ai-research-survey

scan.json (31682B)

---

 {
   "paper": {
     "title": "Defending Against Prompt Injection with DataFilter",
     "authors": [
       "Yizhu Wang",
       "Sizhe Chen",
       "Raghad Alkhudair",
       "Basel Alomair",
       "David Wagner"
     ],
     "year": 2025,
     "venue": "IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) 2026",
     "arxiv_id": "2510.19207",
     "doi": "10.48550/arXiv.2510.19207"
   },
   "scan_version": 3,
   "active_modules": [
     "experimental_rigor",
     "data_leakage"
   ],
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states 'Our DataFilter model is released here for immediate use, with the code to reproduce our results here' with hyperlinks provided in footnote 1."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The training data is the publicly available Alpaca dataset [59]. All evaluation benchmarks (SEP, InjecAgent, AgentDojo, AlpacaEval2) are public. The SFT dataset construction is fully specified by Algorithm 1."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'two 80GB GPUs (A100/H100) using DeepSpeed ZeRO-3' and 'BF16 precision' but does not provide a requirements.txt, Dockerfile, or detailed library version listing sufficient to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides Algorithm 1 for SFT dataset construction, full training hyperparameters in Section V-A, and states the code to reproduce results is released. The prompt template is provided in full."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables II-VIII are reported as single point estimates (e.g., '2.2% ASR') with no confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are performed. Claims like 'DataFilter outperforms PromptArmor' are based solely on comparing raw percentages without any statistical test."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports effect sizes with baseline context throughout, e.g., 'average ASR 2.2% vs 5.9%' for DataFilter vs PromptArmor, 'average utility drop of 1.0% vs 4.1%', and provides both absolute values and differences (Section V-E)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for sample sizes. They note 'we randomly select 1K samples from SEP' for efficiency but provide no power analysis or justification for any benchmark sample sizes."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance or standard deviation reported. The paper acknowledges 'the backend LLM (gpt-4o) is non-deterministic despite setting the sampling temperature to 0, rendering inevitable variability' (Section V-E) but does not report multi-run variance."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Extensive baselines: PromptGuard, DataSentinel, Sandwich, Instructional, Spotlight, PromptArmor, and Tool Filter (Tables II-VI)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include concurrent work PromptArmor (2025), DataSentinel (2025), PromptGuard (2024), and Tool Filter (2025). These represent the current state of the art for model-agnostic defenses."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "No systematic ablation study. The discussion mentions a preliminary experiment where 'we trained a filter without providing the user's prompt as context' (Section VI), but there is no systematic ablation of the four training goals (anti-hallucination, EOS token, position randomization, etc.) that comprise DataFilter's design."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Security is measured by ASR across multiple benchmarks; utility is measured by task success rate (AgentDojo) and length-controlled WinRate (AlpacaEval2). Both dimensions are evaluated."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is included. All security and utility assessments are automated. Human evaluation of filtered output quality or filter accuracy could have been informative."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The filter is trained on the Alpaca dataset and evaluated on entirely separate benchmarks (SEP, InjecAgent, AgentDojo, AlpacaEval2), providing clear train/test separation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by attack type (6 types on SEP in Table IV, 4 on AgentDojo in Table II, 2 on InjecAgent in Table III) and by benchmark."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C provides detailed false positive and false negative examples. The Limitations section discusses when DataFilter fails (optimization-based attacks, very long prompts, injections disguised as task-relevant instructions)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table VIII shows DataFilter achieves only 83% ASR reduction under strong adaptive LLM-based attacks — still substantially breakable. The Limitations section acknowledges several failure modes. The preliminary experiment without user prompt context showed utility degradation."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'reduces the prompt injection attack success rates to near zero while maintaining the LLMs' utility.' Results show average ASR ~2.2% (Tables II-IV) and utility drop of ~1-2% (Tables V-VI), consistent with the claims."