ai-research-survey

scan.json (26262B)

---

 {
   "paper": {
     "title": "Decoding Latent Attack Surfaces in LLMs: Prompt Injection via HTML in Web Summarization",
     "authors": ["Ishaan Verma", "Arsheya Yadav"],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2509.05831",
     "doi": "10.48550/arXiv.2509.05831"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "HTML-based prompt injection attacks using non-visible elements (meta tags, opacity-zero divs, HTML comments) can reliably manipulate LLM web summarization outputs. Llama 4 Scout was significantly more susceptible (29.3% injection success) than Gemma 9B IT (15.7%) across 140 injected web pages and 8 injection techniques. Meta tags and opacity-zero divs were the most effective attack vectors, causing both lexical (ROUGE-L) and semantic (SBERT cosine similarity) divergence from clean summaries.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "A GitHub repository is provided in the Appendix: https://github.com/ishaanv1206/Decoding-Latent-Attack-Surfaces-in-LLMs-Prompt-Injection-via-HTML-in-Web-Summarization, containing evaluation scripts, HTML generation code, and model outputs."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The Appendix states the repository includes 'clean/ and injected/: HTML pages used for evaluation' as well as 'gemma.csv, llama.csv: Summarization outputs from each model' and 'metadata.csv'."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or dependency specifications are mentioned in the paper. The paper mentions Python scripts and Playwright but does not specify library versions or environment setup details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "The Appendix lists repository contents but provides no step-by-step reproduction instructions, README with commands, or explicit guidance on how to replicate the experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Only point estimates are reported (e.g., average ROUGE-L of 0.3011, SBERT cosine similarity of 0.6980). No confidence intervals or error bars are provided."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims Llama 4 Scout is 'more susceptible' and certain techniques are 'most effective' based solely on comparing raw numbers. No statistical significance tests (t-tests, chi-squared, etc.) are applied."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "No effect sizes (Cohen's d, odds ratios, etc.) are reported. Only raw success counts and average similarity scores are presented."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The dataset consists of 282 pages (141 clean, 141 injected) but no justification is given for this sample size, and no power analysis is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported. It is unclear whether experiments were run once or multiple times."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Clean page summaries serve as baselines against which injected page summaries are compared. This is the core experimental design (clean vs. injected pairs)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Both evaluated models are current: Llama 4 Scout (Meta, 2025) and Gemma 9B IT (Google, 2024). These are recent, publicly available models."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "While results are broken down by injection technique (Table 2), there is no systematic ablation study removing or modifying individual components of the injection or evaluation pipeline."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three evaluation approaches are used: ROUGE-L (lexical overlap), SBERT cosine similarity (semantic similarity), and manual annotation of injection success."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "Section III states: 'the \"Injection Successful\" outcome was determined through manual inspection' of LLM summary outputs for evidence of adversarial influence."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No train/test split is discussed. The entire dataset is used for evaluation with no hold-out set, though since no model tuning is performed, this is less critical."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 provides per-injection-technique breakdowns of successful injections for both models. Results by injection type are also discussed for ROUGE-L and SBERT scores."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper provides one qualitative example of a successful injection (pirate persona) but does not systematically discuss failure cases — where and why injections failed to influence model outputs."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 shows several injection techniques with zero successes (hidden script: 0 for Gemma; base64, ARIA label, alt text not listed as successful for either model), indicating that these techniques were ineffective."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims that 'a significant proportion of injected pages led to measurable semantic and stylistic shifts,' which is supported by Table 1 showing 29.3% and 15.7% success rates and ROUGE-L/SBERT divergences."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The study uses a controlled experimental design where the only difference between clean and injected pages is the injection payload. This controlled single-variable manipulation is adequate for the causal claims made (injections cause output changes)."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title says 'LLMs' broadly and the abstract refers to 'LLM-driven web pipelines' generally, but only two open-source models are tested. The paper does not bound its claims to these specific models or acknowledge the narrow scope."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations are considered for the observed differences between models or injection techniques. For example, the paper does not consider whether model size, training data composition, or instruction-tuning approach might explain differential susceptibility."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses ROUGE-L and SBERT similarity as proxies for 'injection impact' without discussing whether these metrics fully capture what constitutes a successful or harmful injection in real-world scenarios. The gap between summary divergence and actual harm is not addressed."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are identified as 'Llama 4 Scout' and 'Gemma 9B IT' without exact version identifiers, snapshot dates, or API versions. Reference [19] mentions 'Llama-4-Scout-17B-16E' but this full identifier is not used in the paper itself."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The paper describes the prompt as 'a standardized prompt instructing the LLM to generate a one-paragraph summary of the web page' but does not provide the actual prompt text used."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameters (temperature, top-p, max tokens, etc.) are reported for either model's inference configuration."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The models are prompted directly to generate summaries."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section III describes the full pipeline: HTML page creation with CSS styling, injection technique application, hosting on GitHub Pages, Playwright-based extraction of HTML source and rendered text, and standardized prompting for summarization."