ai-research-survey

scan.json (27920B)

---

 {
   "paper": {
     "title": "CIA+TA Risk Assessment for AI Reasoning Vulnerabilities",
     "authors": ["Yuksel Aydin"],
     "year": 2025,
     "venue": "arXiv preprint",
     "arxiv_id": "2508.15839"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'derived source data and code are released as supplemental material' in Table 2 notes, but no repository URL or archive link is provided anywhere in the paper. Without a working link, this does not satisfy the criterion."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper references 'released logs' and 'supplemental material' multiple times but provides no URL, DOI, or download link for any data. The reader cannot access the data."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications, dependency files, or software versions are mentioned. The only technical detail is 'temperature=0.4; Tokens=500' for decoding parameters, but no broader environment setup is given."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No reproduction instructions are provided. The paper references prior studies [32, 35] for the empirical data but does not describe how to reproduce the risk assessment calculations or experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "The paper reports point estimates (median ASR values, mitigation coefficients) in Table 2 without confidence intervals or error bars. No uncertainty quantification is provided for any of the key metrics."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes comparative claims about architecture-dependent differences (e.g., mitigation coefficients ranging from 0.96 to -1.35) but provides no statistical significance tests. The human study reference [32] mentions 'statistically significant' results but this paper does not report the tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports effect sizes with baseline context throughout: mitigation coefficients (eta values), percentage reductions (e.g., '96% reduction'), and the human study improvement of '+7.87 percentage points overall' with relative gains like '+44.4%' for Ethical Responsibility. Table 2 provides exploitability rates and residual risk scores."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper states '12,180 controlled experiments' and '151 participants' but provides no justification for why these sample sizes were chosen, no power analysis, and no discussion of whether the sample sizes are adequate for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper reports medians and p75 values (kappa) but does not report standard deviations, interquartile ranges, or variance across experimental runs. The paper explicitly notes 'we did not report standard-deviation-per-turn rates' for context poisoning drift."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The experimental design in Section 5.1 describes three conditions: 'Baseline: Normal operation without adversarial inputs', 'Attack: Exposure to crafted adversarial prompts', and 'Mitigated: Attack condition with defensive interventions.' The baseline condition serves as the comparison point."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "While the paper maps to OWASP LLM Top 10 (2025) and MITRE ATLAS, it does not compare its CIA+TA framework or risk assessment methodology against any existing risk assessment approaches or competing frameworks. No prior risk quantification method is used as a baseline."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "The framework has multiple components (CCS-7 taxonomy, risk formulation, CIA+TA extension, CPT) but no ablation study is presented to demonstrate the contribution of individual components. The paper does not test whether removing Trust or Autonomy dimensions affects risk assessment quality."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses multiple metrics across vulnerability categories: DOI validity rates (CCS-1), stance deviation scores (CCS-2), decision accuracy (CCS-3), role adoption rates (CCS-4), and action density (CCS-6). Inherent risk and residual risk scores are also computed."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "Study 1 (Section 5.1) involved 151 human participants who 'interacted with AI generated outputs under controlled manipulation conditions' to validate real-world impact of cognitive vulnerabilities and mitigation effectiveness. However, this was from a prior published study [32]."
       },
       "held_out_test_set": {
         "applies": false,
         "answer": false,
         "justification": "This is a framework/methodology paper, not a machine learning benchmark evaluation. There is no training/test split paradigm applicable here."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 provides a detailed per-vulnerability breakdown across all seven CCS categories, with exploitability, architecture modifier, inherent risk, mitigation effectiveness, and residual risk for each. Table 3 provides deployment criteria by risk band."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper extensively discusses backfire effects where mitigations increased vulnerability, particularly CCS-5 (Source Interference) with eta = -1.35 (135% increase). Section 5.2 discusses these failure modes and their implications."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that verification-focused prompts were counterproductive for CCS-5 (Source Interference), with median eta = -0.32 indicating backfire. It also reports that CCS-1 (Authority Hallucination) had eta = 0.00, meaning mitigations had no measurable effect."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims (CIA+TA framework, quantitative risk methodology, architecture dependence with 96% reduction to 135% amplification, 151 participants, 12,180 trials) are all supported by corresponding sections in the paper. Table 2 confirms the specific numbers."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes causal claims such as 'identical defenses produce effects ranging from 96% reduction to 135% amplification' and 'certain interventions successfully reduce human susceptibility.' These imply causal relationships but the paper does not present the actual experimental design from the prior studies [32, 35] in sufficient detail to assess whether confounds were controlled."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 (Limitations and Generalizability) explicitly bounds the findings: 'seven architectures provide broad representation' but 'new architectures may exhibit different vulnerability patterns,' 'Laboratory conditions...may not fully capture real-world attack sophistication,' and temporal constraints limiting to 'minutes to hours.'"