ai-research-survey

scan-v4.json (31161B)

---

 {
   "scan_version": 4,
   "paper_type": "empirical",
   "paper": {
     "title": "Defense Against Indirect Prompt Injection via Tool Result Parsing",
     "authors": [
       "Qiang Yu",
       "Xinran Cheng",
       "Chuanyi Liu"
     ],
     "year": 2026,
     "venue": "arXiv.org",
     "arxiv_id": "2601.04795",
     "doi": "10.48550/arXiv.2601.04795"
   },
   "checklist": {
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'competitive Utility under Attack (UA) while maintaining the lowest Attack Success Rate (ASR) to date.' Table 1 confirms the lowest ASR (0–0.34%). UA is moderate but comparable to DeBERTa Detector (the other low-ASR method), supporting 'competitive' UA relative to ASR-comparable defenses.",
         "source": "opus"
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The conclusion claims 'deeper reasoning in LLMs positively correlates with improved BU, UA and ASR for ParseData' and that 'increased reasoning depth tends to introduce more errors' for CheckTool. These causal claims about reasoning depth are based on comparing only 3 models that differ in many ways beyond reasoning depth, with no controlled manipulation.",
         "source": "opus"
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Defense Against Indirect Prompt Injection' broadly, and the abstract motivates with 'autonomous systems and robotics.' Results are only on AgentDojo's four domains (banking, slack, travel, workspace) with 3 models and 3 attack types. The Limitations section notes English-only but doesn't bound to AgentDojo specifically.",
         "source": "opus"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of alternative explanations for the results. For example, the UA improvement under attack (Section 4.2.2) could have alternative explanations beyond the proposed mechanism, but only one interpretation is offered.",
         "source": "opus"
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures ASR, UA, BU, and Risk on AgentDojo, which directly tests defense against indirect prompt injection — the claimed outcome. The metrics measure exactly what is claimed (task completion rate and attack success rate). The broader framing about robotics is motivation, not a measured claim.",
         "source": "opus"
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' section is present after the Conclusion, discussing parameter hijacking attacks and English-only evaluation.",
         "source": "opus"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section identifies a specific threat: parameter hijacking attacks (e.g., redirecting payments via injected email addresses) bypass the defense because no unauthorized tool is called. This is specific to this study's approach.",
         "source": "opus"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section explicitly states what is NOT covered: parameter hijacking attacks and non-English languages. It also notes the lack of benchmarks for parameter hijacking.",
         "source": "opus"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information is disclosed anywhere in the paper. No acknowledgments section mentioning grants or sponsors.",
         "source": "opus"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: all three authors are from Harbin Institute of Technology with institutional email addresses.",
         "source": "opus"
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. The absence of a funding disclosure is not the same as confirming no conflicts.",
         "source": "opus"
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial disclosure is present in the paper.",
         "source": "opus"
       }
     },
     "scope_and_framing": {
       "key_terms_defined": {
         "applies": true,
         "answer": true,
         "justification": "IPI is defined in Section 1, LLM Agent (A, M, F) is formally defined in Section 3.1 with mathematical notation, and ParseData and CheckTool are precisely described; ASR, UA, BU, and Risk metrics are all defined in Table 5.",
         "source": "haiku"
       },
       "intended_contribution_clear": {
         "applies": true,
         "answer": true,
         "justification": "The abstract and introduction clearly state the contribution: a prompt-based defense mechanism using tool result parsing (ParseData module) and trigger sanitization (CheckTool module) to achieve lowest ASR against IPI.",
         "source": "haiku"
       },
       "engagement_with_prior_work": {
         "applies": true,
         "answer": true,
         "justification": "Section 2 systematically categorizes prior work into model-based and prompt-based defenses, explains weaknesses of each, and explicitly positions the proposed approach as addressing gaps in prompt-based detection accuracy.",
         "source": "haiku"
       }
