ai-research-survey

scan-v5.json (32695B)

---

 {
   "scan_version": 5,
   "paper_type": "empirical",
   "paper": {
     "title": "Defending Against Prompt Injection With a Few DefensiveTokens",
     "authors": [
       "Sizhe Chen",
       "Yizhu Wang",
       "Nicholas Carlini",
       "Chawin Sitawarin",
       "David Wagner"
     ],
     "year": 2025,
     "venue": "AISec@CCS",
     "arxiv_id": "2507.07974",
     "doi": "10.1145/3733799.3762982"
   },
   "checklist": {
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims DefensiveToken achieves security 'comparable to training-time alternatives' are supported by Table 3 results (0.24% avg ASR on TaskTracker vs. 0.20–0.51% for training-time defenses). Flexibility and minimal utility drop claims are supported by Table 3 WinRate columns and Figure 3.",
         "source": "haiku"
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims (DefensiveToken reduces ASR, improves security) are supported by controlled ablation studies in Section 4.5 varying number of tokens, initialization, loss function, position, and learning rate. Comparisons with and without DefensiveTokens isolate the causal contribution.",
         "source": "haiku"
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "All experiments use 4 open-weight 7–8B models only. The paper does not bound generalization claims to this model-size range, and conclusions like 'comparable to training-time defenses' implicitly extend beyond the tested scope without acknowledging inapplicability to larger or closed models.",
         "source": "haiku"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper presents a single mechanistic hypothesis for why DefensiveToken works (large embedding magnitude enabling optimization, Table 2) without considering alternatives such as attention-head anchoring, semantic priming, or training-data distribution shift.",
         "source": "haiku"
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "Metrics directly correspond to claims: ASR measures security against prompt injection, WinRate measures utility. No proxy conflation—the paper does not call ASR a stand-in for a broader safety property it doesn't measure.",
         "source": "haiku"
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations section. Limitations appear only in the conclusion paragraph: 'DefensiveToken only defends against prompt injections...does not apply to other safety settings...we do not know the utility on more labeled datasets.' A concluding paragraph does not qualify.",
         "source": "haiku"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats-to-validity section exists. The conclusion briefly mentions utility uncertainty on unlabeled datasets, but does not discuss specific threats such as LLM judge reliability, benchmark saturation, or architecture dependency.",
         "source": "haiku"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The conclusion explicitly states: 'DefensiveToken only defends against prompt injections, where the user is benign and the environment is malicious. DefensiveToken does not apply to other safety settings, e.g., preventing jailbreaks, system following attacks, and data extraction attacks.'",
         "source": "haiku"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Funding is explicitly listed in acknowledgments: Google-BAIR Commons, NSF (grant 2229876), OpenAI, Open Philanthropy, Google, the Department of Homeland Security, and IBM.",
         "source": "haiku"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed in the paper header: UC Berkeley (Chen, Wang, Wagner), Google DeepMind and Anthropic (Carlini), Google DeepMind (Sitawarin).",
         "source": "haiku"
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Google and OpenAI are funders; a Google DeepMind employee (Carlini) is co-author; and gpt-4o (OpenAI's model) is the primary LLM judge throughout evaluation. This creates alignment between funder interests and both the research direction and evaluation tooling.",
         "source": "haiku"
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "Funding sources are acknowledged but there is no explicit 'competing interests' or 'financial interests' statement. No declaration about patents, equity, or consulting relationships is included.",
         "source": "haiku"
       }
     },
     "scope_and_framing": {
       "key_terms_defined": {
         "applies": true,
         "answer": true,
         "justification": "Key terms are precisely defined: prompt injection is defined as inserting malicious instructions into data consumed by an LLM; the threat model is formally specified in Section 3.1; ASR is defined; the [INST]/[DATA]/[RESP] prompt format is shown with concrete examples.",
         "source": "haiku"
       },
       "intended_contribution_clear": {
         "applies": true,
         "answer": true,