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations section. The conclusion mentions 'future work' directions but does not discuss current study limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed anywhere in the paper. There is no consideration of how the synthetic dataset, small sample size, or two-model scope might threaten validity."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper does not identify what the results do NOT show or what settings are excluded from the claims."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The Appendix provides a GitHub repository containing raw HTML files (clean/ and injected/), model outputs (gemma.csv, llama.csv), and metadata (metadata.csv)."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section III describes how 28 content categories were used, how injection techniques were implemented and randomly assigned, how pages were hosted on GitHub Pages, and how Playwright extracted HTML source and rendered text."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. The dataset is entirely synthetic/self-constructed, not drawn from a standard benchmark."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from HTML generation → injection → hosting → Playwright extraction → LLM summarization → metric computation → manual annotation is documented in Section III, though the jump from '28 static HTML pages' to 141 clean + 141 injected is not fully explained."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information is mentioned anywhere in the paper. There is no acknowledgments section disclosing grants or sponsors."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly stated: both authors are from Manipal University Jaipur (Department of Computer Science and Engineering, Department of Data Science and Engineering)."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "This appears to be unfunded university student work. No funding source is mentioned."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is included in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests LLM susceptibility to prompt injection attacks, not model knowledge on a benchmark. It evaluates a security vulnerability rather than model capability, so contamination concerns do not apply."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The study tests defense/vulnerability to prompt injection, not model knowledge. Contamination of the synthetic HTML pages in training data is not the same concern as benchmark contamination."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The study tests prompt injection susceptibility rather than model capability on a knowledge benchmark. Traditional benchmark contamination does not apply."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study. The dataset is synthetic and evaluation is automated (with manual annotation by the authors)."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study evaluates LLM outputs on synthetic web pages."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, API costs, tokens consumed, or wall-clock time is reported for either model's summarization runs."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No information about computational resources, GPU hours, or hardware used is provided."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds. It appears experiments were run once per page per model."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. It is unclear if each page was summarized once or multiple times."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is mentioned. Model inference settings (temperature, etc.) are not even reported, let alone justified through search."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No configuration selection process is described. The paper does not explain how model settings or prompt design were chosen."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Multiple comparisons are made across 8 injection techniques and 2 models, but no statistical tests are performed at all, let alone corrections for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own attack framework and dataset without acknowledging the bias inherent in authors evaluating their own system."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No compute budget information is provided, so performance cannot be contextualized against resource usage."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether its synthetic HTML pages and injection techniques are representative of real-world web content and actual attack scenarios. Construct validity of the benchmark is not addressed."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. Models are prompted directly for summarization."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The synthetic HTML pages were hosted on GitHub Pages and could theoretically appear in model training data. No temporal analysis or discussion of whether models may have seen similar content is provided."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup might inadvertently leak information about injection presence to the model through formatting or structural cues."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Pages are generated from 28 content templates, meaning multiple test pages share structural similarities. This non-independence is not discussed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are applied."
       }
     }
   },
   "claims": [
     {
       "claim": "Llama 4 Scout has a 29.29% injection success rate while Gemma 9B IT has a 15.71% success rate across HTML-based prompt injections.",
       "evidence": "Table 1 in Section IV reports 41/140 successful injections for Llama 4 Scout (29.29%) and 22/140 for Gemma 9B IT (15.71%), determined by manual annotation.",
       "supported": "moderate"
     },
     {
       "claim": "Meta tags, opacity-zero divs, and comment injections are the most effective HTML-based prompt injection techniques.",
       "evidence": "Table 2 shows meta tag (17 Llama, 6 Gemma), comment injection (12, 7), and opacity div (10, 9) as the most successful techniques. Hidden scripts had minimal success (2, 0).",
       "supported": "moderate"
     },
     {
       "claim": "HTML-based prompt injections cause measurable lexical and semantic divergence in LLM summaries.",
       "evidence": "Table 1 reports average ROUGE-L of 0.3011/0.3270 and SBERT cosine similarity of 0.6980/0.6945 between clean and injected summary pairs, indicating divergence from clean outputs.",
       "supported": "moderate"
     },
     {
       "claim": "Conventional sanitization methods are insufficient to mitigate HTML-based injection threats.",
       "evidence": "Stated in the conclusion but supported only by the observation that non-visible HTML elements successfully influenced model outputs. No actual sanitization methods were tested or evaluated.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "Internal numerical inconsistencies",
       "detail": "The paper states '141 clean and 141 injected pages' in Section III but Table 1 shows '140' total injected files. Success rates differ between Table 1 (29.29%, 15.71%) and the discussion text (29.08%, 15.60%). The methodology describes '28 static HTML pages' but the total is 282, with no clear explanation of how 28 templates became 141 instances."
