ai-research-survey

scan.json (26468B)

---

 {
   "paper": {
     "title": "Cognitive Control Architecture (CCA): A Lifecycle Supervision Framework for Robustly Aligned AI Agents",
     "authors": ["Zhibo Liang", "Tianze Hu", "Zaiye Chen", "Mingjie Tang"],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2512.06716"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL or code archive link is provided anywhere in the paper, footnotes, or appendices. The AgentDojo benchmark link is provided (https://agentdojo.spylab.ai) but this is the evaluation benchmark, not the CCA implementation code."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation is conducted on the publicly available AgentDojo benchmark (Debenedetti et al., 2024), with access link provided at https://agentdojo.spylab.ai. The benchmark's 97 multi-turn tasks are publicly accessible."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or detailed environment specification is provided. The paper mentions using the all-MiniLM-L6-v2 model and specific LLM APIs, but does not provide a comprehensive environment setup with library versions."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. Appendix B describes hyperparameters and Appendix C provides prompts, but there is no README or reproduction section with commands to replicate the experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "The main results in Tables 1-3 report only point estimates. Error bars (mean ± std dev) are reported only in Table 7 (Appendix E.2) for a single attack type on a newer model version (DeepSeek-V3.2), not for the main experimental results."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used. The paper claims CCA outperforms baselines based solely on comparing point estimates (e.g., 0.34% ASR vs 0.16% ASR) without any hypothesis tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports percentage improvements with baseline context throughout, e.g., 'reducing the average ASR from 11.99% to 0.34%, achieving an attack mitigation rate of over 97%' (Section 4.2), and 'BU of 87.63%, representing only a 2.06% drop compared to the undefended baseline of 89.69%'."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is given for using 97 tasks from AgentDojo as the evaluation set. No power analysis or discussion of whether this sample size is sufficient for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Main results (Tables 1-3) appear to be single-run experiments with no variance reported. Standard deviations are provided only in the supplementary Table 7 (5 runs on DeepSeek-V3.2 for one attack type), not for the primary results."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares CCA against four baseline defense methods (Repeat Prompt, Spotlight, DeBERTa classifier, MELON) plus a No Defense baseline, as shown in Table 1."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The baselines include recent methods: MELON (Zhu et al., 2025), Spotlight (Hines et al., 2024), DeBERTa-based detection (ProtectAI, 2024), and Repeat Prompt. These represent the current state of the art in IPI defense."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 and Table 3 present a systematic ablation study removing each of the four score components (S_causal, S_risk, S_prov, S_sem) individually. Additionally, Table 8 ablates the dynamic graph update mechanism, and Figure 4c shows the effect of removing the Intent Graph entirely."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses three evaluation metrics: Attack Success Rate (ASR), Utility Under Attack (UA), and Benign Utility (BU), plus efficiency overhead measured in token usage. These are defined in Section 4.1."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates a defense framework against automated attacks on a benchmark with deterministic code-based evaluation. Human evaluation of system outputs is not relevant here; the AgentDojo benchmark provides ground-truth automated evaluation."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The paper evaluates on the full AgentDojo benchmark (97 tasks) without discussing any held-out split. The hyperparameters (e.g., weight settings, threshold of 0.5) appear to have been tuned on the same benchmark used for evaluation, with no separate validation set mentioned."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by attack type (Direct, Ignore Previous, System Message, Important Messages) in Table 1, by domain (Travel, Workspace, Slack, Banking) in Figure 4b-d, and per component in the ablation study (Table 3)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No qualitative analysis of failure cases is provided. The paper does not discuss the specific scenarios where CCA's ASR was non-zero (e.g., the 0.84% remaining attack success for Important Messages), nor does it analyze why these attacks succeeded."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The ablation study (Table 3) shows that removing the causal score causes ASR to increase nearly tenfold to 4.95% and UA to drop to 66.49%. The static graph ablation (Table 8) shows degradation. These demonstrate where components fail or degrade."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims CCA 'effectively withstands sophisticated attacks' and 'achieves uncompromised security with notable efficiency and robustness.' Table 1 shows 0.34% average ASR with 86.43% UA, and Figure 4b shows 3.3x efficiency improvement over MELON. These results support the abstract's claims, though 'uncompromised security' is slightly hyperbolic given the non-zero ASR."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper's causal claims (e.g., 'CCA achieves security through its two-pillar design') are supported by controlled ablation studies (Table 3) that systematically remove individual components and measure the impact. The ablation design is adequate for these component-level causal claims."