ai-research-survey

scan.json (29949B)

---

 {
   "paper": {
     "title": "Defending Against Indirect Prompt Injection Attacks With Spotlighting",
     "authors": [
       "Keegan Hines",
       "Gary Lopez",
       "Matthew Hall",
       "Federico Zarfati",
       "Yonatan Zunger",
       "Emre Kıcıman"
     ],
     "year": 2024,
     "venue": "CAMLIS",
     "arxiv_id": "2403.14720",
     "doi": "10.48550/arXiv.2403.14720"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Spotlighting — a family of prompt engineering techniques (delimiting, datamarking, encoding) — reduces indirect prompt injection attack success rate from >50% to <2% on GPT-family models. Datamarking (interleaving special tokens in input text) has no detrimental impact on NLP task performance (SQuAD, IMDB, SuperGLUE), while encoding (base64) achieves the lowest ASR but requires high-capacity models like GPT-4 to maintain task performance. The paper draws an analogy to in-band vs. out-of-band signaling in telecommunications, arguing that the fundamental fix requires a multi-channel architecture for LLMs.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository URL, GitHub link, or archive is provided anywhere in the paper. The techniques are described but no implementation is released."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The synthetic corpus of 1000 attack documents is not released. Standard NLP benchmarks (SQuAD, IMDB, SuperGLUE) are public, but the custom attack dataset central to the evaluation is not available."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications, requirements files, or dependency information is provided. The paper mentions model names but no software environment details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are included. The system prompts are provided as examples, but there are no scripts, commands, or procedures to replicate the full experimental pipeline."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are reported as point estimates (e.g., 'ASR is reduced to 3.10%', 'ASR is reduced to 0.0%'). No confidence intervals, error bars, or uncertainty ranges appear in figures or text."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "Comparative claims like 'datamarking leads a strong reduction in ASR' and 'encoding approach outperforms datamarking' are made without any statistical significance tests — only raw percentage comparisons."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are reported with baseline context throughout: 'ASR is reduced from approximately 50% to below 3%' (Section 5.1), 'ASR is reduced to 0.0%' from ~40% (Figure 4), and NLP task performance with/without transformation (Figure 7). The reader can assess magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The corpus size of 1000 documents is stated (Section 4.2) but never justified. No power analysis or rationale for why 1000 is sufficient."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or multiple-run results are reported. All experiments appear to be single-run. The paper mentions examining 'the effect of temperature on XPIA susceptibility' but provides no data on run-to-run variance."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Multiple baselines are included: no defense (Figure 1), instruction-only defense (Figure 2), delimiting (Figure 3), and progressive spotlighting variants. The progression from no defense through each technique provides a clear comparison structure."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "The baselines are all ablation-like variants of the authors' own approach (no defense, instructions-only, delimiting) or trivial baselines. No comparison against other published XPIA defense methods from the literature, despite citing prior work [2] that explored defense approaches."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The three spotlighting variants (delimiting → datamarking → encoding) function as a progressive ablation, showing the incremental benefit of each transformation. The instruction-only condition isolates the effect of prompt instructions from the spotlighting transformations."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Two distinct metric families are used: Attack Success Rate (ASR) for defense effectiveness, and NLP task performance across four benchmarks (SQuAD Q&A accuracy, IMDB Sentiment, SuperGLUE WIC, SuperGLUE BoolQ) for task impact."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is performed. Attack success is determined by automated keyword detection. NLP task performance is measured by automated benchmark metrics only."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "For the primary ASR evaluation on the 1000-document synthetic corpus, there is no mention of held-out test splits. The defense techniques are hand-designed rather than tuned, but no explicit separation of development and evaluation data is described."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by model (text-davinci-003, GPT-3.5-Turbo, GPT-4) and by task (summarization, Q&A) across Figures 1-6. NLP task impact is shown per-benchmark (SQuAD, IMDB, WIC, BoolQ) in Figures 7-8."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The appendix (Section 8.1) discusses gray-area cases where the model notices but doesn't fall for the attack. Section 5.2 shows encoding degrades GPT-3.5-Turbo performance significantly. Section 5.4 discusses adversary scenarios where defenses could be subverted."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results are reported: delimiting provides only modest improvement and is not recommended (Section 5.1); encoding severely degrades GPT-3.5-Turbo task performance (Figure 8, bottom); few-shot examples risk overfitting and label leakage (Section 8.2)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'spotlighting reduces the attack success rate from greater than 50% to below 2%' — this is supported by Figures 4-6 showing ASR reductions to 0-3% across models and tasks. The claim of 'minimal impact on task efficacy' is supported by Figure 7 for datamarking, though encoding impacts GPT-3.5 (acknowledged in Section 5.2)."