ai-research-survey

scan.json (28503B)

---

 {
   "paper": {
     "title": "CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution",
     "authors": [
       "Minbeom Kim",
       "Mihir Parmar",
       "Phillip Wallis",
       "Lesly Miculicich",
       "Kyomin Jung",
       "Krishnamurthy Dj Dvijotham",
       "Long T. Le",
       "Tomas Pfister"
     ],
     "year": 2026,
     "venue": "arXiv preprint",
     "arxiv_id": "2602.07918"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL or code archive is provided in the paper. The paper references official implementations of baselines (AgentDojo, DRIFT, MELON) but does not release CausalArmor's own code."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available benchmarks: AgentDojo (v1.2.2, with GitHub link https://github.com/ethz-spylab/agentdojo) and DoomArena's TauBench subset. Custom injection templates are provided in full text in Appendix C.2."
       },
       "environment_specified": {
         "applies": true,
         "answer": true,
         "justification": "Appendix D.1 specifies the computing environment: '8 NVIDIA A100 GPUs' accessed via Google Cloud Vertex AI, vLLM for proxy model serving. Specific model versions and HuggingFace model IDs are listed for baselines (protectai/deberta-v3-base-prompt-injection-v2, leolee99/PIGuard)."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. While experimental details are thorough in the appendix, there is no code release or runnable reproduction guide."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 (DoomArena) reports results with confidence intervals (e.g., '73.57 (± 1.32)'). However, the main AgentDojo results in Table 3 report only point estimates without confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests (p-values, t-tests, etc.) are reported. Claims of CausalArmor outperforming baselines are based on comparing point estimates. For DoomArena, 5 random seeds are used but no formal significance tests are applied."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports absolute performance values with baseline context throughout. For example, Table 3 shows ASR dropping from 32.47% (No Defense) to 0.62% (CausalArmor) on Gemini-2.5-Flash with Important Instructions, allowing readers to compute effect sizes. Table 2 shows the CoT masking effect: ASR increases by 1.46% when disabled."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "AgentDojo has 629 injection tasks and DoomArena has 115 scenarios, but no justification is provided for why these sample sizes are sufficient for the claims made. DoomArena uses 5 random seeds but no power analysis is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "DoomArena results in Table 1 report variance across 5 seeds (± notation). However, the main AgentDojo results in Table 3, which form the bulk of the evaluation, report single-run numbers with no variance across runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares against multiple baselines across three categories: Prompting (Repeat Prompt), Trained Classifiers (DeBERTa Detector, PiGuard), and System-based defenses (DRIFT, MELON, PromptArmor). No Defense is also included. Results in Table 3."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include recent 2025 work: DRIFT (Li et al., 2025a), MELON (Zhu et al., 2025), PiGuard (Li et al., 2025b), PromptArmor (Shi et al., 2025b). These represent the current state of the art in IPI defense."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.5 presents ablation studies: (1) CoT masking ablation (Table 2) showing ASR increases from 0.29% to 1.75% without it, and (2) proxy model ablation (Figure 5) varying model families and sizes. Section 5.3 and Figure 4 ablate the threshold parameter tau."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses five metrics: Benign Utility (BU), Benign Latency (BL), Utility under Attack (UA), Latency under Attack (LA), and Attack Success Rate (ASR). All are reported in Table 3."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "Human evaluation is not relevant for this work. The evaluation is on automated agent benchmarks (AgentDojo, DoomArena) where success/failure is objectively determined by whether unauthorized actions are executed."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses established benchmarks (AgentDojo v1.2.2 with its standard evaluation set, DoomArena TauBench subset). Two new attack templates (task_dependency, tool_output_hijack) were introduced alongside the standard template to test robustness to unseen attack vectors."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 breaks down results across three different attack templates (Important Instructions, New Attack 1, New Attack 2) and three backbone models (Gemini-2.5-Flash, Claude-4-Sonnet, Gemini-3-Pro). AgentDojo covers four environments (banking, slack, travel, workspace), though per-environment breakdowns are not shown in the main tables."