     }
   },
   "type_checklist": {
     "empirical": {
       "artifacts": {
         "code_released": {
           "applies": true,
           "answer": true,
           "justification": "Abstract states 'Code is available at GitHub' with a link to https://github.com/qiang-yu/agentdojo/tree/tool-result-extract.",
           "source": "opus"
         },
         "data_released": {
           "applies": true,
           "answer": true,
           "justification": "The benchmark used is AgentDojo (Debenedetti et al., 2024), which is a publicly available framework. No custom data was collected.",
           "source": "opus"
         },
         "environment_specified": {
           "applies": true,
           "answer": false,
           "justification": "Only temperature (0) and context length (64KB) are specified. No requirements.txt, Dockerfile, or detailed environment setup listing library versions is provided.",
           "source": "opus"
         },
         "reproduction_instructions": {
           "applies": true,
           "answer": false,
           "justification": "No step-by-step reproduction instructions are provided in the paper. Code is released but no README or reproduction guide is described.",
           "source": "opus"
         }
       },
       "statistical_methodology": {
         "confidence_intervals_or_error_bars": {
           "applies": true,
           "answer": false,
           "justification": "All results in Tables 1–5 are point estimates with no confidence intervals, error bars, or uncertainty measures.",
           "source": "opus"
         },
         "significance_tests": {
           "applies": true,
           "answer": false,
           "justification": "The paper claims its methods 'significantly outperform' baselines (abstract, Section 4.2) but provides no statistical significance tests — comparisons are made by inspecting raw numbers only.",
           "source": "opus"
         },
         "effect_sizes_reported": {
           "applies": true,
           "answer": true,
           "justification": "Effect sizes are reported with baseline context: 'our methods yield a risk value of only 0.2%–1%, which is approximately 1/10 to 1/8 that of Tool Filter' (Section 4.2.1). Tables provide absolute values for all methods enabling direct comparison.",
           "source": "opus"
         },
         "sample_size_justified": {
           "applies": true,
           "answer": false,
           "justification": "AgentDojo contains 97 user tasks across 4 domains. No justification for why this sample size is adequate for the claims made, and no power analysis.",
           "source": "opus"
         },
         "variance_reported": {
           "applies": true,
           "answer": false,
           "justification": "No variance, standard deviation, or spread measures are reported. Results appear to be single-run numbers. Temperature is set to 0 but this is not discussed as justification for omitting variance.",
           "source": "opus"
         }
       },
       "evaluation_design": {
         "baselines_included": {
           "applies": true,
           "answer": true,
           "justification": "Four baseline defenses are compared: DeBERTa Detector, Repeat User Prompt, Spotlighting with Delimiting, and Tool Filter (Section 4.1).",
           "source": "opus"
         },
         "baselines_contemporary": {
           "applies": true,
           "answer": true,
           "justification": "All baselines are from 2024: DeBERTa Detector (ProtectAI.com, 2024), AgentDojo defenses (Debenedetti et al., 2024), Spotlighting (Hines et al., 2024). These represent the current state of the art.",
           "source": "opus"
         },
         "ablation_study": {
           "applies": true,
           "answer": true,
           "justification": "Section 4.3 presents ablation studies showing individual contributions of ParseData and CheckTool (Table 3), and ParseData vs ParseFull (Table 4). Multiple combination orderings are tested.",
           "source": "opus"
         },
         "multiple_metrics": {
           "applies": true,
           "answer": true,
           "justification": "Four metrics are used: Benign Utility (BU), Utility under Attack (UA), Attack Success Rate (ASR), and Risk (ASR/UA). Defined in Section 4.1.",
           "source": "opus"
         },
         "human_evaluation": {
           "applies": true,
           "answer": false,
           "justification": "No human evaluation is included. All evaluation is automated through the AgentDojo benchmark. Human evaluation could assess false positives where legitimate data is incorrectly filtered by ParseData.",
           "source": "opus"
         },
         "held_out_test_set": {
           "applies": true,
           "answer": false,