         "justification": "The contribution is clearly stated: 'We introduce DefensiveToken, the first test-time prompt injection defense that is as effective as training-time ones in most cases.' Table 1 situates it against all existing defense categories across three axes.",
         "source": "haiku"
       },
       "engagement_with_prior_work": {
         "applies": true,
         "answer": true,
         "justification": "Section 2 explicitly situates DefensiveToken against attack types (optimization-free vs. optimization-based), defense categories (detection vs. prevention, test-time vs. training-time), and prior methods (StruQ, SecAlign, ISE, Jatmo, instruction hierarchy, prompt tuning), explaining how DefensiveToken differs from each.",
         "source": "haiku"
       }
     }
   },
   "type_checklist": {
     "empirical": {
       "artifacts": {
         "code_released": {
           "applies": true,
           "answer": true,
           "justification": "The abstract states 'The code is available here' with a hyperlink. The paper references specific implementation components (peft library, PyTorch FSDP) consistent with a released codebase.",
           "source": "haiku"
         },
         "data_released": {
           "applies": true,
           "answer": true,
           "justification": "All evaluation datasets are publicly available standard benchmarks: AlpacaFarm, SEP, TaskTracker (31K samples), CyberSecEval2, InjecAgent, and Cleaned Alpaca (training data). No proprietary data was created.",
           "source": "haiku"
         },
         "environment_specified": {
           "applies": true,
           "answer": false,
           "justification": "The paper mentions 'four NVIDIA Tesla A100s (80GB) with PyTorch FSDP' and the peft library, but provides no requirements.txt, Dockerfile, or version-pinned dependency list.",
           "source": "haiku"
         },
         "reproduction_instructions": {
           "applies": true,
           "answer": false,
           "justification": "Algorithm 1 provides the optimization procedure at a high level and key hyperparameters are reported, but no step-by-step execution instructions are provided. Users would need to substantially infer how to run the experiments.",
           "source": "haiku"
         }
       },
       "statistical_methodology": {
         "confidence_intervals_or_error_bars": {
           "applies": true,
           "answer": false,
           "justification": "Main results in Table 3 (all 24 model-benchmark combinations) are single-run point estimates without error bars. Variance is reported for only one configuration: SEP/Llama3.1-8B over 5 runs (WinRate 53.84±0.56, ASR 2.81±1.09).",
           "source": "haiku"
         },
         "significance_tests": {
           "applies": true,
           "answer": false,
           "justification": "No statistical significance tests are reported for any comparative claim. All differences between methods are presented as raw percentage differences without p-values or confidence intervals.",
           "source": "haiku"
         },
         "effect_sizes_reported": {
           "applies": true,
           "answer": true,
           "justification": "Effect sizes are clearly quantified: DefensiveToken reduces GCG ASR from 95.2% to 48.8%; reduces optimization-free ASR by an order of magnitude versus no defense on major benchmarks; WinRate drops of less than 2pp for utility. Baselines provide meaningful reference points throughout.",
           "source": "haiku"
         },
         "sample_size_justified": {
           "applies": true,
           "answer": false,
           "justification": "No justification is given for the choice of 4 models or these specific benchmarks. No power analysis is provided. The selection of 5 defensive tokens is empirically justified (Table 4) but not via pre-study power calculation.",
           "source": "haiku"
         },
         "variance_reported": {
           "applies": true,
           "answer": false,
           "justification": "Variance is only reported for one model-benchmark combination (Llama3.1-8B on SEP, 5 runs). All other results in Table 3 are single-run point estimates.",
           "source": "haiku"
         }
       },
       "evaluation_design": {
         "baselines_included": {
           "applies": true,
           "answer": true,
           "justification": "Multiple baselines are included: test-time (Reminder, Sandwich, TextGrad) and training-time (StruQ-LoRA, StruQ-Full, SecAlign-LoRA), plus 'no defense' baseline, all evaluated across the same 5 benchmarks and 4 models.",
           "source": "haiku"
         },
         "baselines_contemporary": {
           "applies": true,
           "answer": true,
           "justification": "Baselines are current: StruQ (2025), SecAlign (2025), TextGrad (2025), Instruction Hierarchy (2024, gpt-4o). The paper also explicitly justifies excluding detection-based and system-level defenses as out-of-scope for the threat model.",