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Appendix E provides detailed case studies including failure modes. Figures 8 and 9 show the poisoned CoT failure where input sanitization alone fails. Appendix A discusses limitations including split-context attacks and sanitizer effectiveness. The paper also discusses cases where overhead can approach always-on sanitization."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that removing CoT masking degrades security (Table 2), that smaller proxy models (<8B parameters) fail to reliably detect attacks (Figure 5), and that in DoomArena's extreme threat model, utility under attack converges to zero for all methods. Appendix A explicitly discusses where the approach may fail."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims CausalArmor 'matches the security of aggressive defenses while improving explainability and preserving utility and latency.' Table 3 supports this: CausalArmor achieves ASR comparable to or lower than system-based defenses while maintaining BU and BL closer to No Defense. The theoretical claim of 'exponentially small upper bound' is proven in Proposition 4.1 and Appendix B."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses 'causal' in an explicitly operationalized LOO-ablation sense, not a strict structural causal model sense. This is transparently acknowledged in Appendix A: 'our causal statements should be interpreted under this operational influence measure.' Ablation studies (Table 2, Figure 5) use controlled single-variable manipulation to isolate component contributions."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The paper evaluates on specific benchmarks (AgentDojo, DoomArena) with specific models (Gemini-2.5-Flash, Claude-4-Sonnet, Gemini-3-Pro) and states limitations about generalization explicitly. Appendix A notes limitations regarding split-context attacks, sanitizer effectiveness, and the operational notion of causality. The title specifically says 'Indirect Prompt Injection' rather than broader claims."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A discusses multiple alternative explanations and failure modes: that LOO ablation may miss semantic-preserving interventions, that distributed attacks could evade detection, and that sanitizer effectiveness could vary. Section 5.6 explicitly addresses whether theoretical assumptions hold empirically rather than just asserting them."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses marketing names without specific version identifiers: 'Gemini-2.5-flash', 'Gemini-3-Pro', 'Claude-4-Sonnet', 'Claude-4.0-Sonnet'. No snapshot dates or API version strings are provided. The proxy model 'Gemma-3-12B-IT' is a model name without a version date. AgentDojo version (v1.2.2) is specified."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The full sanitization system prompt is provided in Appendix D.1. All three injection templates (Important Instructions, Task Dependency, Tool Output Hijack) are provided verbatim in Appendix C.2 with their placeholders documented."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "The key hyperparameter tau is explicitly varied and its effects analyzed (Figure 4, Figure 6). The proxy model size (Gemma-3-12B-IT) and sanitizer model (Gemini-2.5-flash) are specified. DoomArena uses 5 random seeds. However, temperature/sampling settings for the LLM calls are not reported."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The CausalArmor framework is described in detail: Algorithm 1 (simplified overview) and Algorithm 2 (full version) in Appendix C provide pseudocode. The three-stage process (LOO attribution, selective sanitization, retroactive CoT masking) is fully described with mathematical formalization in Sections 3-4."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C documents the experimental configurations: AgentDojo v1.2.2 with four environments (Section C.1), the three injection templates with full text (Section C.2), DoomArena configuration including the conversational setting and adaptive attacker model (Section C.3). The privileged tool set and proxy model setup are specified."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A is a dedicated 'Limitations and Future Research Directions' section covering four specific limitation areas: operational notion of causality, robustness to split-context attacks, effectiveness of sanitizer, and the gap between theoretical guarantees and practice."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A provides specific threats: (1) LOO ablation may miss attacks requiring semantic-preserving interventions or complex multi-span interactions, (2) 'perfectly distributed' split-context attacks could theoretically evade detection, (3) the sanitizer (Gemini-2.5-flash) is not claimed to be robust against all obfuscations, (4) worst-case overhead can approach always-on sanitization."