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for its findings. For example, the backfire effects could be due to prompt design issues rather than fundamental architecture properties, but no such alternatives are explored. The limitations section discusses methodological constraints but not alternative interpretations."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'seven distinct AI architectures' and 'instruction-tuned models, base language models, and specialized reasoning systems' but never specifies which models were used, their versions, or even their names. This is a critical omission."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The paper references the 'Think First, Verify Always' protocol and 'verification-focused prompts' but does not provide any actual prompt text. The adversarial prompts and defensive prompts are described only in natural language."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 states 'All experiments used fixed decoding parameters held constant across runs (temperature=0.4; Tokens=500)' which are the key LLM inference parameters."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not use agentic scaffolding. The experiments involve direct prompting of AI models under controlled conditions, not agentic workflows."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not describe how raw experimental outputs were processed into the metrics reported in Table 2. The transformation from raw model responses to ASR scores, stance deviation measurements, and DOI validity assessments is not documented."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 'Limitations and Generalizability' provides a dedicated limitations discussion covering architecture coverage, ecological validity, metric limitations, and temporal constraints."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 discusses specific threats: 'measuring authority hallucination through DOI validity provides objective assessment but may miss subtler forms of confabulation,' 'stance drift measurements assume linear progression, potentially overlooking non-linear manipulation patterns,' and temporal constraints of 'minutes to hours' vs. real attacks over 'days or weeks.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 explicitly states what the results do not show: 'new architectures may exhibit different vulnerability patterns,' 'Adversaries with greater resources...might develop more effective exploitation techniques,' and 'Longer-term attacks operating over days or weeks might exhibit different dynamics.' The paper also notes untested areas like RAG pipelines ('not tested in our AI experiment')."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The paper references 'released logs' and 'supplemental material' but provides no actual link or access mechanism. The reader cannot verify any of the underlying data."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "The data collection is delegated to prior studies [32, 35]. This paper describes the experimental conditions at a high level (baseline/attack/mitigated) but does not describe the actual data collection procedures, instruments, or protocols used."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "For the human study (151 participants), the paper states only that 'Participants, recruited across expertise levels, interacted with AI generated outputs.' No details on recruitment channels, selection criteria, or potential recruitment bias are provided in this paper."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The transformation from 12,180 raw trials to the summary statistics in Table 2 is not documented. How raw outputs were scored, aggregated across architectures, and converted to median ASR and kappa values is not explained."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information or acknowledgments section is present in the paper. The author is listed as 'Independent Researcher' but there is no statement about funding or lack thereof."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The author is listed as 'Independent Researcher' which is their stated affiliation. Since the paper does not evaluate any specific commercial product, there is no product-specific conflict to disclose."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. The absence of any funding statement means the reader cannot determine whether the funder (if any) has a stake in the outcome."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper. The absence of disclosure is not the same as the absence of conflict."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper does not evaluate a pre-trained model's capability on any benchmark. It tests AI systems' vulnerability to adversarial manipulation and defense effectiveness, not their knowledge or benchmark performance."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above: the paper tests adversarial vulnerability patterns and defense effectiveness, not pre-trained model knowledge on benchmarks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above: no benchmark evaluation of model knowledge is conducted. The experiments test reasoning-level vulnerabilities, not benchmark performance."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": true,
         "answer": false,
         "justification": "The human study with 151 participants is from a prior publication [32]. No mention of pre-registration is made in this paper."
       },
       "irb_or_ethics_approval": {
         "applies": true,
         "answer": false,
         "justification": "No IRB or ethics board approval is mentioned for the human study with 151 participants, which is referenced from prior work [32] but still involves human subjects whose data is reported here."
       },
       "demographics_reported": {
         "applies": true,
         "answer": false,
         "justification": "The only demographic information is that participants were 'recruited across expertise levels.' No details on age, gender, geographic distribution, specific expertise levels, or other demographics are provided."
       },
       "inclusion_exclusion_criteria": {
         "applies": true,
         "answer": false,
         "justification": "No inclusion or exclusion criteria are stated for the 151 human participants. The paper provides no information about who was eligible to participate."
       },
       "randomization_described": {
         "applies": true,
         "answer": false,
         "justification": "The paper states participants interacted with AI outputs 'under controlled manipulation conditions' but does not describe how participants were assigned to conditions or whether randomization was used."