           "source": "haiku"
         },
         "ablation_study": {
           "applies": true,
           "answer": true,
           "justification": "Section 4.5 provides comprehensive ablation studies: number of tokens (Table 4), initialization strategy (Table 5), loss function (Table 6), insertion position (Table 7), and learning rate (Table 8). Multiple design choices are varied independently.",
           "source": "haiku"
         },
         "multiple_metrics": {
           "applies": true,
           "answer": true,
           "justification": "Both security (ASR for optimization-free attacks and GCG-ASR for optimization-based) and utility (WinRate on AlpacaEval2) metrics are reported. Figure 3 visualizes the Pareto utility-security trade-off explicitly.",
           "source": "haiku"
         },
         "human_evaluation": {
           "applies": false,
           "answer": false,
           "justification": "Human evaluation is not applicable here. Utility is measured via LLM judge (gpt-4o through AlpacaEval2) and security via automated string matching or LLM judge. This is an automated security defense evaluation without system outputs requiring human judgment.",
           "source": "haiku"
         },
         "held_out_test_set": {
           "applies": true,
           "answer": true,
           "justification": "DefensiveToken optimization uses Cleaned Alpaca (51K training samples), explicitly stated to be 'different and in another domain from' the AlpacaFarm evaluation set. 'The user instructions and injections in evaluation have no overlap with those used in model training.'",
           "source": "haiku"
         },
         "per_category_breakdown": {
           "applies": true,
           "answer": true,
           "justification": "Table 3 provides full per-model (4 models) and per-benchmark (5 benchmarks) breakdowns for all methods, enabling fine-grained analysis of where DefensiveToken succeeds or underperforms.",
           "source": "haiku"
         },
         "failure_cases_discussed": {
           "applies": true,
           "answer": true,
           "justification": "Failure cases are explicitly discussed: GCG attacks still achieve 48.8% avg ASR (vs. near-0% for StruQ-Full); Falcon3-7B requires 20 tokens for near-zero ASR vs. 5 for other models; InjecAgent agentic setting shows DefensiveToken is 'slightly weaker than training-time alternatives.'",
           "source": "haiku"
         },
         "negative_results_reported": {
           "applies": true,
           "answer": true,
           "justification": "Negative results are honestly reported: SecAlign loss applied to token embeddings catastrophically hurts utility (Table 6, ~10pp WinRate drop); insertion at end of input significantly degrades both utility and security (Table 7); lr=0.01 fails to achieve security (Table 8).",
           "source": "haiku"
         }
       },
       "setup_transparency": {
         "model_versions_specified": {
           "applies": true,
           "answer": true,
           "justification": "Specific model identifiers are provided: Llama3-8B-Instruct, Llama3.1-8B-Instruct, Falcon3-7B-Instruct, Qwen2.5-7B-Instruct. The LLM judge is identified as gpt-4o with AlpacaEval2 reference model version turbo-2024-04-09.",
           "source": "haiku"
         },
         "prompts_provided": {
           "applies": true,
           "answer": true,
           "justification": "Full prompts and injection examples are reproduced for all 4 attack variants (Ignore, Completion, Ignore-Completion, GCG) across all 5 benchmarks, including the exact [INST]/[DATA]/[RESP] format and complete injection text.",
           "source": "haiku"
         },
         "hyperparameters_reported": {
           "applies": true,
           "answer": true,
           "justification": "Full hyperparameters reported: learning rate 0.1, 1 epoch, 5 tokens, LoRA parameters (r=64, lora_alpha=8, lora_dropout=0.1, target_modules=['q_proj','v_proj']), Cleaned Alpaca 51K training samples, and batch training via PyTorch FSDP.",
           "source": "haiku"
         },
         "scaffolding_described": {
           "applies": false,
           "answer": false,
           "justification": "There is no agentic scaffolding in the core DefensiveToken evaluation. InjecAgent uses ReAct prompts from an existing benchmark, not custom scaffolding designed by the authors.",
           "source": "haiku"
         },
         "data_preprocessing_documented": {
           "applies": true,
           "answer": true,
           "justification": "The defensive training dataset construction is described in Algorithm 1 and Section 3.3: self-labeled responses from undefended LLM, 50% samples unchanged, 25% each with two injection variants. Injection placement rules per benchmark are also specified.",
           "source": "haiku"
         }
       },