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The causal claim 'spotlighting reduces ASR' is supported by controlled single-variable manipulation: the same model, same dataset, same task, with only the spotlighting transformation varying. This is adequate causal design for the claim."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title 'Defending Against Indirect Prompt Injection Attacks With Spotlighting' is generic, but experiments use only GPT-family models and only synthetic keyword payload attacks. The abstract says 'Using GPT-family models' but broader claims about XPIA defense are not bounded to this narrow attack type."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for why spotlighting works beyond the telecommunications analogy (Section 6). It does not consider whether results are specific to keyword attacks, whether the attack corpus has distributional properties that favor the defense, or other confounds."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The appendix (Section 8.1) explicitly discusses the gap between the keyword-detection proxy (ASR) and actual attack success, distinguishing strict ASR from 'Affected Success Rate' (AffSR) and providing examples of gray-area cases. The proxy nature of the measurement is acknowledged."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 specifies: 'text-davinci-003, GPT-3.5Turbo (June 2023 version) and GPT-4 (June 2023 version).' Versions are identified by snapshot date."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full system prompt text is provided for delimiting (Section 3.2), datamarking (Section 3.3), encoding (Section 3.4), instruction-only defense (Section 4.2), and few-shot (Section 8.2). These are actual prompt templates with clear placeholder notation."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 states: 'All experiments are conducted with temperature set to 1.0. We examined the effect of temperature on XPIA susceptibility and found no notable impact.' Temperature is the critical sampling parameter for these experiments."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The approach is direct prompt engineering applied to single LLM calls."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'we generated a synthetic dataset of 1000 documents that contain prompt injection attacks' (Section 4.2) with 'variations on a simple keyword payload attack' but provides no details on the generation procedure, templates used, document content, or variation methodology."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated 'Limitations' or 'Threats to Validity' section. Limitation-like content is scattered across Section 5.3 (recommendations), Section 5.4 (adversary considerations), Section 6 (discussion), and the appendix, but no consolidated section exists."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Specific threats are discussed throughout: adversaries can subvert delimiting if they know the system prompt (Section 5.4); encoding severely degrades weaker models (Section 5.2); few-shot examples risk overfitting to known attack patterns (Section 8.2); attacks without whitespace could bypass datamarking (Section 5.4)."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what was NOT tested. It doesn't bound claims to keyword attacks only, doesn't acknowledge the absence of testing against sophisticated/adaptive attacks, and doesn't specify which attack types or real-world scenarios are excluded from the evaluation."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Neither the 1000-document attack corpus nor the raw model responses are available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "The attack corpus generation is described only as 'variations on a simple keyword payload attack' with the keyword 'canary' (Section 4.2). No details on how the 1000 documents were generated, what variation strategies were used, or what the non-attack document content looks like."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data is synthetic and from standard benchmarks."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline from document generation through spotlighting transformation to ASR measurement is described conceptually but not in reproducible detail. The attack document generation process, exact transformation implementations, and response classification logic are not documented."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding acknowledgment section. All authors are from Microsoft, which implies corporate funding, but no explicit funding disclosure is provided."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All authors are listed with 'Microsoft' affiliation on the first page. The affiliation is clear and prominent."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Microsoft has a major partnership with OpenAI and sells Azure OpenAI services. Effective prompt injection defenses increase the commercial viability of Microsoft's LLM products. The employer has a direct financial interest in showing these defenses work."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is included in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests defense techniques against prompt injection, not model knowledge or capability on benchmarks. The benchmark evaluations (SQuAD, IMDB, SuperGLUE) serve only to verify the defense doesn't degrade performance; the comparison is within-model (with vs. without spotlighting), making training contamination equally affecting both conditions."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates defense effectiveness, not model capability. Any benchmark contamination would affect both the with-spotlighting and without-spotlighting conditions equally, making it irrelevant to the claims."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defenses rather than model knowledge. The primary evaluation uses a custom synthetic attack corpus, and NLP benchmarks are used only for differential comparison."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All experiments are automated with synthetic data and benchmark datasets."