     },
     {
       "flag": "No statistical testing whatsoever",
       "detail": "All comparisons between models and injection techniques are based on raw counts and averages. No significance tests, confidence intervals, or effect sizes are reported, making it impossible to determine whether differences are meaningful or due to chance."
     },
     {
       "flag": "Manual annotation without inter-rater reliability",
       "detail": "Injection success was determined through manual inspection, but there is no mention of multiple annotators, inter-rater agreement metrics (e.g., Cohen's kappa), or annotation guidelines. This is a single-annotator assessment with no reliability check."
     },
     {
       "flag": "Overclaiming from narrow scope",
       "detail": "The paper tests only two open-source models but makes broad claims about 'LLM' vulnerability and 'state-of-the-art models.' No proprietary models (GPT-4, Claude) are tested, and the two models tested are not the most widely deployed in production summarization systems."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper contains no dedicated limitations section and does not acknowledge any threats to validity, which is a significant omission for a security research paper making broad claims."
     },
     {
       "flag": "Small and synthetic dataset",
       "detail": "Only 140 injected pages from 28 content templates were tested, with injection type randomly assigned. The synthetic nature of the pages (generated with lorem-ipsum-style content) limits ecological validity for real-world web summarization scenarios."
     }
   ],
   "cited_papers": [
     {
       "title": "Automatic and Universal Prompt Injection Attacks against Large Language Models",
       "authors": ["X. Liu", "Z. Yu", "Y. Zhang", "N. Zhang", "C. Xiao"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Introduces a universal framework for prompt injection attacks demonstrating vulnerabilities in defense-equipped LLMs."
     },
     {
       "title": "Prompt Injection attack against LLM-integrated Applications",
       "authors": ["Y. Liu", "G. Deng", "Y. Li", "K. Wang", "Z. Wang", "X. Wang", "T. Zhang", "Y. Liu", "H. Wang", "Y. Zheng", "Y. Liu"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Proposes a goal-guided generative method for prompt injection attacks against LLM-integrated applications."
     },
     {
       "title": "Prompt Injection Attacks on Large Language Models in Realistic Settings",
       "authors": ["J. Clusmann", "M. Bontrager", "M. Maldonado"],
       "year": 2024,
       "arxiv_id": "2407.18981",
       "relevance": "Studies prompt injection attacks in realistic deployment settings, including system prompt leakage scenarios."
     },
     {
       "title": "Evaluating and Improving Robustness in Large Language Models: A Survey",
       "authors": ["Y. Yang", "Z. Wang", "H. Liu"],
       "year": 2024,
       "arxiv_id": "2506.11111",
       "relevance": "Survey demonstrating that LLMs vary significantly in resilience across datasets and attack strategies."
     },
     {
       "title": "Retrieval-Augmented In-Context Learning Attacks and Defenses",
       "authors": ["Q. Yu", "T. Huang", "Z. Deng"],
       "year": 2024,
       "arxiv_id": "2402.10928",
       "relevance": "Reveals weaknesses in retrieval-augmented in-context learning when exposed to embedded adversarial prompts."
     },
     {
       "title": "Raze to the Ground: Query-Efficient Adversarial HTML Attacks on Machine-Learning Phishing Webpage Detectors",
       "authors": ["L. Tao", "M. Li", "H. Li"],
       "year": 2023,
       "relevance": "Empirical study showing that HTML-based manipulations can evade conventional sanitization methods in ML systems."
     },
     {
       "title": "A Real-World Case Study of Attacking ChatGPT via Prompt Injection",
       "year": 2024,
       "arxiv_id": "2504.16125",
       "relevance": "Real-world case study of prompt injection attacks against ChatGPT, directly relevant to LLM security evaluation."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Web developers integrating LLMs into summarization pipelines can use these findings to identify and mitigate HTML-based injection vectors."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Confirms the known vulnerability of LLMs to prompt injection through a specific HTML channel; results are expected rather than surprising."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates concrete invisible injection attacks through common HTML elements that could manipulate LLM-powered web tools without user awareness."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no criticism of specific companies or products, purely a vulnerability demonstration study."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code and dataset available on GitHub with HTML pages, evaluation scripts, and model outputs, allowing reproduction."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Tests Meta's Llama 4 and Google's Gemma — recognizable but not top-tier attention magnets like GPT-4 or ChatGPT."
     }
   }
 }