       "data_integrity": {
         "raw_data_available": {
           "applies": true,
           "answer": false,
           "justification": "Security evaluation relies on gpt-4o judge decisions which are not publicly released, making independent verification of ASR numbers impossible. Only aggregate statistics are presented; individual judge responses are unavailable.",
           "source": "haiku"
         },
         "data_collection_described": {
           "applies": true,
           "answer": true,
           "justification": "Data collection is described: standard benchmarks used with injections appended per benchmark-specific rules (end-of-data for SEP, benchmark-specified placement for TaskTracker). Training data generation from Cleaned Alpaca is described in Algorithm 1.",
           "source": "haiku"
         },
         "recruitment_methods_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants were recruited. All evaluation uses standard benchmark datasets and LLM judges.",
           "source": "haiku"
         },
         "data_pipeline_documented": {
           "applies": true,
           "answer": true,
           "justification": "The pipeline from training data construction (Algorithm 1) through DefensiveToken optimization to evaluation (LLM judge via AlpacaEval2 for utility, gpt-4o for security, string matching for AlpacaFarm) is documented at a level sufficient to understand the full flow.",
           "source": "haiku"
         }
       },
       "contamination": {
         "training_cutoff_stated": {
           "applies": true,
           "answer": false,
           "justification": "Training data cutoffs for Llama3, Llama3.1, Falcon3, and Qwen2.5 base models are not stated. The paper only verifies that the defensive token optimization data doesn't overlap with evaluation benchmarks, not whether base model pre-training included evaluation examples.",
           "source": "haiku"
         },
         "train_test_overlap_discussed": {
           "applies": true,
           "answer": false,
           "justification": "The paper states 'The user instructions and injections in evaluation have no overlap with those used in model training' (for defensive token optimization), but does not discuss potential overlap between the base LLMs' pre-training data and evaluation benchmarks like AlpacaFarm or SEP.",
           "source": "haiku"
         },
         "benchmark_contamination_addressed": {
           "applies": true,
           "answer": false,
           "justification": "Contamination of the base LLMs' pre-training data with evaluation benchmarks is not addressed. This matters for utility measurement—if Llama3 or Qwen2.5 pre-training included AlpacaFarm examples, the WinRate baseline would be inflated.",
           "source": "haiku"
         }
       },
       "human_studies": {
         "pre_registered": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "haiku"
         },
         "irb_or_ethics_approval": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "haiku"
         },
         "demographics_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "haiku"
         },
         "inclusion_exclusion_criteria": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "haiku"
         },
         "randomization_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "haiku"
         },
         "blinding_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "haiku"
         },
         "attrition_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "haiku"
         }
       },
       "cost_and_practicality": {
         "inference_cost_reported": {
           "applies": true,
           "answer": false,
           "justification": "The paper notes DefensiveTokens add 'only 5 more tokens' to input but provides no quantitative inference latency or throughput measurements. The overhead is described qualitatively as 'minimal changes to the LLM system' without measured numbers.",
           "source": "haiku"
         },
         "compute_budget_stated": {
           "applies": true,
           "answer": true,
           "justification": "Training compute is reported: 'four NVIDIA Tesla A100s (80GB) with PyTorch FSDP and takes one hour to complete.' This provides actionable compute budget information.",
           "source": "haiku"
         }
       }
     }
   },
   "claims": [
     {
       "claim": "DefensiveToken achieves security comparable to training-time defenses on optimization-free prompt injection attacks, with 0.24% average ASR on TaskTracker vs. 0.20–0.51% for training-time alternatives.",
       "evidence": "Table 3 and Figure 2: DefensiveToken achieves 0.24% avg ASR on TaskTracker across 4 models; StruQ-LoRA 0.24%, StruQ-Full 0.20%, SecAlign-LoRA 0.51%. Similar results on AlpacaFarm and SEP benchmarks.",
       "supported": "strong"
     },
     {