           "justification": "No distinction between development and test sets. The prompts in Appendices B–C were likely designed iteratively while observing AgentDojo results, but no held-out subset was used for final evaluation.",
           "source": "opus"
         },
         "per_category_breakdown": {
           "applies": true,
           "answer": true,
           "justification": "Table 5 provides per-attack-type breakdowns (Direct, Ignore Previous, Important Messages) and per-model breakdowns across all defense methods.",
           "source": "opus"
         },
         "failure_cases_discussed": {
           "applies": true,
           "answer": true,
           "justification": "The Limitations section discusses parameter hijacking as a specific failure mode that bypasses the defense. Section 4.3.1 discusses how CheckTool's reasoning leads to errors. Section 4.2.2 notes that qwen3-32b's deep thinking causes more mistakes with defenses.",
           "source": "opus"
         },
         "negative_results_reported": {
           "applies": true,
           "answer": true,
           "justification": "Several negative results are reported: CheckTool decreases BU with stronger reasoning models (Section 4.3.1), ParseFull decreases BU by 32.43% for llama-3.1-70b (Section 4.3.2), and combining modules 'diminishes overall utility compared to their standalone performance' (Section 4.3.1).",
           "source": "opus"
         }
       },
       "setup_transparency": {
         "model_versions_specified": {
           "applies": true,
           "answer": false,
           "justification": "Models are listed as 'gpt-oss-120b', 'Llama-3.1-70b', and 'qwen3-32b' (Section 4.1). No snapshot dates or API versions are provided. 'gpt-oss-120b' is not a recognized public model identifier.",
           "source": "opus"
         },
         "prompts_provided": {
           "applies": true,
           "answer": true,
           "justification": "Full prompt text for ParseData (Appendix B) and CheckTool (Appendix C) modules is provided, including the anticipation prompt, data extraction prompt, and trigger removal prompt.",
           "source": "opus"
         },
         "hyperparameters_reported": {
           "applies": true,
           "answer": true,
           "justification": "Section 4.1 states 'Temperature and context length are set to 0 and 64KB respectively.' These are the key LLM generation hyperparameters.",
           "source": "opus"
         },
         "scaffolding_described": {
           "applies": true,
           "answer": true,
           "justification": "Figure 1 provides architecture diagrams for both ParseData and CheckTool modules. Section 3.3–3.4 describe the workflow in detail: anticipation step, data extraction with format/logic constraints, tool trigger detection, and sanitization. Prompt text is in appendices.",
           "source": "opus"
         },
         "data_preprocessing_documented": {
           "applies": true,
           "answer": true,
           "justification": "The benchmark (AgentDojo) is used directly. Section 4.1 describes the benchmark structure: 4 domains, 97 total tasks, attack injection mechanism. No custom preprocessing is applied to the data.",
           "source": "opus"
         }
       },
       "data_integrity": {
         "raw_data_available": {
           "applies": true,
           "answer": false,
           "justification": "Code is released but no raw experimental logs, model outputs, or per-task results are mentioned as available. Only aggregated results in tables are provided.",
           "source": "opus"
         },
         "data_collection_described": {
           "applies": true,
           "answer": true,
           "justification": "Section 4.1 describes AgentDojo's structure: 4 domains (banking, slack, travel, workspace), 16+21+20+40 tasks, tool-based interactions, injection mechanism, and verification process.",
           "source": "opus"
         },
         "recruitment_methods_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants. The study uses the AgentDojo benchmark exclusively.",
           "source": "opus"
         },
         "data_pipeline_documented": {
           "applies": true,
           "answer": true,
           "justification": "The experimental pipeline is clear: user task → LLM reasoning → tool call → defense module (ParseData/CheckTool) → sanitized output → LLM response. Metric formulas are explicitly stated in Table 5.",
           "source": "opus"
         }
       },
       "contamination": {
         "training_cutoff_stated": {
           "applies": false,
           "answer": false,
           "justification": "The paper tests defense mechanisms against prompt injection, not model knowledge on benchmarks. AgentDojo evaluates agent behavior under attack, not whether models have memorized benchmark solutions.",