       },
       "blinding_described": {
         "applies": true,
         "answer": false,
         "justification": "No blinding information is provided. It is unclear whether participants knew which condition (manipulated vs. non-manipulated) they were in."
       },
       "attrition_reported": {
         "applies": true,
         "answer": false,
         "justification": "No attrition or dropout information is reported. The paper states 151 participants but does not indicate whether all completed the study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper conducted 12,180 AI trials across seven architectures but reports no inference costs, API costs, tokens consumed, or wall-clock time."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No computational budget, hardware details, or total resource expenditure is mentioned for the 12,180 experimental trials."
       }
     }
   },
   "claims": [
     {
       "claim": "Identical defensive measures produce opposite effects across different architectures, with mitigation coefficients ranging from eta = 0.96 (96% reduction) to eta = -1.35 (135% increase in vulnerability).",
       "evidence": "Table 2 shows per-vulnerability mitigation effectiveness medians, and Section 5.2 discusses architecture-dependent patterns. CCS-5 (Source Interference) had median eta = -0.32 (backfire), while CCS-7 (Attention Hijacking) showed eta up to 0.96.",
       "supported": "moderate"
     },
     {
       "claim": "The CIA+TA framework extends the traditional CIA triad with Trust and Autonomy as necessary security dimensions for cognitive AI systems.",
       "evidence": "Section 4 defines Trust (epistemic validation, Section 4.2) and Autonomy (human agency preservation, Section 4.3) with conceptual arguments and references to supporting literature. This is a framework proposal, not an empirically testable claim.",
       "supported": "moderate"
     },
     {
       "claim": "A brief TFVA micro-lesson (3 minutes) produced statistically significant improvements in security-relevant decision-making (+7.87 percentage points overall).",
       "evidence": "Section 4.3 cites reference [32] (a separate paper by the same author) for this claim. The evidence is not presented in this paper; it relies entirely on the prior publication.",
       "supported": "weak"
     },
     {
       "claim": "Seven fundamental vulnerability categories (CCS-7) characterize the cognitive attack surface, validated through 12,180 controlled experiments across seven AI architectures.",
       "evidence": "Section 2.3 defines the seven categories; Table 2 provides risk metrics. However, the experimental details are in reference [35] (a separate paper by the same author). This paper does not present the raw experimental methodology or results in sufficient detail for independent evaluation.",
       "supported": "moderate"
     },
     {
       "claim": "Identity Confusion (CCS-4) shows strong guardrail effectiveness with median eta = 1.00 (residual risk = 0).",
       "evidence": "Table 2 shows CCS-4 with E=0.217, eta=1.00, and residual risk 0.00. Section 5.2 states 'Binary prevention for boundary-based vulnerabilities (CCS-4) achieved eta > 0.9 when properly implemented.'",
       "supported": "moderate"
     }
   ],
   "methodology_tags": ["theoretical", "benchmark-eval"],
   "key_findings": "The paper proposes the CIA+TA framework extending the CIA triad with Trust (epistemic validation) and Autonomy (human agency preservation) for AI systems with reasoning capabilities. Drawing from two prior studies (151 human participants, 12,180 AI trials across seven architectures), it demonstrates strong architecture dependence in vulnerability patterns, with identical mitigations producing effects ranging from 96% reduction to 135% amplification of vulnerabilities. The paper introduces a quantitative risk assessment methodology with empirically-derived coefficients and maps its CCS-7 vulnerability taxonomy to OWASP LLM Top 10 and MITRE ATLAS for operational integration.",
   "red_flags": [
     {
       "flag": "Self-citation dependency",
       "detail": "The paper's empirical foundation rests entirely on two prior publications by the same author ([32] and [35]). No new experiments are conducted, and the prior work is not independently replicated. The reader must trust the prior publications, which are also single-author preprints."
     },
     {
       "flag": "Anonymous architectures",
       "detail": "The paper tests 'seven distinct AI architectures' across 12,180 trials but never names any of them. The reader cannot assess whether the architectures are representative, contemporary, or even real commercial systems vs. toy implementations."
     },
     {
       "flag": "Phantom supplemental material",
       "detail": "The paper repeatedly references 'released logs,' 'supplemental material,' and 'derived source data and code' but provides no URLs, DOIs, or access instructions. The claimed open data cannot be verified."
     },
     {
       "flag": "Missing human study details",
       "detail": "The human study with 151 participants is reported without IRB approval, demographics, randomization procedures, or attrition data. These are critical for assessing the validity of the human validation claims."
     },
     {
       "flag": "No variance or uncertainty quantification",
       "detail": "Despite 12,180 trials, the paper reports only medians and p75 values. No standard deviations, confidence intervals, or statistical tests are provided for any of the key metrics, making it impossible to assess the reliability of the reported effect sizes."
