ai-research-survey

scan.json (19395B)

---

 {
   "paper": {
     "title": "Comprehensive Analysis of Machine Learning and Deep Learning models on Prompt Injection Classification using Natural Language Processing techniques",
     "authors": ["Bhavvya Jain", "Pranav Pawar", "Dhruv Gada", "Tanish Patwa", "Pratik Kanani", "Deepali Patil", "Lakshmi Kurup"],
     "year": 2025,
     "venue": "International Research Journal of Multidisciplinary Technovation",
     "doi": "10.54392/irjmt2523"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, code archive, or link to source code is provided anywhere in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The dataset is publicly available from Hugging Face (deepset prompt injection dataset), as stated in Section 3.1."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or detailed environment specification is provided. Libraries like scikit-learn, nltk, and BERT are mentioned but no versions are given."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or runnable scripts are provided."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Only point estimates of accuracy are reported (e.g., 94.74% for RNN). No confidence intervals or error bars are provided."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims RNN outperforms other models but provides no statistical significance tests to support these comparisons."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "Only raw accuracy numbers are reported. No effect sizes (Cohen's d, etc.) or contextual improvement measures beyond raw differences are given."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The dataset size is not stated explicitly in the paper text (only that it was 'sampled out from a larger dataset'), and no justification for the sample size is provided."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or results across multiple runs are reported. All results appear to be from single runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Multiple ML models (LR, SVM, Decision Tree, RF, AdaBoost, XGBoost, KNN, Gradient Boosting) and DL models (CNN, RNN, LSTM, Bi-LSTM) are compared against each other."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "The models used (Logistic Regression, SVM, basic RNN, LSTM) are all classical approaches. No contemporary prompt injection detection methods or transformer-based classifiers are compared against."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "No ablation study is performed. The comparison of vectorization techniques is not an ablation — it compares independent approaches rather than removing components from a single system."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "Only accuracy is reported as the evaluation metric. No F1, precision, recall, or AUC metrics are provided despite this being a binary classification task where class balance matters."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "Human evaluation is not relevant to this binary classification benchmark evaluation."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The dataset was split using train_test_split from scikit-learn (Section 3.4), and results are reported on the test set."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by vectorization technique (TF-IDF, Word2Vec, BoW) and by model in Tables 2 and 3."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No failure cases, error analysis, or qualitative examples of misclassified prompts are discussed."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Word2Vec's lower performance is reported and discussed (Section 4.1), noting its 'static embeddings may not fully capture the context.' KNN with BoW achieving only 54.14% is also reported."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims RNN achieved 94.74% detection rate, which matches Table 3. The claim that deep learning architectures capturing sequential dependencies are effective is supported by the results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes causal claims such as 'RNN's ability to capture sequential dependency helped to detect the pattern' (Section 4.2) without controlled experiments isolating this mechanism."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims to 'enhance the security, integrity, and trustworthiness of AI-driven technologies' in the abstract, but only tests on a single Hugging Face dataset. No discussion of generalization boundaries."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations for the results are discussed. For example, dataset characteristics (keyword-heavy malicious prompts) that could explain why simple BoW matches deep learning are not explored."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "The BERT model is specified as 'bert-base-uncased' (Section 3.5.5/Table 3). The ML models are standard scikit-learn implementations."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "This paper does not use prompting — it trains ML/DL classifiers on text data."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Hyperparameters are reported: 10 epochs, batch size 32, 0.2 validation split, Adam optimizer with learning rate 0.001, Word2Vec dimensionality 100, window size 5, min frequency 1 (Sections 3.4.2, 3.5)."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used in this work."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Preprocessing steps are documented in Section 3.3: removal of special characters via regex, lowercasing, stopword removal, with a worked example."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no limitations or threats-to-validity section. The conclusion briefly mentions future work but does not discuss limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed anywhere in the paper."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper does not discuss what the results do NOT show or what settings were not tested."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The dataset is publicly available on Hugging Face (deepset prompt injection dataset), enabling independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "The paper only states the dataset was 'obtained from Hugging Face datasets' and 'developed by deepset' and 'sampled out from a larger dataset' (Section 3.1). No details on how deepset created it or the sampling process."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants; the data source is a standard public benchmark dataset."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The data pipeline from raw text through preprocessing (special character removal, denoising) to vectorization to model training is documented in Sections 3.2-3.5 with a flowchart (Figure 3)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All authors are listed as affiliated with Dwarkadas J. Sanghvi College of Engineering, Mumbai, India."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funding is disclosed; appears to be unfunded academic work from a single university."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper trains ML/DL classifiers from scratch on a dataset; it does not evaluate a pre-trained model's capability on a benchmark."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — no pre-trained model benchmark evaluation is performed."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — no pre-trained model benchmark evaluation is performed."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or per-example computation time is reported despite using BERT embeddings and multiple model architectures."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No hardware specifications, GPU hours, or total computation budget is stated."
