ai-research-survey

scan.json (19746B)

---

 {
   "paper": {
     "title": "CourtGuard: A Local, Multiagent Prompt Injection Classifier",
     "authors": ["Isaac Wu", "Michael Maslowski"],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2510.19844"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "GitHub repository provided: https://github.com/isaacwu2000/CourtGuard with 'full prompts' for all three models."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "All three evaluation datasets (LLMail-Inject, NotInject, Qualifire) are publicly available. LLMail-Inject on HuggingFace, NotInject from Li & Liu 2024, Qualifire on HuggingFace."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or detailed environment setup is mentioned. Only model names are listed without library versions or dependencies."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. The GitHub link is given but no README or reproduction steps are described."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are reported as point estimates (e.g., '95.68%') with no confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims CourtGuard is 'better' at classifying benign prompts and the Direct Detector is 'better' at classifying injections, but no statistical significance tests are used. Comparisons are based solely on raw percentage differences."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 reports percentage differences between CourtGuard and Direct Detector (e.g., '−21.87' on LLMail-Inject), providing magnitude of differences with baseline context."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The 5,000 sample from 460,000+ LLMail-Inject attacks and the 9+10 prompt optimization samples are not justified. No power analysis or rationale for these sizes."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Temperature is set to zero, so results are deterministic for a given input, but no variance across different samples or seeds is reported. Single-run results only."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The Direct Detector (single LLM-as-judge) serves as the primary baseline. Section 5.3 also compares against PromptGuard, LakeraGuard, GPT-4o, InjecGuard, LlamaGuard3, Sentinel, and deberta-v3-base."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include contemporary solutions like Sentinel (June 2025), InjecGuard (2024), and Constitutional Classifiers (2025)."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "No ablation study is performed. The contribution of individual components (defense attorney, prosecution attorney, judge) is not isolated. The Direct Detector comparison is not an ablation since it uses a different prompt structure entirely."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Reports accuracy on multiple datasets, plus precision, recall, and F1 score on the Qualifire benchmark (Tables 1, 3, 4)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation of system outputs. Section 6 provides qualitative analysis by the authors but no systematic human evaluation."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 describes separating 9 prompts from NotInject and 10 from LLMail-Inject for prompt optimization, evaluating on the remaining data."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by dataset (LLMail-Inject, NotInject, Qualifire) and within Qualifire by benign vs. jailbreak prompts (Table 3). Also broken down by model."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 (Qualitative Analysis) discusses specific failure modes, including how the Direct Detector assumes classifications before reasoning and how CourtGuard's deliberative approach reduces true positive rates."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper honestly reports that CourtGuard is 'generally a worse prompt injection detector' than the Direct Detector, with lower recall and F1 scores across most configurations."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims that CourtGuard has lower false positive rate but is 'generally a worse prompt injection detector' are supported by Tables 1-5."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "Section 6 makes causal claims that CourtGuard's lower false positive rate is 'due to' the multiagent framework forcing consideration of both classifications, and that the Direct Detector's assuming approach 'allowed it to more easily detect prompt injections.' These are speculative mechanistic explanations without controlled experiments to isolate the causal factor."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The conclusion suggests 'AI developers in data-sensitive enterprises should consider employing them for LLM applications in contact with sensitive data,' but the evaluation only covers static, single-turn prompt injections on public datasets. The title 'A Local, Multiagent Prompt Injection Classifier' also overstates generality."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper offers one mechanistic explanation (hidden reasoning vs. deliberative reasoning) but does not consider alternatives such as prompt quality differences, model-specific behaviors, or whether the multiagent overhead simply dilutes signal."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model versions are provided: Gemma-3-12b-it, Llama-3.3-8B, Phi-4-mini-instruct. These are versioned model names with size specifications."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states 'full prompts' are available at the GitHub repository. The paper also describes prompts used for each role (defense, prosecution, judge)."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "Only temperature (set to zero) is mentioned. No top-p, max tokens, or other sampling parameters are reported."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 3 and Figure 1 describe the multiagent workflow: two attorney models run in parallel, then a judge model issues final verdict. The roles and flow are clearly described."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A documents how LLMail-Inject subject/body fields were concatenated. Section 4.1 describes the stratified sampling of 5,000 from 460,000+ attacks. Section 4.3 documents prompt optimization split."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 is a dedicated Limitations section discussing inference time, robustness, and the limitation to static single-turn attacks."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 identifies specific threats: only tested on 'public datasets of static, singular prompt injection attacks,' real-world attacks are 'multi-turn' and 'adaptive,' and data contamination risk is mentioned."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 explicitly states that multi-turn conversations and adaptive attacks 'were not tested in this paper' and that 'CourtGuard is not robust enough to fully protect LLM systems.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The raw model outputs and per-prompt classifications are not released. Only aggregate percentages are reported."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes each dataset's origin and purpose. The stratified sampling method for LLMail-Inject is described in Section 4.1."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. Evaluation uses public datasets."