     }
   ],
   "cited_papers": [
     {
       "title": "Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "arxiv_id": "2302.12173",
       "relevance": "Foundational work on indirect prompt injection attacks against LLM-integrated applications, directly relevant to AI security evaluation."
     },
     {
       "title": "Benchmarking and defending against indirect prompt injection attacks on large language models",
       "authors": ["Jingwei Yi", "Yueqi Xie", "Bin Zhu", "Emre Kiciman", "Guangzhong Sun", "Xing Xie", "Fangzhao Wu"],
       "year": 2023,
       "arxiv_id": "2312.14197",
       "relevance": "Benchmark evaluation of indirect prompt injection defenses, directly relevant to LLM security methodology."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Key adversarial attack methodology for aligned LLMs, relevant to AI safety and security evaluation."
     },
     {
       "title": "Towards understanding sycophancy in language models",
       "authors": ["Mrinank Sharma", "Meg Tong", "Tomasz Korbak"],
       "year": 2023,
       "arxiv_id": "2310.13548",
       "relevance": "Studies LLM sycophancy behavior which is a reasoning-level vulnerability relevant to AI safety evaluation methodology."
     },
     {
       "title": "Prompt injection attack against LLM-integrated applications",
       "authors": ["Yi Liu"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Direct prompt injection attack methodology, relevant to LLM security testing and evaluation."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["Xiaogeng Liu"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Automated prompt injection methodology, relevant to scalable LLM security evaluation."
     },
     {
       "title": "EasyJailbreak: A unified framework for jailbreaking large language models",
       "authors": ["Weikang Zhou"],
       "year": 2024,
       "arxiv_id": "2403.12171",
       "relevance": "Unified jailbreak framework relevant to LLM safety and red-teaming evaluation methodology."
     },
     {
       "title": "PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models",
       "authors": ["Wei Zou", "Runpeng Geng", "Binghui Wang", "Jinyuan Jia"],
       "year": 2024,
       "arxiv_id": "2402.07867",
       "relevance": "RAG-specific poisoning attacks, relevant to evaluating security of retrieval-augmented LLM systems."
     },
     {
       "title": "TrojanRAG: Retrieval-augmented generation can be backdoor driver in large language models",
       "authors": ["Pengzhou Cheng", "Yidong Ding", "Tianjie Ju", "Zongru Wu", "Wei Du", "Ping Yi", "Zhuosheng Zhang", "Gongshen Liu"],
       "year": 2024,
       "arxiv_id": "2405.13401",
       "relevance": "Backdoor attacks through RAG pipelines, relevant to LLM supply-chain security evaluation."
     },
     {
       "title": "Sleeper agents: Training deceptive LLMs that persist through safety training",
       "authors": ["Evan Hubinger", "Carson Denison", "Jesse Mu", "Mike Lambert", "Meg Tong", "Monte MacDiarmid", "Daniel M. Ziegler"],
       "year": 2024,
       "arxiv_id": "2401.05566",
       "relevance": "Demonstrates persistent deceptive behaviors in LLMs surviving safety training, relevant to AI alignment and safety evaluation."
     },
     {
       "title": "Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned",
       "authors": ["Deep Ganguli", "Liane Lovitt", "Jackson Kernion", "Amanda Askell", "Yuntao Bai", "Saurav Kadavath"],
       "year": 2022,
       "arxiv_id": "2209.07858",
       "relevance": "Foundational red-teaming methodology for LLMs, directly relevant to AI safety evaluation practices."
     },
     {
       "title": "Constitutional AI: Harmlessness from AI feedback",
       "authors": ["Yuntao Bai", "Andy Jones", "Kamal Ndousse"],
       "year": 2022,
       "arxiv_id": "2212.08073",
       "relevance": "Constitutional AI methodology for aligning LLMs, relevant to AI safety and alignment evaluation."
     },
     {
       "title": "\"Think first, verify always\": Training humans to face AI risks",
       "authors": ["Yuksel Aydin"],
       "year": 2025,
       "arxiv_id": "2508.03714",
       "relevance": "Companion human-subject study providing the human validation data used in this framework, relevant to human factors in AI security."
     },
     {
       "title": "Cognitive cybersecurity for artificial intelligence: Guardrail engineering with CCS-7",
       "authors": ["Yuksel Aydin"],
       "year": 2025,
       "arxiv_id": "2508.10033",
       "relevance": "Companion paper providing the 12,180 AI trial experiments underlying the risk assessment framework, relevant to LLM vulnerability testing methodology."
     }
   ]
 }