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly bounds its scope: 'our causal statements should be interpreted under this operational influence measure' (Appendix A), 'it should not be treated as a standalone safety solution under arbitrary distribution shift' (Impact Statement), and recommends using CausalArmor 'as one layer in a defense-in-depth stack.' The theoretical guarantees are explicitly conditional on Assumptions 1-2."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (detailed per-task results, attribution scores, log files) is released. Only aggregated results in tables and figures are provided."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation uses established benchmarks with described configurations. AgentDojo v1.2.2 with 629 injection tasks across four environments is specified (Section 5.1, Appendix C.1). DoomArena's TauBench-Retail with 115 tasks is described (Appendix C.3). Two new injection templates were designed using Gemini-3-Pro."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. The evaluation uses automated benchmarks (AgentDojo, DoomArena)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation pipeline is documented: Appendix C specifies benchmark configurations, Appendix D covers implementation details including computing environment, baseline implementations, and the sanitization prompt. Algorithm 2 provides the full CausalArmor pipeline pseudocode."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the paper. Multiple authors are from Google Cloud AI Research, Google, and Google DeepMind, but no explicit funding disclosure is made."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Google Cloud AI Research, Seoul National University, Google, and Google DeepMind. The first author's student researcher status at Google Cloud AI Research is noted."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "The majority of authors (6 of 8) are affiliated with Google (Google Cloud AI Research, Google, Google DeepMind). The experiments heavily feature Google products (Gemini-2.5-Flash, Gemini-3-Pro, Gemma-3-12B-IT) and use Google Cloud Vertex AI infrastructure. Google has a financial interest in demonstrating effective safety solutions for its AI products. No independence statement is provided."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper. Several authors are Google employees working on Google AI products that are central to the evaluation."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates are stated for any of the models used (Gemini-2.5-Flash, Gemini-3-Pro, Claude-4-Sonnet, Gemma-3-12B-IT). The paper acknowledges contamination risk for standard injection templates and introduces new templates to mitigate this, but does not state cutoff dates."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly discusses contamination risk for the AgentDojo important_instructions template: 'there is a risk that recent frontier models may have already encountered this specific pattern during their safety alignment or instruction tuning phases (data contamination).' This motivated introducing two new attack templates (Appendix C.2)."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": true,
         "justification": "The paper addresses benchmark contamination by (1) acknowledging that standard templates may be contaminated, (2) introducing two novel attack templates (task_dependency, tool_output_hijack) designed by Gemini-3-Pro 'to mimic system-level notifications or fake error traces,' and (3) evaluating on both standard and new templates to test robustness."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants involved. The study uses automated benchmarks."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants involved."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants involved."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants involved."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants involved."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants involved."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants involved."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Latency is reported as a primary metric (Benign Latency, relative to No Defense) across all experiments. Table 3 shows latency multipliers (e.g., CausalArmor BL = 1.30x for Gemini-2.5-Flash). Appendix D.1 discusses the computational overhead of LOO attribution (O(1) sequential calls, O(|S_t|) token compute) and identifies sanitization as the main cost."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": true,
         "justification": "The hardware is specified: '8 NVIDIA A100 GPUs' via Google Cloud Vertex AI (Appendix D.1). The proxy model (Gemma-3-12B-IT) is served via vLLM. Relative latency numbers are reported throughout, providing a practical measure of compute requirements."