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper's title claims a 'Lifecycle Supervision Framework for Robustly Aligned AI Agents' but results are only on the AgentDojo benchmark with specific models (DeepSeek-V3.1, Kimi K2). While Appendix E adds two more models, the paper does not bound its claims to these tested settings. The Limitations section (Section 6) partially addresses this for 'highly open-ended, exploratory scenarios' but does not restrict the generalization claims in the title and abstract."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for its results. For example, it does not consider whether the performance gains are due to the specific characteristics of AgentDojo tasks, whether the deterministic evaluation favors certain defense types, or whether the LLM used for adjudication contributes differently across attack types."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses 'DeepSeek-V3.1' and 'Kimi K2' but does not provide specific API snapshot dates or version identifiers. 'DeepSeek-V3.1' is a marketing name without a snapshot date. Similarly, GPT-4.1-mini and Qwen3-Next-80B in the appendix lack specific version identifiers."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C provides the full prompt text for both the Intent Graph Generation and the Adjudicator. These are complete prompts with all sections, not just natural language descriptions. The prompts include specific formatting rules, scoring guides, and output schemas."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Appendix B.1 reports: temperature 0.0, alignment score weights (w_sem=0.1, w_causal=0.7, w_prov=0.1, w_risk=0.1), decision threshold of 0.5. Appendix B.2 provides ablation weight configurations. Table 5 provides all Srisk values."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The paper describes the CCA scaffolding in detail: Algorithm 1 shows the full execution loop, Section 3.2 describes the Intent Graph generation and runtime monitoring, Section 3.3 describes the Tiered Adjudicator, and the two-layer architecture is fully specified with formulas (Equations 1-4)."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not describe how the AgentDojo benchmark tasks were selected or filtered for evaluation. It states '97 multi-turn tasks' but does not discuss whether any tasks were excluded or how the attack scenarios were instantiated across these tasks."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 is a dedicated 'Limitations' section that discusses specific limitations of the framework."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section identifies specific threats: (1) 'efficacy of our proactive defense is highest for tasks that are clearly decomposable into an Intent Graph; its utility may be reduced in highly open-ended, exploratory scenarios,' and (2) 'the Inherent Action Risk Score (Srisk) is currently static and parameter-agnostic, which prevents a more nuanced, context-aware assessment.' These are specific to this system."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The Limitations section mentions two specific weaknesses but does not explicitly state what the results do NOT show or which settings are excluded from the claims. The paper does not state, for example, that results may not generalize beyond the AgentDojo benchmark, or that the approach has not been tested against adaptive attackers who know about CCA."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (individual task outcomes, per-task scores, adjudicator decisions) is made available. Only aggregate metrics are reported."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "The data collection procedure is described: experiments are run on AgentDojo benchmark with 97 multi-turn tasks across four domains, using four specific attack types (Section 4.1). The benchmark uses deterministic code evaluation."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. The evaluation uses the publicly available AgentDojo benchmark, which is a standard benchmark."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not document the full pipeline from raw benchmark execution to final reported metrics. It does not explain how the aggregate ASR, UA, and BU percentages are computed from individual task outcomes, or whether any tasks were excluded from the aggregation."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the paper. There is no mention of grants, corporate sponsors, or funding agencies."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed on the first page: Zhibo Liang and Mingjie Tang are affiliated with Sichuan University. Tianze Hu and Zaiye Chen have email addresses listed but no explicit institutional affiliation."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. The absence of a funding disclosure is itself a concern — the paper should state whether the work was funded or unfunded."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates a defense framework against indirect prompt injection attacks, not model capability on a benchmark. The LLMs are used as components of the system (agent and adjudicator), not evaluated on knowledge benchmarks. Contamination is not relevant to the security evaluation."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the paper tests a defense architecture, not model knowledge on benchmark tasks. The evaluation measures whether attacks succeed or are blocked, which is not subject to training data contamination."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the evaluation measures defense effectiveness against injected attacks, not model capability. The benchmark tasks are tools for testing security, not knowledge."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Figure 4b reports average token usage per task for CCA vs MELON across all domains (CCA: 3857 tokens, MELON: 12772 tokens). Figure 4d reports Intent Graph generation cost (~1956 tokens). While not in dollar amounts, token counts are a meaningful cost measure."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. The paper does not report total API spend, wall-clock time for the full evaluation, or total tokens consumed across all experiments."