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Claims that DataFilter 'reduces' ASR are supported by controlled comparisons: same benchmarks, same backend LLMs, with and without the defense applied. This controlled experimental design adequately supports the causal claims."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The paper tests on multiple benchmarks (instruction-following and agentic), two backend LLMs (GPT-4o and Llama-3.1-8B), and multiple attack types. The Limitations section explicitly bounds scope: 'cannot defend against the strong optimization-based adaptive attacks' and acknowledges issues with very long prompts."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not substantively discuss alternative explanations for DataFilter's effectiveness. There is no discussion of whether the specific Alpaca training distribution, the choice of Llama-3.1-8B as filter backbone, or the particular benchmark properties drive the results. The utility-security tradeoff discussion is about mechanism design, not confounds."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper directly measures ASR (whether malicious actions occur) and utility (task success/win rates). These are direct measurements of the claimed defense properties, not proxies."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specifies 'gpt-4o-2024-05-13' (Section V-E), 'Llama-3.1-8B-Instruct' (filter model and backend), 'meta-llama/Llama-Prompt-Guard-2-86M' (baseline), and 'GPT-4.1' (PromptArmor detector). The snapshot date for gpt-4o is included."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The full system prompt template for DataFilter is provided in Section IV-C (grey box). The PromptArmor reproduction prompt is also provided in Section V-C. Adaptive attack prompts are provided in Appendix B."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section V-A reports: batch size 1, gradient accumulation 16, learning rate 2×10^-5, cosine schedule, 100 warmup steps, BF16 precision, 300 steps. Backend LLM temperature set to 0 (Section V-E)."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The DataFilter deployment architecture is described in Figure 1 and Section IV-B. The JSON data handling strategy for agentic applications is detailed in Section IV-D (recursive filtering of keys/values)."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Algorithm 1 fully specifies the SFT dataset construction including truncation ratios, injection position distributions, and attack type simulation. The special tokens (<|end_of_instruction|>, <|end_of_data|>) are documented."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section VI contains a 'Limitations' paragraph with substantive discussion of three specific limitations: inference overhead, vulnerability to optimization-based attacks, and challenges with long user prompts."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Specific threats discussed: DataFilter fails against optimization-based adaptive attacks (citing [12] which 'breaks our defense, as it breaches all existing defenses'), struggles with very long user prompts requiring developer extraction of short instructions, and adds an integration step."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly states it does not consider optimization-based attacks (Section II-D: 'We do not consider optimization-based attacks'), positions DataFilter as 'a practical defense in the short and medium term', and states in Section VI that no work has solved the problem of strongest attacks."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "All evaluation benchmarks (SEP, InjecAgent, AgentDojo, AlpacaEval2) are public. The Alpaca training dataset is public. Code and model are released for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Algorithm 1 fully specifies SFT dataset construction from Alpaca (N=19K samples with non-empty data part). Evaluation benchmarks are cited with descriptions (Sections V-B)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are standard public benchmarks and a public instruction-tuning dataset."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Algorithm 1 documents the full pipeline from Alpaca samples to SFT triples, including truncation, injection simulation, and position randomization with exact percentages at each step."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgments section lists: 'KACST-UC Berkeley Center of Excellence for Secure Computing, the NSF ACTION center through NSF grant 2229876, and by generous gifts from Google, Meta, and Noyce foundation.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: UC Berkeley (Wang, Chen, Wagner) and KACST (Alkhudair, Alomair). They are not evaluating products from their own organizations."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Google and Meta both fund this work and are major LLM providers. Both companies have commercial interest in prompt injection defenses (Google Bard and Meta's Llama are mentioned as targets). The paper evaluates Llama-3.1-8B-Instruct (Meta's model) as both filter and backend, creating a potential alignment between funder interest and positive results."