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference costs, API costs, token consumption, or latency overhead is reported for any of the spotlighting techniques despite the encoding approach requiring the model to decode base64, which may incur additional compute."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, API spend, or hardware details are provided despite running experiments across 3 models, multiple tasks, and 1000-document corpora."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. All results appear to be from single runs despite using temperature=1.0, which introduces stochastic variation."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. Results are presented as single point estimates with no indication of how many times each experiment was conducted."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. The choice of marking tokens, prompt phrasing, and encoding method appear to be hand-selected without documenting what alternatives were tried or how selections were made."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 provides justified recommendations: encoding is recommended for high-capacity models based on lowest ASR (Figure 6), datamarking for general use based on strong ASR reduction without task impact (Figures 4, 7). The progression of results across configurations justifies the selection."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical significance tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own proposed techniques without acknowledging the potential bias of self-evaluation. No independent evaluation or acknowledgment of author-evaluation bias is provided."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of compute differences between spotlighting approaches. Encoding requires the model to decode base64, which uses more tokens and compute, but this cost is never quantified or compared against the defense benefit."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 and Appendix 8.1 discuss construct validity of the ASR metric, distinguishing strict ASR from Affected Success Rate (AffSR), providing concrete examples of gray-area cases, and explaining why keyword detection may not capture all attack outcomes."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. Experiments are direct prompt engineering on single LLM calls."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of temporal leakage. The NLP benchmarks (SQuAD 2016, IMDB 2011, SuperGLUE 2020) predate the models' training, but this is not discussed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. The keyword 'canary' in attack payloads could be a distinctive signal that doesn't generalize to real attacks."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of independence. The 1000 attack documents are 'variations on a simple keyword payload attack' — the degree of similarity between documents and whether results are inflated by non-independence is not addressed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are applied. No canary strings, membership inference, or decontamination pipelines are used."
       }
     }
   },
   "claims": [
     {
       "claim": "Spotlighting reduces attack success rate from greater than 50% to below 2% with minimal impact on task efficacy.",
       "evidence": "Figures 4-6 show ASR reductions across models and tasks: datamarking reduces GPT-3.5-Turbo ASR to 3.10% (summarization) and 8.0% (Q&A); encoding reduces ASR to 0.0% (summarization) and 1.8% (Q&A). Figure 7 shows no detrimental NLP task impact for datamarking.",
       "supported": "moderate"
     },
     {
       "claim": "Datamarking has no detrimental impact on underlying NLP tasks.",
       "evidence": "Figure 7 shows GPT-3.5-Turbo performance across SQuAD Q&A, IMDB Sentiment, SuperGLUE WIC, and SuperGLUE BoolQ is essentially unchanged with datamarking applied.",
       "supported": "moderate"
     },
     {
       "claim": "Encoding is the most effective spotlighting method but requires high-capacity models.",
       "evidence": "Figure 6 shows encoding achieves 0.0% ASR in summarization. Figure 8 shows GPT-4 handles encoding well across benchmarks, while GPT-3.5-Turbo suffers significant task performance degradation with encoding.",
       "supported": "strong"
     },
     {
       "claim": "Delimiting has only modest effects on reducing ASR and is not recommended.",
       "evidence": "Figure 3 shows delimiting reduces GPT-3.5-Turbo ASR by roughly half (from ~60% to ~30%), which is significantly less effective than datamarking or encoding.",
       "supported": "strong"
     },
     {
       "claim": "Few-shot learning can reduce ASR to below 5% but should be used with caution due to overfitting risks.",
       "evidence": "Figure 9 and Appendix 8.2 show ASR reduced below 5% with few-shot examples, but the authors warn about correlation between few-shot examples and test data, calling it 'a contemporary version of the classic overfitting problem.'",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Company evaluating its own product ecosystem",
       "detail": "All authors are from Microsoft, which has a major commercial partnership with OpenAI. Effective prompt injection defenses directly increase the commercial viability of Microsoft's Azure OpenAI offerings. No conflict of interest statement is included."
     },
     {
       "flag": "Only synthetic keyword attacks tested",
       "detail": "The entire ASR evaluation uses a single attack type: keyword payload attacks where the model is urged to output 'canary'. No sophisticated, adaptive, or semantically diverse attacks are tested. Real-world XPIA would involve far more varied and subtle attack payloads, making the reported near-zero ASR potentially misleading."
     },
     {
       "flag": "No error bars or variance on any result",
       "detail": "All experiments use temperature=1.0 (introducing stochastic variation) but report only single-point estimates. With 1000 attack documents and stochastic decoding, the variance could be substantial, especially for small ASR values near 0%."