       "claim": "DefensiveToken reduces optimization-free ASR by an order of magnitude compared to prompting-based test-time defenses (Reminder, Sandwich), which 'never reduce ASRs by over two times' across all benchmarks.",
       "evidence": "Figure 2 and Table 3: Reminder achieves 19.8–35.3% ASR on TaskTracker while DefensiveToken achieves 0.19–0.27%; on AlpacaFarm, Sandwich reduces ASR only to 56.7–85.6% while DefensiveToken achieves 0.48–4.81%.",
       "supported": "strong"
     },
     {
       "claim": "DefensiveToken incurs smaller utility loss than all tested baselines (test-time and training-time) because only 5 additional tokens are added to the input.",
       "evidence": "Figure 3 shows DefensiveToken is closest to the ideal defense on both AlpacaFarm and SEP. Table 3 WinRate column shows <2pp utility drop versus no-defense baseline in most cases, outperforming TextGrad (−6 to −19pp), StruQ-Full (Falcon3: −5pp), and SecAlign (−2 to −9pp).",
       "supported": "strong"
     },
     {
       "claim": "Against adaptive GCG optimization-based attacks (attacker knows DefensiveToken embeddings), DefensiveToken reduces average ASR from 95.2% to 48.8% while prompting-based baselines achieve near-100% ASR.",
       "evidence": "Figure 2 (GCG sub-figure): Reminder/Sandwich achieve 96.6–100% GCG ASR; DefensiveToken achieves 37.5% (Llama3.1-8B) to 73.6% (Qwen2.5-7B) GCG ASR averaged across 4 models.",
       "supported": "moderate"
     },
     {
       "claim": "Optimized DefensiveToken embeddings have 100x larger L1-norm magnitude than vocabulary token embeddings, making prompting-based approaches unable to replicate their security effectiveness.",
       "evidence": "Table 2: vocabulary tokens average L1-norm 34 (max 47) vs. DefensiveTokens average 4332 (max 4594) for Llama-3.1-8B-Instruct. Correlation with security is argued but not causally established.",
       "supported": "moderate"
     },
     {
       "claim": "5 defensive tokens are sufficient for all 4 tested models to achieve near-optimal security; random initialization outperforms text-embedding initialization due to facilitating larger optimization magnitude.",
       "evidence": "Table 4: 5 tokens achieve 0.48% ASR on Llama3/3.1-8B (same as 20 tokens). Table 5: random initialization achieves 0.48% ASR vs. space initialization's 2.40% with 5 tokens on Llama3.1-8B. Falcon3-7B exception noted.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "DefensiveToken proposes optimizing special token embeddings (not model weights) that can be optionally prepended to LLM inputs at test time to achieve prompt injection robustness comparable to training-time fine-tuning while preserving developer flexibility to skip the defense when utility is prioritized. On 5 benchmarks with 4 open-weight 7–8B LLMs, DefensiveToken reduces optimization-free attack success rates by orders of magnitude over prompting-based baselines (0.24% avg ASR on TaskTracker vs. 11–30% for existing test-time defenses) while incurring less utility loss than all competing methods. The defense achieves a superior utility-security Pareto frontier, sitting closest to the ideal defense in Figure 3. The main remaining gap is against adaptive optimization-based attacks (GCG), where DefensiveToken reduces ASR from 95.2% to 48.8% while training-time defenses achieve near-zero—a limitation honestly reported.",
   "red_flags": [
     {
       "flag": "LLM judge reliance without reliability check",
       "detail": "Security evaluation throughout relies on gpt-4o to determine attack success. No inter-rater reliability between the LLM judge and human annotators is reported. OpenAI is also a named funder, creating alignment between funder interests and evaluation tooling."
     },
     {
       "flag": "Variance reported for only one configuration",
       "detail": "Five-run variance is reported only for SEP/Llama3.1-8B-Instruct. All other results in Table 3 (24 model-benchmark combinations) are single-run point estimates without error bars, making claimed comparisons statistically uninformative."
     },
     {
       "flag": "Results restricted to 7–8B open-weight models",
       "detail": "All four tested models are 7B or 8B parameters. Generalizability to larger models (70B+) or closed frontier models (GPT-4, Claude) is untested, and deployment requires providers to optimize and release DefensiveTokens alongside their models—a step that has not occurred in practice."
     },
     {
       "flag": "Funder conflict with judge tool",
       "detail": "OpenAI is a named funder and gpt-4o (OpenAI's model) is the primary LLM judge throughout evaluation. Google is a named funder and a Google DeepMind employee is co-author. No competing interests statement is present."
     },
     {
       "flag": "Code URL not visible in paper text",
       "detail": "The abstract states 'The code is available here' with a hyperlink, but the URL is not printed in the paper text, making code availability unverifiable from the paper alone."