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from dataset selection through sampling, prompt optimization split, and evaluation is described across Sections 4.1-4.3 and Appendix A. Failed prompts are noted with counts (Table 1 footnotes)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Section 9 (Acknowledgments) credits 'Non-Trivial Ventures for providing the structured fellowship which made this paper possible.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Both authors are affiliated with Non-Trivial Ventures, listed under their names on the first page."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Non-Trivial Ventures is a fellowship program, not a company selling prompt injection products. They have no apparent financial stake in the results."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper evaluates pre-trained models on public benchmarks but does not state training data cutoff dates for any of the three models."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "Section 7 briefly mentions 'data contamination' as a concern but does not analyze whether the evaluation datasets appeared in the models' training data."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "NotInject and Qualifire were published before these models' likely training cutoffs. The paper mentions contamination risk in Section 7 but does not address it substantively."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper discusses inference time as a limitation (Section 7, 'can reach several seconds') but does not report actual measured latency or cost figures."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No hardware specifications, GPU type, or total compute budget is stated despite running local LLM inference."
       }
     }
   },
   "claims": [
     {
       "claim": "CourtGuard has a lower false positive rate than the Direct Detector",
       "evidence": "Tables 1-3 show CourtGuard scores higher on NotInject (benign prompts) and Qualifire Benign for most model configurations. Mean improvement: +6.36% on NotInject, +3.45% on Qualifire Benign (Table 2).",
       "supported": "moderate"
     },
     {
       "claim": "CourtGuard is generally a worse prompt injection detector than the Direct Detector",
       "evidence": "Table 2 shows mean −19.53% on LLMail-Inject and −25.36% on Qualifire Jailbreak. Table 5 shows mean F1 difference of −9.11%.",
       "supported": "strong"
     },
     {
       "claim": "Both the Direct Detector and CourtGuard using Llama or Phi score above 90% on NotInject, exceeding PromptGuard, LakeraGuard, GPT-4o, and InjecGuard",
       "evidence": "Table 1 shows scores of 90.61-99.09% for Llama and Phi configurations. Comparison to other solutions cited from Li & Liu (2024) in Section 5.3.2.",
       "supported": "moderate"
     },
     {
       "claim": "The Direct Detector's assuming approach allows it to leverage hidden reasoning for prompt injection classification",
       "evidence": "Section 6 provides qualitative examples of the Direct Detector stating classifications early in its response. This is speculative reasoning without controlled experiments.",
       "supported": "weak"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "CourtGuard, a multiagent prompt injection classifier using a court metaphor (defense, prosecution, judge), achieves lower false positive rates than a single-LLM Direct Detector across three local models (Gemma-3-12b-it, Llama-3.3-8B, Phi-4-mini-instruct) on two benchmarks. However, CourtGuard is substantially worse at detecting actual prompt injections, with mean recall dropping 16% on the Qualifire benchmark. The authors attribute this tradeoff to the multiagent structure forcing deliberation over both benign and malicious interpretations, though this explanation is speculative.",
   "red_flags": [
     {
       "flag": "No statistical tests on comparative claims",
       "detail": "All claims of one system being 'better' than another are based on raw percentage comparisons without significance tests, confidence intervals, or any uncertainty quantification."
     },
     {
       "flag": "Prompt optimization on test data subsets",
       "detail": "Prompts were optimized on small subsets (9 from NotInject, 10 from LLMail-Inject) drawn from the same datasets used for evaluation. While the optimized samples were excluded, this still risks overfitting to dataset characteristics."
     },
     {
       "flag": "Speculative causal mechanism",
       "detail": "The explanation that the Direct Detector leverages 'hidden reasoning' and CourtGuard forces 'deliberation' is presented as a likely explanation but is unsupported by controlled experiments or ablations."
     },
     {
       "flag": "No ablation of multiagent components",
       "detail": "The contribution of individual agents (defense, prosecution, judge) is never isolated. It is unclear whether the three-agent structure is necessary or whether a single agent with a modified prompt could achieve similar results."
     }
   ],
   "cited_papers": [
     {
       "title": "Constitutional classifiers: Defending against universal jailbreaks across thousands of hours of red teaming",
       "authors": ["M. Sharma"],
       "year": 2025,
       "arxiv_id": "2501.18837",
       "relevance": "Major LLM safety defense by Anthropic, directly relevant to prompt injection and jailbreak prevention."
     },
     {
       "title": "Adaptive attacks break defenses against indirect prompt injection attacks on LLM agents",
       "authors": ["Q. Zhan", "R. Fang", "H. S. Panchal", "D. Kang"],
       "year": 2025,
       "arxiv_id": "2503.00061",
       "relevance": "Demonstrates adaptive attacks defeating prompt injection defenses, relevant to LLM agent security evaluation."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": ["E. Debenedetti", "I. Shumailov", "T. Fan"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "CaMeL system for architectural prompt injection defense, relevant to agentic AI safety."
     },
     {
       "title": "LLMail-inject: A dataset from a realistic adaptive prompt injection challenge",
       "authors": ["S. Abdelnabi"],
       "year": 2025,
       "arxiv_id": "2506.09956",
       "relevance": "Major prompt injection benchmark dataset from Microsoft, relevant to evaluation methodology."
     },
     {
       "title": "InjecGuard: Benchmarking and mitigating over-defense in prompt injection guardrail models",
       "authors": ["H. Li", "X. Liu"],
       "year": 2024,
       "arxiv_id": "2410.22770",
       "relevance": "Addresses false positive problem in prompt injection detection, directly relevant to LLM safety evaluation."
     },
     {
       "title": "Prompt injection detection and mitigation via AI multi-agent NLP frameworks",
       "authors": ["D. Gosmar", "D. A. Dahl"],
       "year": 2025,
       "arxiv_id": "2503.11517",
       "relevance": "Another multiagent approach to prompt injection defense, directly comparable methodology."
     },
     {
       "title": "Reasoning Models Don't Always Say What They Think",
       "authors": ["Y. Chen"],
       "year": 2025,
       "relevance": "Anthropic research on hidden reasoning in LLMs, cited to explain CourtGuard's mechanism."
     },
     {
       "title": "Backdoored retrievers for prompt injection attacks on retrieval augmented generation of large language models",
       "authors": ["C. Clop", "Y. Teglia"],
       "year": 2024,
       "arxiv_id": "2410.14479",
       "relevance": "RAG-based prompt injection attacks, relevant to LLM security."
     }
   ]
 }