.",
       "supported": "strong"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "BrowseSafe-Bench is a 14,719-sample benchmark for evaluating prompt injection detection in browser agents, featuring 11 attack types, 9 injection strategies, and realistic HTML with distractor elements. Evaluation of 23 frontier models shows that even the best off-the-shelf models achieve at most F1=0.863, with particular weakness against stealth linguistic styles, visible content rewrites, and multilanguage attacks. A fine-tuned Qwen3-30B-A3B model (BrowseSafe) achieves F1=0.904 with sub-1-second latency, outperforming all general-purpose models on precision and balanced accuracy while maintaining practical deployment speed.",
   "red_flags": [
     {
       "flag": "Company evaluating its own defense product",
       "detail": "Four of six authors are Perplexity AI employees, and the paper evaluates BrowseSafe, a defense mechanism designed for Perplexity's production browser agent (Comet). The benchmark and defense were developed by the same team, creating a potential self-evaluation bias. No external or independent evaluation is included."
     },
     {
       "flag": "No statistical tests or variance reporting",
       "detail": "All results are single-run point estimates without confidence intervals, error bars, significance tests, or multi-seed variance. The claim that BrowseSafe outperforms baselines (F1=0.904 vs 0.863) is not accompanied by any statistical test to determine if this difference is significant."
     },
     {
       "flag": "No model version IDs for closed-weight models",
       "detail": "The evaluated models (GPT-5, Sonnet 4.5, Haiku 4.5) are identified only by marketing names without API version strings or snapshot dates. Since model behavior changes across versions, exact reproduction is impossible."
     },
     {
       "flag": "Small sample sizes in some benchmark categories",
       "detail": "Some injection strategy categories have very few samples: table cell rewrite (n=2), footer rewrite (n=15), list item rewrite (n=9). Per-category balanced accuracy results for these categories are likely unreliable, as the paper itself acknowledges for footer and table cell rewrite."
     },
     {
       "flag": "Benchmark constructed by same team as defense",
       "detail": "BrowseSafe-Bench was designed and constructed by the same team that built the BrowseSafe defense. The defense model was trained on the benchmark's training split. While a held-out test set is used, there is a risk that benchmark design decisions inadvertently favor the defense approach."
     }
   ],
   "cited_papers": [
     {
       "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents",
       "authors": ["Q. Zhan", "Z. Liang", "Z. Ying", "D. Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Prompt injection benchmark for tool-integrated LLM agents, directly compared in BrowseSafe-Bench evaluation."
     },
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents",
       "authors": ["E. Debenedetti", "J. Zhang", "M. Balunovic", "L. Beurer-Kellner", "M. Fischer", "F. Tramer"],
       "year": 2024,
       "relevance": "Dynamic benchmark for prompt injection attack/defense evaluation in LLM agents, one of the key prior benchmarks compared against."
     },
     {
       "title": "Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents",
       "authors": ["H. Zhang", "J. Huang", "K. Mei"],
       "year": 2024,
       "arxiv_id": "2410.02644",
       "relevance": "Benchmark for agent security covering prompt injection, memory poisoning, and backdoor attacks in LLM-based agents."
     },
     {
       "title": "WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks",
       "authors": ["I. Evtimov", "A. Zharmagambetov", "A. Grattafiori", "C. Guo", "K. Chaudhuri"],
       "year": 2025,
       "arxiv_id": "2504.18575",
       "relevance": "Web agent security benchmark built on VisualWebArena, directly compared in the paper's benchmark comparison table."
     },
     {
       "title": "Defeating Prompt Injections by Design",
       "authors": ["E. Debenedetti", "I. Shumailov", "T. Fan", "J. Hayes", "N. Carlini"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "Proposes CaMeL, a protective system layer for LLM security against prompt injection, representing an architectural defense approach."
     },
     {
       "title": "Securing AI Agents with Information-Flow Control",
       "authors": ["M. Costa", "B. Kopf", "A. Kolluri", "A. Paverd"],
       "year": 2025,
       "arxiv_id": "2505.23643",
       "relevance": "Explores formal security guarantees for AI agents using information-flow control (FIDES system), a defense approach complementary to BrowseSafe."
     },
     {
       "title": "Formalizing and Benchmarking Prompt Injection Attacks and Defenses",
       "authors": ["Y. Liu", "Y. Jia", "R. Geng", "J. Jia", "N. Z. Gong"],
       "year": 2024,
       "relevance": "Provides formal treatment of prompt injection attacks and defenses, published at USENIX Security 2024."
     },
     {
       "title": "LLM Agents Should Employ Security Principles",
       "authors": ["K. Zhang", "Z. Su", "P.-Y. Chen", "E. Bertino", "X. Zhang", "N. Li"],
       "year": 2025,
       "arxiv_id": "2505.24019",
       "relevance": "Proposes AgentSandbox enforcing security principles (defense-in-depth, least privilege) for agentic systems, by the same first author."
     },
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["S. Chen", "J. Piet", "C. Sitawarin", "D. Wagner"],
       "year": 2025,
       "relevance": "Defense approach separating prompts and data into two channels, published at USENIX Security 2025."
     },
     {
       "title": "The attacker moves second: Stronger adaptive attacks bypass defenses against llm jailbreaks and prompt injections",
       "authors": ["M. Nasr", "N. Carlini", "C. Sitawarin"],
       "year": 2025,
       "arxiv_id": "2510.09023",
       "relevance": "Demonstrates that adaptive attacks can bypass prompt injection defenses, directly relevant to evaluating defense robustness."
     },
     {
       "title": "WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents",
       "authors": ["Y. Liu", "R. Xu", "X. Wang", "Y. Jia", "N. Z. Gong"],
       "year": 2025,
       "arxiv_id": "2510.01354",
       "relevance": "Prompt injection detection benchmark for web agents with malicious/benign samples, one of the key prior benchmarks compared against."
     },
     {
       "title": "EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage",
       "authors": ["Z. Liao", "L. Mo", "C. Xu"],
       "year": 2024,
       "arxiv_id": "2409.11295",
       "relevance": "Demonstrates environmental injection attacks for privacy leakage against web agents, a key attack type addressed by BrowseSafe."
     }
   ]
 }