     }
   ],
   "cited_papers": [
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "relevance": "Direct predecessor and primary baseline; DefensiveToken uses StruQ's defensive loss function and training dataset construction methodology"
     },
     {
       "title": "SecAlign: Defending Against Prompt Injection with Preference Optimization",
       "relevance": "Key training-time baseline using preference optimization; SecAlign loss is ablated against StruQ loss in DefensiveToken context"
     },
     {
       "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents",
       "relevance": "Agentic tool-calling benchmark used to test generalization of DefensiveToken to API-calling/ReAct settings beyond instruction-following"
     },
     {
       "title": "Get my drift? Catching LLM Task Drift with Activation Deltas",
       "relevance": "TaskTracker benchmark (31K samples) used as the largest primary security evaluation dataset"
     },
     {
       "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
       "relevance": "GCG attack method used to evaluate DefensiveToken robustness under strong adaptive optimization-based attacks"
     },
     {
       "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions",
       "relevance": "Training-time defense implemented in frontier models (gpt-4o, gemini-2.5-flash); contextualizes where DefensiveToken sits relative to provider-level solutions"
     },
     {
       "title": "Defeating prompt injections by design",
       "relevance": "System-level defense baseline; excluded from main comparison because it applies only to agentic control-flow cases"
     },
     {
       "title": "Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?",
       "relevance": "SEP benchmark (9.1K samples) used in both security and utility-security trade-off evaluation"
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 3,
       "justification": "Directly addresses the OWASP #1 LLM threat with a deployable defense requiring 1 hour of training and 5 extra tokens at inference time with no infrastructure changes."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "The finding that test-time token embedding optimization can match training-time fine-tuning security challenges the prevailing assumption that parameter updates are necessary for robust prompt injection defense."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Addresses prompt injection attacks that have compromised real-world LLM products (Google Bard, Slack AI, Anthropic/OpenAI web agents), ranked #1 OWASP LLM threat, with growing agentic deployment surface."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Understated positioning of Berkeley academic work against industry (Google/OpenAI) funded training-time solutions, with co-authors spanning both sides."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code is reportedly released, training takes 1 hour on 4 A100s with standard open-weight models, making the defense feasibly reproducible by well-resourced practitioners."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Nicholas Carlini (Google DeepMind/Anthropic) is a prominent ML security researcher; David Wagner (UC Berkeley) is a well-known security faculty member; published at AISec@CCS, the top AI security workshop."
     }
   },
   "hn_data": {
     "threads": [
       {
         "hn_id": "40938701",
         "title": "Training a time series model using transformers at Datadog",
         "points": 27,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=40938701",
         "created_at": "2024-07-11T17:19:07Z"
       },
       {
         "hn_id": "32218471",
         "title": "Drivable Volumetric Avatars Using Texel-Aligned Features",
         "points": 3,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=32218471",
         "created_at": "2022-07-24T22:36:31Z"
       },
       {
         "hn_id": "44553930",
         "title": "Defending Against Prompt Injection with a Few DefensiveTokens",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=44553930",
         "created_at": "2025-07-13T21:32:40Z"
       },
       {
         "hn_id": "47041986",
         "title": "A Survey of In-Context Reinforcement Learning",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=47041986",
         "created_at": "2026-02-17T00:01:18Z"
       },
       {
         "hn_id": "43296207",
         "title": "The Widespread Adoption of Large Language Model-Assisted Writing Across Society",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=43296207",
         "created_at": "2025-03-08T00:09:53Z"
       },
       {
         "hn_id": "43088092",
         "title": "The Widespread Adoption of Large Language Model-Assisted Writing Across Society",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=43088092",
         "created_at": "2025-02-18T10:30:59Z"
       },
       {
         "hn_id": "38091292",
         "title": "Communicative Agents for Software Development",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=38091292",
         "created_at": "2023-10-31T21:00:02Z"
       },
       {
         "hn_id": "37786498",
         "title": "Communicative Agents for Software Development",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=37786498",
         "created_at": "2023-10-06T02:13:18Z"
       },
       {
         "hn_id": "46452714",
         "title": "Performance Evaluation of Brokerless Messaging Libraries",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=46452714",
         "created_at": "2026-01-01T09:44:55Z"
       },
       {
         "hn_id": "45486277",
         "title": "Brain Graph Augmentation via Learnable Edge Masking for Psychiatric Diagnosis",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=45486277",
         "created_at": "2025-10-05T23:45:56Z"
       }
     ],
     "top_points": 27,
     "total_points": 44,
     "total_comments": 0
   }
 }