       }
     }
   },
   "claims": [
     {
       "claim": "CCA reduces the average Attack Success Rate from 11.99% (no defense) to 0.34%, achieving over 97% attack mitigation.",
       "evidence": "Table 1, Section 4.2: Average ASR across four attack types drops from 11.99% to 0.34% with CCA on DeepSeek-V3.1.",
       "supported": "moderate"
     },
     {
       "claim": "CCA maintains the highest Utility Under Attack (86.43%) among all defense methods while achieving near-zero ASR.",
       "evidence": "Table 1: CCA achieves 86.43% UA vs MELON's 43.76% UA, with comparable security (0.34% vs 0.16% ASR).",
       "supported": "moderate"
     },
     {
       "claim": "CCA is approximately 3.3x more token-efficient than MELON.",
       "evidence": "Figure 4b: CCA uses 3857 average tokens per task vs MELON's 12772, a 3.3x improvement across all scenarios.",
       "supported": "moderate"
     },
     {
       "claim": "The CCA framework is model-agnostic, demonstrating effectiveness with Kimi K2 (reducing ASR from 29.50% to 0.53%).",
       "evidence": "Table 2: With Kimi K2, CCA reduces ASR from 29.50% to 0.53% while improving UA from 74.18% to 82.51%.",
       "supported": "moderate"
     },
     {
       "claim": "Causal analysis (S_causal) is the foundational component; removing it increases ASR nearly tenfold to 4.95%.",
       "evidence": "Table 3: w/o S_causal shows ASR of 4.95% (vs 0.53% full CCA) and UA of 66.49% (vs 82.51%).",
       "supported": "moderate"
     },
     {
       "claim": "CCA's main findings are stable across repeated runs, with ASR of 0.72 ± 0.14% on DeepSeek-V3.2.",
       "evidence": "Table 7, Appendix E.2: 5-run evaluation on DeepSeek-V3.2 gives ASR 0.72 ± 0.14%, UA 86.47 ± 0.82%.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "The Cognitive Control Architecture (CCA) proposes a dual-layer defense against indirect prompt injection attacks on LLM agents: a proactive Intent Graph for control-flow and data-flow integrity checking, and a reactive Tiered Adjudicator using a multi-faceted Intent Alignment Score. On the AgentDojo benchmark, CCA achieves 0.34% average attack success rate while maintaining 86.43% utility under attack, substantially outperforming MELON (0.16% ASR but only 43.76% UA) in the security-functionality tradeoff. The approach is also 3.3x more token-efficient than MELON and generalizes across multiple agent models (DeepSeek-V3.1, Kimi K2, Qwen3-Next-80B, GPT-4.1-mini).",
   "red_flags": [
     {
       "flag": "Main results lack error bars",
       "detail": "The primary results in Tables 1-3 are single-run experiments without confidence intervals or standard deviations. Error bars are only provided in Appendix E.2 for one attack type on a different model version (DeepSeek-V3.2), not for the main comparison. Small differences between methods (e.g., 0.34% vs 0.16% ASR) could be within noise."
     },
     {
       "flag": "No failure case analysis",
       "detail": "CCA achieves non-zero ASR in several conditions (e.g., 0.84% on Important Messages, 0.42% on Direct) but the paper never analyzes why these attacks succeeded. Understanding failure modes is critical for a security framework."
     },
     {
       "flag": "Threshold selection not validated",
       "detail": "The decision threshold of 0.5 for the alignment score and the weight configuration (w_causal=0.7) appear to have been chosen without a documented tuning process or sensitivity analysis. The same benchmark used for reporting may have been used for tuning."