           "source": "opus"
         },
         "train_test_overlap_discussed": {
           "applies": false,
           "answer": false,
           "justification": "The paper tests defenses/tools rather than model knowledge. Contamination of AgentDojo tasks is not relevant to the defense evaluation.",
           "source": "opus"
         },
         "benchmark_contamination_addressed": {
           "applies": false,
           "answer": false,
           "justification": "The paper tests defenses/tools rather than model knowledge. The benchmark measures whether attacks succeed and tasks complete, not model recall capability.",
           "source": "opus"
         }
       },
       "human_studies": {
         "pre_registered": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "opus"
         },
         "irb_or_ethics_approval": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "opus"
         },
         "demographics_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "opus"
         },
         "inclusion_exclusion_criteria": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "opus"
         },
         "randomization_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "opus"
         },
         "blinding_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "opus"
         },
         "attrition_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants in this study.",
           "source": "opus"
         }
       },
       "cost_and_practicality": {
         "inference_cost_reported": {
           "applies": true,
           "answer": false,
           "justification": "The method adds extra LLM calls per tool invocation (ParseData requires 2 additional LLM calls, CheckTool requires 1-2). No inference cost, latency, or token overhead is reported.",
           "source": "opus"
         },
         "compute_budget_stated": {
           "applies": true,
           "answer": false,
           "justification": "No total computational budget is stated. The paper runs experiments across 3 models, 3 attacks, and 12 defense configurations but does not quantify total API costs or compute time.",
           "source": "opus"
         }
       },
       "experimental_rigor": {
         "seed_sensitivity_reported": {
           "applies": true,
           "answer": false,
           "justification": "No mention of multiple random seeds or seed sensitivity analysis. Temperature is set to 0 which reduces but does not eliminate stochasticity in API-based models.",
           "source": "opus"
         },
         "number_of_runs_stated": {
           "applies": true,
           "answer": false,
           "justification": "The number of experimental runs is not stated. Results appear to be from single runs.",
           "source": "opus"
         },
         "hyperparameter_search_budget": {
           "applies": true,
           "answer": false,
           "justification": "No hyperparameter search budget is reported. The prompt designs in Appendices B–C were presumably iterated but no search process is documented.",
           "source": "opus"
         },
         "best_config_selection_justified": {
           "applies": true,
           "answer": false,
           "justification": "Multiple configurations are tested (ParseData, ParseFull, CheckTool, and combinations in both orderings) but no justification for how the 'best' configuration was selected. No validation set is used for selection.",
           "source": "opus"
         },
         "multiple_comparison_correction": {
           "applies": true,
           "answer": false,
           "justification": "No statistical tests are performed at all, so no correction for multiple comparisons. The paper makes many comparisons across 3 models × 4 attacks × 12 defenses without any statistical framework.",
           "source": "opus"
         },
         "self_comparison_bias_addressed": {
           "applies": true,
           "answer": false,
           "justification": "The authors implement their own defense modules and compare against baselines within the same framework. No acknowledgment of potential bias in implementing and evaluating their own system.",
           "source": "opus"
         },
         "compute_budget_vs_performance": {
           "applies": true,
           "answer": false,
           "justification": "The proposed method adds multiple extra LLM calls per tool invocation compared to baselines that add zero or one. This compute cost difference is never discussed in relation to performance gains.",
           "source": "opus"
         },
         "benchmark_construct_validity": {
           "applies": true,
           "answer": false,
           "justification": "No discussion of whether AgentDojo accurately represents real-world indirect prompt injection threats. The benchmark's 4 domains and 97 tasks may not capture the full diversity of real-world agent deployments.",