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests a defense mechanism, not model knowledge on benchmarks. The benchmarks measure defense effectiveness (ASR, utility under defense), not whether the model has memorized benchmark answers."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defenses rather than model knowledge. Contamination of the backend LLM with benchmark data is not the focus — the defense's filtering behavior is what's evaluated."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same rationale: the paper evaluates a defense mechanism, not a pre-trained model's capability on benchmarks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table IX reports per-sample cost overhead (<$0.0005) and latency overhead (<0.60s) for DataFilter with both GPT-5.1 and GPT-4o backends, computed using OpenRouter pricing."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Training hardware is stated (two 80GB GPUs, A100/H100) and training steps (300) but total training time, GPU hours, or total training cost are not explicitly reported."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper acknowledges non-determinism of gpt-4o (Section V-E: 'the backend LLM (gpt-4o) is non-deterministic despite setting the sampling temperature to 0') but does not report results across multiple seeds or runs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. Results appear to be from single runs without explicit mention of repetition."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Training hyperparameters are reported but no hyperparameter search budget is described. The truncation ratios (65%/10%/10%/15%) and injection position ratios (20%/20%/60%) are presented as 'heuristically' chosen without justification."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for how the final configuration was selected. Heuristic choices (truncation percentages, position distributions, 300 training steps) are stated without explaining why these values were chosen over alternatives."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparisons across 7 defenses, 6+ attack types, 4 benchmarks, and 2 backend LLMs without any statistical tests, let alone corrections for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own DataFilter against baselines including their own re-implementation of PromptArmor (whose code was not released). No acknowledgment of self-evaluation bias, particularly regarding the re-implementation of concurrent work."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "While Table IX reports DataFilter's overhead, there is no comparison of defense effectiveness as a function of compute budget. PromptArmor uses GPT-4.1 (much more expensive) vs DataFilter's Llama-3.1-8B, but this cost-effectiveness comparison is not made."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the benchmarks (SEP, InjecAgent, AgentDojo) actually measure real-world prompt injection defense effectiveness. No analysis of construct validity or comparison with real-world attack scenarios beyond benchmark settings."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "DataFilter is applied as a preprocessing step before the same backend LLM and agent scaffold, so the scaffolding is identical across all defense comparisons. The confound is controlled by design."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of temporal leakage. The filter is trained on Alpaca (2023) and tested on benchmarks released around the same time or later, but this is not discussed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information about attack patterns through features available to the filter that wouldn't be available in real deployment."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of potential overlap or structural similarity between Alpaca training data and the evaluation benchmarks (particularly AlpacaEval2, which is derived from a related dataset)."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is used or discussed."
       }
     }
   },
   "claims": [
     {
       "claim": "DataFilter reduces prompt injection ASR to near zero (~2.2% average) while maintaining utility within 1-2 percentage points of the undefended model.",
       "evidence": "Tables II-IV show ASR reductions across SEP, InjecAgent, and AgentDojo. Tables V-VI show utility preservation on AgentDojo (79.4% vs 81.4% benign) and AlpacaEval2 (54.1% vs 54.0% for GPT-4o).",
       "supported": "strong"
     },
     {
       "claim": "DataFilter achieves a better security-utility tradeoff than all tested model-agnostic defenses.",
       "evidence": "Figure 2 and comparative tables show DataFilter outperforms PromptArmor on both security (2.2% vs 5.9% average ASR) and utility (1.0% vs 4.1% average drop). Other baselines are substantially worse on security.",
       "supported": "moderate"
     },
     {
       "claim": "DataFilter generalizes from basic training attacks (Straightforward, Ignore, Completion) to unseen attack types and agentic domains.",