     },
     {
       "flag": "Attack corpus generation not documented",
       "detail": "The 1000-document synthetic attack corpus is described only as 'variations on a simple keyword payload attack' with no details on the generation procedure, diversity of variations, or document content. This makes it impossible to assess whether the attack corpus provides a meaningful evaluation."
     }
   ],
   "cited_papers": [
     {
       "title": "Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models",
       "authors": ["J. Yi", "Y. Xie", "B. Zhu", "K. Hines", "E. Kiciman", "G. Sun", "X. Xie", "F. Wu"],
       "year": 2023,
       "arxiv_id": "2312.14197",
       "relevance": "Direct predecessor to this work — establishes the XPIA benchmark and explores early defense techniques including delimiting."
     },
     {
       "title": "More than you've asked for: A Comprehensive Analysis of Novel Prompt Injection Threats to Application-Integrated Large Language Models",
       "authors": ["K. Greshake", "S. Abdelnabi", "S. Mishra", "C. Endres", "T. Holz", "M. Fritz"],
       "year": 2023,
       "arxiv_id": "2302.12173",
       "relevance": "Foundational analysis of indirect prompt injection threats in LLM applications, establishing the XPIA threat model."
     },
     {
       "title": "GPT-4 Technical Report",
       "authors": ["OpenAI"],
       "year": 2023,
       "arxiv_id": "2303.08774",
       "relevance": "Technical report for GPT-4, one of the primary models evaluated in this paper's experiments."
     },
     {
       "title": "Llama 2: Open foundation and fine-tuned chat models",
       "authors": ["H. Touvron", "L. Martin", "K. Stone"],
       "year": 2023,
       "arxiv_id": "2307.09288",
       "relevance": "Major open-source LLM relevant to understanding the landscape of models vulnerable to prompt injection."
     },
     {
       "title": "Constitutional AI: Harmlessness from AI feedback",
       "authors": ["Y. Bai", "S. Kadavath", "S. Kundu"],
       "year": 2022,
       "arxiv_id": "2212.08073",
       "relevance": "Alignment training approach relevant to understanding model safety and instruction-following behavior exploited by prompt injection."
     },
     {
       "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
       "authors": ["A. Zou", "Z. Wang", "N. Carlini", "M. Nasr", "J. Z. Kolter", "M. Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Demonstrates adversarial attacks on aligned LLMs, including token-based attacks referenced in the UPIA vs XPIA distinction."
     },
     {
       "title": "Chain-of-Thought Prompting Elicits Reasoning in Large Language Models",
       "authors": ["J. Wei", "X. Wang", "D. Schuurmans"],
       "year": 2023,
       "arxiv_id": "2201.11903",
       "relevance": "Foundational prompting technique that enables the kind of instruction-following behavior exploited by prompt injection attacks."
     },
     {
       "title": "Language models are few-shot learners",
       "authors": ["T. B. Brown", "B. Mann", "N. Ryder"],
       "year": 2020,
       "arxiv_id": "2005.14165",
       "relevance": "GPT-3 paper establishing the foundation for the GPT model family evaluated in this work."
     },
     {
       "title": "Code Llama: Open Foundation Models for Code",
       "authors": ["B. Roziere", "J. Gehring", "F. Gloeckle"],
       "year": 2023,
       "arxiv_id": "2308.12950",
       "relevance": "Open code generation model relevant to the broader landscape of LLMs vulnerable to prompt injection in code-processing contexts."
     },
     {
       "title": "Tree of Thoughts: Deliberate Problem Solving with Large Language Models",
       "authors": ["S. Yao", "D. Yu", "J. Zhao"],
       "year": 2023,
       "arxiv_id": "2305.10601",
       "relevance": "Advanced reasoning framework for LLMs that increases agent capability and thereby the risk surface for prompt injection attacks."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 3,
       "justification": "Spotlighting techniques (especially datamarking) are immediately usable by any developer building LLM applications — full example prompts are provided."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Confirms the intuition that marking input data helps LLMs distinguish instructions from data; the telecom analogy is novel framing but the finding is expected."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Highlights that baseline XPIA success rates exceed 50% on major models, underscoring a significant AI security vulnerability, though it then proposes a mitigation."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy or conflict; straightforward defense paper with positive results."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Prompt templates are provided for manual replication, but no code, tool, or demo is released."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "From Microsoft Research, evaluating GPT-3.5/GPT-4 — recognizable lab and models."
     }
   }
 }