       }
     }
   },
   "claims": [
     {
       "claim": "RNN model achieved the highest overall accuracy of 94.74% for prompt injection detection, outperforming all other ML and DL models.",
       "evidence": "Table 3 shows RNN accuracy of 0.9474 with BERT embeddings, compared to CNN (0.9398), LSTM (0.9248), and Bi-LSTM (0.9245). Table 2 shows best ML accuracy was 93.99%.",
       "supported": "weak"
     },
     {
       "claim": "Deep learning architectures that capture sequential dependencies are highly effective in identifying prompt injection threats.",
       "evidence": "RNN (94.74%) outperformed CNN (93.98%), but LSTM (92.48%) and Bi-LSTM (92.45%) performed worse than CNN, contradicting the sequential dependency narrative. Results from Table 3.",
       "supported": "weak"
     },
     {
       "claim": "TF-IDF and BoW vectorization techniques achieved comparable highest accuracies of 93.99% with Random Forest and Logistic Regression respectively.",
       "evidence": "Table 2 shows Random Forest with TF-IDF at 0.9399 and Logistic Regression with BoW at 0.9399.",
       "supported": "moderate"
     },
     {
       "claim": "Word2Vec showed lower overall performance compared to TF-IDF and BoW for prompt injection classification.",
       "evidence": "Table 2 shows Word2Vec's best accuracy was 84.96% (Gradient Boosting) vs 93.99% for TF-IDF and BoW.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "The paper evaluates 8 ML models with 3 vectorization techniques (TF-IDF, Word2Vec, BoW) and 4 DL models with BERT embeddings for prompt injection classification. RNN with BERT embeddings achieved the highest accuracy at 94.74%, while simple approaches like Logistic Regression with BoW and Random Forest with TF-IDF both achieved 93.99%. The marginal improvement of deep learning over traditional ML (0.75 percentage points) is not statistically validated, and only accuracy is reported as a metric.",
   "red_flags": [
     {
       "flag": "Single metric evaluation",
       "detail": "Only accuracy is reported for a binary classification task. No precision, recall, F1, or AUC-ROC are provided, which is problematic since class distribution is not clearly specified and accuracy alone can be misleading for imbalanced datasets."
     },
     {
       "flag": "No statistical validation of claims",
       "detail": "The RNN's 94.74% vs CNN's 93.98% (0.76pp difference) is presented as a meaningful finding, but no significance tests or confidence intervals are provided. Single-run results without variance make it impossible to determine if this difference is real."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper has no limitations, threats to validity, or discussion of what the results do not show. Dataset size, single-dataset evaluation, and lack of real-world validation are not discussed."
     },
     {
       "flag": "Claims outrun evidence",
       "detail": "The abstract claims the study 'enhances the security, integrity, and trustworthiness of AI-driven technologies, ensuring their safe use across diverse applications' based on a single-dataset classification experiment with no real-world deployment or validation."
     },
     {
       "flag": "Contradictory narrative",
       "detail": "The paper emphasizes sequential dependency modeling as key, but LSTM and Bi-LSTM (designed for long-range sequential dependencies) performed worse than both RNN and CNN, contradicting this interpretation."
     }
   ],
   "cited_papers": [
     {
       "title": "Prompt Injection attack against LLM Integrated Applications",
       "authors": ["Y. Liu", "G. Deng", "Y. Li", "K. Wang", "Z. Wang", "X. Wang", "T. Zhang", "Y. Liu", "H. Wang", "Y. Zheng", "Y. Liu"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Foundational work on prompt injection attacks against LLM-integrated applications using the HOUYI toolkit."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection",
       "authors": ["K. Greshake", "A. Sahar", "M. Shailesh", "E. Christoph", "H. Thorsten", "F. Mario"],
       "year": 2023,
       "relevance": "Key study on indirect prompt injection attacks and LLM vulnerabilities in real-world applications."
     },
     {
       "title": "Benchmarking and defending against indirect prompt injection attacks on large language models",
       "authors": ["J. Yi", "Y. Xie", "B. Zhu", "E. Kiciman", "G. Sun", "X. Xie", "F. Wu"],
       "year": 2023,
       "arxiv_id": "2312.14197",
       "relevance": "Benchmark and defense evaluation for indirect prompt injection attacks on LLMs."
     },
     {
       "title": "Ignore previous prompt: Attack techniques for language models",
       "authors": ["F. Perez", "I. Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Early systematic study of prompt injection attack techniques against language models."
     },
     {
       "title": "Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Q. Zhan", "L. Zhixiang", "Y. Zifan", "K. Daniel"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Benchmark for evaluating LLM agent susceptibility to indirect prompt injection attacks."
     },
     {
       "title": "Optimization-based Prompt Injection Attack to LLM-as-a-Judge",
       "authors": ["J. Shi", "Z. Yuan", "Y. Liu", "Y. Huang", "P. Zhou", "L. Sun", "N. Z. Gong"],
       "year": 2024,
       "relevance": "Advanced prompt injection attack technique targeting LLM-as-a-Judge evaluation systems."
     },
     {
       "title": "Guardian: A multi-tiered defense architecture for thwarting prompt injection attacks on llms",
       "authors": ["P. Rai", "S. Sood", "V. K. Madisetti", "A. Bahga"],
       "year": 2024,
       "relevance": "Multi-layered defense architecture for prompt injection attack prevention on LLMs."
     },
     {
       "title": "Strengthening LLM Trust Boundaries: A Survey of Prompt Injection Attacks",
       "authors": ["S.S. Kumar", "M.L. Cummings", "A. Stimpson"],
       "year": 2024,
       "relevance": "Survey categorizing prompt injection attacks by prompt types, trust boundaries, and required expertise."
     },
     {
       "title": "A new era in llm security: Exploring security concerns in real-world llm-based systems",
       "authors": ["F. Wu", "N. Zhang", "S. Jha", "P. McDaniel", "C. Xiao"],
       "year": 2024,
       "arxiv_id": "2402.18649",
       "relevance": "Comprehensive exploration of security concerns in deployed LLM-based systems."
     }
   ]
 }