       }
     }
   },
   "claims": [
     {
       "claim": "CausalArmor achieves near-zero Attack Success Rate while preserving benign utility and latency close to the No Defense baseline.",
       "evidence": "Table 3 shows CausalArmor achieves ASR of 0.62%, 0.42%, and 0.40% across three attack templates on Gemini-2.5-Flash (vs. 32.47%, 12.01%, 7.06% for No Defense), while maintaining BU of 56.26% (vs. 53.61% No Defense) and BL of 1.30x.",
       "supported": "strong"
     },
     {
       "claim": "CausalArmor resolves the over-defense dilemma by selectively triggering sanitization only when causal attribution indicates dominance by an untrusted span.",
       "evidence": "Figure 4 and Table 3 show CausalArmor achieves security comparable to always-on defenses (DRIFT, MELON) with significantly lower latency. For example, on Claude-4-Sonnet, CausalArmor achieves 0.0% ASR with BL=1.27x, while DRIFT achieves 0.82% ASR with BL=5.43x.",
       "supported": "strong"
     },
     {
       "claim": "Retroactive CoT masking is necessary to prevent poisoned reasoning traces from re-triggering malicious actions after input sanitization.",
       "evidence": "Table 2 shows that removing CoT masking increases average ASR from 0.29% to 1.75% (a 6x increase) while slightly reducing BU from 75.11% to 74.61%.",
       "supported": "moderate"
     },
     {
       "claim": "The probability of IPI attack success is bounded exponentially by the combined benign baseline advantage and sanitization margin (Proposition 4.1).",
       "evidence": "Proposition 4.1 proves Pr(Attack Success) <= T * |Y_mal| * exp(-(beta + gamma)) under Assumptions 1-2. Section 5.6 provides empirical support for both assumptions via benign utility data (Assumption 1) and causal restoration visualization (Assumption 2, Figure 7).",
       "supported": "moderate"
     },
     {
       "claim": "Proxy models (>= 12B parameters) can reliably substitute for frontier models in LOO attribution computation for IPI detection.",
       "evidence": "Figure 5 shows that Gemma-3-12B, Qwen3-14B, and Ministral-14B all achieve ASR close to the oracle (near-zero) when used as proxy models for CausalArmor with Gemini-3-Pro as the backbone. Models below 8B show degraded detection.",
       "supported": "moderate"
     },
     {
       "claim": "CausalArmor is effective against adaptive, privileged attackers in the DoomArena benchmark.",
       "evidence": "Table 1 shows CausalArmor reduces ASR from 88.87% (No Defense) to 3.65% on Gemini-3-Pro in DoomArena's adaptive attack setting, while maintaining BU of 70.96% (vs. 73.57% No Defense). This is comparable to PiGuard (ASR 5.57%) which has significantly worse BU (55.13%).",
       "supported": "strong"
     }
   ],
   "methodology_tags": [
     "benchmark-eval",
     "theoretical"
   ],
   "key_findings": "CausalArmor proposes a selective defense against Indirect Prompt Injection that detects attacks by computing leave-one-out attribution scores to identify when untrusted content dominates the user request's influence on privileged actions. On AgentDojo and DoomArena benchmarks, CausalArmor achieves near-zero Attack Success Rates (comparable to always-on defenses) while preserving benign utility and latency close to undefended agents, effectively resolving the over-defense dilemma. The framework introduces retroactive Chain-of-Thought masking to prevent poisoned reasoning traces from re-triggering attacks, and demonstrates that efficient proxy models (12B+ parameters) can reliably substitute for frontier models in the attribution computation.",
   "red_flags": [
     {
       "flag": "Company evaluating its own products",
       "detail": "Six of eight authors are affiliated with Google (Google Cloud AI Research, Google, Google DeepMind). The evaluation heavily features Google models (Gemini-2.5-Flash, Gemini-3-Pro, Gemma-3-12B-IT) and Google Cloud infrastructure. The proxy model recommended (Gemma-3) is in the same model family as the backbone (Gemini), potentially favoring transferability claims. No conflicts of interest disclosure is provided."
     },
     {
       "flag": "No code release",
       "detail": "Despite detailed algorithmic descriptions, no source code is released for CausalArmor. This limits reproducibility and independent verification of the results, especially given the complexity of the multi-component framework (LOO attribution, sanitization, CoT masking)."
     },
     {
       "flag": "Missing model version specifications",
       "detail": "All models are referenced by marketing names (Gemini-2.5-Flash, Gemini-3-Pro, Claude-4-Sonnet) without snapshot dates or API version identifiers. Given that model behavior changes across versions, this undermines reproducibility."
     },
     {
       "flag": "AgentDojo results lack variance reporting",
       "detail": "The primary evaluation (AgentDojo, Table 3) reports single-run point estimates without error bars, confidence intervals, or multiple seeds. Only the smaller DoomArena evaluation (115 scenarios) uses 5 seeds with variance. Given the stochasticity of LLM-based agents, single-run results may not be stable."