     },
     {
       "flag": "No code release",
       "detail": "For a security framework paper, the absence of released implementation code prevents independent verification of the results and limits reproducibility."
     },
     {
       "flag": "Unfair MELON comparison in cross-model experiments",
       "detail": "In Table 7, the MELON baseline is cited from the original paper on DeepSeek-V3.1, while CCA is evaluated on DeepSeek-V3.2. This is an apples-to-oranges comparison that the paper acknowledges but does not resolve."
     }
   ],
   "cited_papers": [
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "The primary evaluation benchmark used in this paper; a dynamic, stateful environment for testing LLM agent security."
     },
     {
       "title": "MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents",
       "authors": ["Kaijie Zhu", "Xianjun Yang", "Jindong Wang", "Wenbo Guo", "William Yang Wang"],
       "year": 2025,
       "arxiv_id": "2502.05174",
       "relevance": "State-of-the-art runtime verification defense against IPI attacks; the primary comparison baseline in this paper."
     },
     {
       "title": "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Seminal work on indirect prompt injection attacks against LLM-integrated applications."
     },
     {
       "title": "IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents",
       "authors": ["Hengyu An", "Jinghuai Zhang", "Tianyu Du", "Chunyi Zhou", "Qingming Li", "Tao Lin", "Shouling Ji"],
       "year": 2025,
       "arxiv_id": "2508.15310",
       "relevance": "Control-flow integrity defense using tool-dependency graphs; closely related approach that CCA builds upon."
     },
     {
       "title": "The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents",
       "authors": ["Feiran Jia", "Tong Wu", "Xin Qin", "Anna Squicciarini"],
       "year": 2024,
       "arxiv_id": "2412.16682",
       "relevance": "Runtime task alignment defense against IPI attacks in LLM agents."
     },
     {
       "title": "IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems",
       "authors": ["Yuhao Wu", "Franziska Roesner", "Tadayoshi Kohno", "Ning Zhang", "Umar Iqbal"],
       "year": 2024,
       "arxiv_id": "2403.04960",
       "relevance": "System-level isolation defense for LLM agents using sandboxing, representing the architectural defense paradigm."
     },
     {
       "title": "Defending Against Indirect Prompt Injection Attacks with Spotlighting",
       "authors": ["Keegan Hines", "Gary Lopez", "Matthew Hall", "Federico Zarfati", "Yonatan Zunger", "Emre Kiciman"],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Prompt engineering defense against IPI; one of the baseline methods in CCA's evaluation."
     },
     {
       "title": "Formalizing and Benchmarking Prompt Injection Attacks and Defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Formalizes prompt injection attacks and defenses; provides taxonomy used in understanding attack evolution."
     },
     {
       "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions",
       "authors": ["Eric Wallace", "Kai Xiao", "Reimar Leike", "Lilian Weng", "Johannes Heidecke", "Alex Beutel"],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Training-time approach to making LLMs distinguish between trusted and untrusted instructions."
     },
     {
       "title": "Agent-SafetyBench: Evaluating the Safety of LLM Agents",
       "authors": ["Zhexin Zhang", "Shiyao Cui", "Yida Lu", "Jingzhuo Zhou", "Junxiao Yang", "Hongning Wang", "Minlie Huang"],
       "year": 2024,
       "arxiv_id": "2412.14470",
       "relevance": "Benchmark for evaluating LLM agent safety, relevant to the broader agent security evaluation landscape."
     },
     {
       "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Introduces GCG adversarial attack method; demonstrates optimization-based attacks that training-time defenses struggle against."
     },
     {
       "title": "ReAct: Synergizing Reasoning and Acting in Language Models",
       "authors": ["Shunyu Yao", "Jeffrey Zhao", "Dian Yu", "Nan Du", "Izhak Shafran", "Karthik Narasimhan", "Yuan Cao"],
       "year": 2023,
       "relevance": "Foundational agent paradigm (reasoning + acting) that CCA's defense architecture builds upon."
     },
     {
       "title": "StruQ: Defending Against Prompt Injection with Structured Queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2025,
       "relevance": "Structural defense against prompt injection using structured queries; represents the structured defense paradigm."
     }
   ]
 }