       "evidence": "Trained on Alpaca with 3 attack types but evaluated on 6 attack types including Context and Multi-Turn-Completion (Table IV), and on agentic benchmarks AgentDojo and InjecAgent (Tables II-III) with consistently low ASR.",
       "supported": "strong"
     },
     {
       "claim": "DataFilter is robust to adaptive human-designed attacks targeting the filter itself.",
       "evidence": "Table VII shows ASR ≤1% on SEP and 0% on AgentDojo under adaptive attacks that attempt to deceive or suppress the filter. Appendix B provides the attack prompts used.",
       "supported": "moderate"
     },
     {
       "claim": "DataFilter introduces marginal computational overhead (less than 4% cost, less than 18% latency).",
       "evidence": "Table IX shows +3.7% cost and +4.0% latency with GPT-5.1 backend; +1.0% cost and +17.5% latency with GPT-4o backend.",
       "supported": "strong"
     },
     {
       "claim": "DataFilter remains the most effective defense under strong adaptive LLM-based attacks, though still substantially breakable at 83% ASR.",
       "evidence": "Table VIII shows DataFilter achieves 83% ASR vs 93% for PromptArmor under the strongest available attack from [12]. Authors note this attack 'breaks our defense, as it breaches all existing defenses.'",
       "supported": "moderate"
     }
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "DataFilter, a model-agnostic defense that fine-tunes Llama-3.1-8B-Instruct to strip prompt injections from untrusted data before it reaches the backend LLM, reduces average attack success rates from over 40% to ~2.2% across SEP, InjecAgent, and AgentDojo benchmarks while maintaining utility within 1-2 percentage points. It outperforms all tested model-agnostic baselines including PromptArmor (GPT-4.1-based) on both security and utility. However, strong adaptive LLM-based attacks still achieve 83% ASR against DataFilter, and all results lack uncertainty quantification (no error bars, no multi-run variance).",
   "red_flags": [
     {
       "flag": "No error bars or uncertainty quantification",
       "detail": "All results across all tables are single point estimates with no confidence intervals, standard deviations, or multi-run variance. The authors acknowledge gpt-4o non-determinism but never quantify it. Results could be within noise of each other."
     },
     {
       "flag": "Self-implementation of concurrent baseline",
       "detail": "PromptArmor (a key competitor) was re-implemented by the authors since no code was released. The authors modified the detection prompt ('we refined the detection prompt'), introducing potential bias in the comparison. The authors acknowledge PromptArmor's effectiveness 'is heavily dependent on ChatGPT's prior exposure' but their re-implementation choices are not validated."
     },
     {
       "flag": "Unjustified heuristic design choices",
       "detail": "Multiple training design decisions use specific percentages described as 'heuristically' chosen (65%/10%/10%/15% truncation ratios, 20%/20%/60% injection positions) with no ablation, sensitivity analysis, or justification for these values."
     },
     {
       "flag": "No ablation study",
       "detail": "DataFilter incorporates four specific training goals (benign preservation, anti-hallucination, anti-repetition, position randomization) but provides no ablation study to determine which components are necessary or how much each contributes to the final performance."
     },
     {
       "flag": "Strong adaptive attack substantially breaks the defense",
       "detail": "Table VIII shows 83% ASR under the strongest adaptive LLM-based attack [12], yet the paper's framing emphasizes 'near zero' ASR from weaker attacks. The title and abstract do not mention this significant vulnerability."
     }
   ],
   "cited_papers": [
     {
       "title": "Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection",
       "authors": [
         "K. Greshake",
         "S. Abdelnabi",
         "S. Mishra",
         "C. Endres",
         "T. Holz",
         "M. Fritz"
       ],
       "year": 2023,
       "relevance": "Foundational work on indirect prompt injection attacks against LLM-integrated applications."
     },
     {
       "title": "The attacker moves second: Stronger adaptive attacks bypass defenses against llm jailbreaks and prompt injections",
       "authors": [
         "M. Nasr",
         "N. Carlini",
         "C. Sitawarin"
       ],
       "year": 2025,
       "arxiv_id": "2510.09023",
       "relevance": "Demonstrates that strong adaptive attacks can break all existing prompt injection defenses including DataFilter (83% ASR)."
     },
     {
       "title": "Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks",
       "authors": [
         "S. Chen",
         "A. Zharmagambetov",
         "D. Wagner",
         "C. Guo"
       ],
       "year": 2025,
       "arxiv_id": "2507.02735",
       "relevance": "Fine-tuning defense for prompt injection that inspired DataFilter's training approach and demonstrated cross-domain generalization."