     }
   ],
   "cited_papers": [
     {
       "title": "Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents",
       "authors": ["E. Debenedetti", "J. Zhang", "M. Balunovic", "L. Beurer-Kellner", "M. Fischer", "F. Tramer"],
       "year": 2024,
       "relevance": "Primary evaluation benchmark for IPI defense in tool-using LLM agents."
     },
     {
       "title": "Doomarena: A framework for testing ai agents against evolving security threats",
       "authors": ["L. Boisvert", "M. Bansal", "C. K. R. Evuru"],
       "year": 2025,
       "arxiv_id": "2504.14064",
       "relevance": "Second evaluation benchmark featuring adaptive adversarial attackers against AI agents."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": ["E. Debenedetti", "I. Shumailov", "T. Fan", "J. Hayes", "N. Carlini"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "CaMeL system-based defense against prompt injection through instruction/data channel separation."
     },
     {
       "title": "DRIFT: Dynamic rule-based defense with injection isolation for securing LLM agents",
       "authors": ["H. Li", "X. Liu", "H.-C. Chiu", "D. Li", "N. Zhang", "C. Xiao"],
       "year": 2025,
       "arxiv_id": "2506.12104",
       "relevance": "System-based IPI defense baseline using dynamic rule generation and always-on sanitization."
     },
     {
       "title": "PiGuard: Prompt injection guardrails via mitigating overdefense for free",
       "authors": ["H. Li", "X. Liu", "N. Zhang", "C. Xiao"],
       "year": 2025,
       "relevance": "Trained classifier baseline for prompt injection detection addressing over-defense."
     },
     {
       "title": "Melon: Provable defense against indirect prompt injection attacks in AI agents",
       "authors": ["K. Zhu", "X. Yang", "J. Wang", "W. Guo", "W. Y. Wang"],
       "year": 2025,
       "arxiv_id": "2502.05174",
       "relevance": "System-based defense using policy divergence verification, a key baseline comparison."
     },
     {
       "title": "PromptArmor: Simple yet effective prompt injection defenses",
       "authors": ["T. Shi", "K. Zhu", "Z. Wang"],
       "year": 2025,
       "arxiv_id": "2507.15219",
       "relevance": "Sanitization-based defense baseline for prompt injection in LLM agents."
     },
     {
       "title": "The attacker moves second: Stronger adaptive attacks bypass defenses against LLM jailbreaks and prompt injections",
       "authors": ["M. Nasr", "N. Carlini", "C. Sitawarin"],
       "year": 2025,
       "arxiv_id": "2510.09023",
       "relevance": "Evaluates robustness of defenses against adaptive attacks; referenced for responsible disclosure considerations."
     },
     {
       "title": "Indirect prompt injections: Are firewalls all you need, or stronger benchmarks?",
       "authors": ["R. Bhagwatkar", "K. Kasa", "A. Puri"],
       "year": 2025,
       "arxiv_id": "2510.05244",
       "relevance": "Examines the effectiveness of firewall-based approaches to indirect prompt injection defense."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Q. Zhan", "Z. Liang", "Z. Ying", "D. Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Benchmark for evaluating indirect prompt injection attacks in tool-using LLM agents."
     },
     {
       "title": "Agent Security Bench (ASB): Formalizing and benchmarking attacks and defenses in LLM-based agents",
       "authors": ["H. Zhang", "J. Huang", "K. Mei"],
       "year": 2024,
       "arxiv_id": "2410.02644",
       "relevance": "Formalizes and benchmarks security attacks and defenses for LLM-based agents."
     },
     {
       "title": "ContextCite: Attributing model generation to context",
       "authors": ["B. Cohen-Wang", "H. Shah", "K. Georgiev", "A. Madry"],
       "year": 2024,
       "relevance": "LOO attribution method for context-dependent generation; foundational for CausalArmor's detection approach."
     },
     {
       "title": "Prompt flow integrity to prevent privilege escalation in LLM agents",
       "authors": ["J. Kim", "W. Choi", "B. Lee"],
       "year": 2025,
       "arxiv_id": "2503.15547",
       "relevance": "Defense mechanism against privilege escalation in LLM agents through flow integrity."
     }
   ]
 }