     },
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": [
         "S. Chen",
         "J. Piet",
         "C. Sitawarin",
         "D. Wagner"
       ],
       "year": 2025,
       "relevance": "System-level defense that structures LLM queries to separate prompts from data, requiring model weight access."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": [
         "Q. Zhan",
         "Z. Liang",
         "Z. Ying",
         "D. Kang"
       ],
       "year": 2024,
       "relevance": "Benchmark for evaluating prompt injection attacks in agentic tool-calling scenarios, used as primary evaluation benchmark."
     },
     {
       "title": "Agentdojo: A dynamic environment to evaluate attacks and defenses for llm agents",
       "authors": [
         "E. Debenedetti",
         "J. Zhang",
         "M. Balunović",
         "L. Beurer-Kellner",
         "M. Fischer",
         "F. Tramèr"
       ],
       "year": 2024,
       "relevance": "Multi-tool agent benchmark for prompt injection with both security and utility evaluation, used as primary evaluation benchmark."
     },
     {
       "title": "Can llms separate instructions from data? and what do we even mean by that?",
       "authors": [
         "E. Zverev",
         "S. Abdelnabi",
         "M. Fritz",
         "C. H. Lampert"
       ],
       "year": 2025,
       "relevance": "SEP benchmark providing controlled measurement of instruction-data separation in LLMs, used as evaluation benchmark."
     },
     {
       "title": "PromptArmor: Simple yet effective prompt injection defenses",
       "authors": [
         "T. Shi",
         "K. Zhu",
         "Z. Wang"
       ],
       "year": 2025,
       "arxiv_id": "2507.15219",
       "relevance": "Concurrent defense using LLM-based detection and fuzzy string matching for injection removal; primary competitor to DataFilter."
     },
     {
       "title": "DataSentinel: A game-theoretic detection of prompt injection attacks",
       "authors": [
         "Y. Liu",
         "Y. Jia",
         "J. Jia",
         "D. Song",
         "N. Z. Gong"
       ],
       "year": 2025,
       "relevance": "Game-theoretic prompt injection detector using deliberately vulnerable LLM design, evaluated as baseline defense."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": [
         "E. Debenedetti",
         "I. Shumailov",
         "T. Fan",
         "J. Hayes",
         "N. Carlini"
       ],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "System-level defense providing security-by-design against prompt injection through pipeline redesign."
     },
     {
       "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions",
       "authors": [
         "E. Wallace",
         "K. Xiao",
         "R. Leike",
         "L. Weng",
         "J. Heidecke",
         "A. Beutel"
       ],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Model-level defense training LLMs to prioritize system instructions over injected instructions in data."
     },
     {
       "title": "Defending against indirect prompt injection attacks with spotlighting",
       "authors": [
         "K. Hines",
         "G. Lopez",
         "M. Hall",
         "F. Zarfati",
         "Y. Zunger",
         "E. Kiciman"
       ],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Prompt-based defense using delimiting to mark untrusted data, evaluated as baseline."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Released model and code for a plug-and-play prompt injection filter that can protect any backend LLM without modification, directly applicable to production agent systems."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The main claim of near-zero ASR is undermined by the buried finding that adaptive LLM-based attacks still achieve 83% ASR, but the paper doesn't frame this tension as its headline."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Prompt injection defense is the core theme, with concrete demonstrations of real-world attacks against Google Bard, Slack AI, Claude Computer Use, and OpenAI Operator."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Mildly challenges PromptArmor (a concurrent competitor they re-implemented themselves) and implicitly questions model providers for not shipping robust models, but no major controversy."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Model weights and reproduction code are released, requiring a Llama-3.1-8B setup but providing clear benchmarks to reproduce."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "UC Berkeley is well-recognized in security research but the authors and the tool itself are not household names in the broader tech community."
     }
   }
 }