           "source": "opus"
         },
         "scaffold_confound_addressed": {
           "applies": true,
           "answer": false,
           "justification": "The paper compares model performance (gpt-oss-120b vs llama-3.1-70b vs qwen3-32b) and attributes differences to 'reasoning depth' without controlling for other model differences. The defense modules interact with each model's capabilities differently but this confound is not addressed.",
           "source": "opus"
         }
       },
       "data_leakage": {
         "temporal_leakage_addressed": {
           "applies": true,
           "answer": false,
           "justification": "No discussion of whether the models could have seen AgentDojo tasks or similar patterns during training. AgentDojo was published in 2024; models may have been trained on its contents.",
           "source": "opus"
         },
         "feature_leakage_addressed": {
           "applies": true,
           "answer": false,
           "justification": "No discussion of feature leakage. The evaluation setup provides models with full tool definitions and conversation context, but whether this mirrors real-world information availability is not discussed.",
           "source": "opus"
         },
         "non_independence_addressed": {
           "applies": true,
           "answer": false,
           "justification": "No discussion of independence between AgentDojo tasks. Tasks within domains may share structural patterns that inflate performance estimates.",
           "source": "opus"
         },
         "leakage_detection_method": {
           "applies": true,
           "answer": false,
           "justification": "No leakage detection or prevention method is used.",
           "source": "opus"
         }
       }
     }
   },
   "claims": [
     {
       "claim": "ParseData+CheckTool and CheckTool+ParseData achieve ASR below 1%, approximately 1/10 that of the best competing defenses (DeBERTa Detector and Tool Filter).",
       "evidence": "Table 1 shows Avg ASR of 0.19% and 0.11% for gpt-oss-120b, compared to DeBERTa's 1.19% and Tool Filter's 1.71%.",
       "supported": "strong"
     },
     {
       "claim": "The proposed method achieves an Avg Risk of 0.2%–1%, approximately 1/10 to 1/8 that of Tool Filter (the next best baseline at 3%–6%).",
       "evidence": "Figure 3 shows Risk values of 0.22%–1.33% for the proposed methods vs. 2.93%–6.28% for Tool Filter across all three models.",
       "supported": "strong"
     },
     {
       "claim": "Deeper reasoning capability in LLMs positively correlates with ParseData performance but negatively affects CheckTool performance.",
       "evidence": "Table 3 shows qwen3-32b achieves BU 51.22% higher than CheckTool with ParseData, while CheckTool BU is substantially lower; attributed to deep thinking causing over-identification of triggers.",
       "supported": "moderate"
     },
     {
       "claim": "The 'Important Messages' attack achieves consistently the highest ASR across all models and defenses.",
       "evidence": "Table 5 shows Important Messages ASR is higher than Direct and Ignore Previous for every defense-model combination, consistent with the claim in Debenedetti et al. 2024.",
       "supported": "strong"
     },
     {
       "claim": "Existing prompt-based defenses (Repeat User Prompt, Spotlighting with Delimiting) leave ASR above 10% under the Important Messages attack, making them impractical.",
       "evidence": "Table 2 shows Repeat User Prompt ASR of 14.75%/11.80%/16.86% and Spotlighting ASR of 23.29%/13.17%/25.08% for gpt-oss-120b, llama-3.1-70b, qwen3-32b respectively under Important Messages.",
       "supported": "strong"
     },
     {
       "claim": "qwen3-32b achieves 0% ASR under the Important Messages attack with CheckTool+ParseData, but at the cost of substantially reduced benign utility.",
       "evidence": "Table 2 shows qwen3-32b CheckTool+ParseData achieves 0.00% ASR but only 37.11% BU vs. 83.51% BU for No Defense.",
       "supported": "strong"
     }
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "The paper proposes a two-module prompt-based defense against indirect prompt injection: ParseData extracts only the minimal necessary data from tool results using LLM-driven format and logic constraints, while CheckTool detects and sanitizes content that triggers unauthorized tool calls. Evaluated on AgentDojo with three LLMs (gpt-oss-120b, llama-3.1-70b, qwen3-32b) and three attack types, the combined ParseData+CheckTool achieves average ASR below 1% across all models—approximately 1/10 that of the next best defenses—while maintaining moderate utility. A key tradeoff is identified: deeper-reasoning models (qwen3-32b) benefit ParseData but are harmed by CheckTool, which over-triggers and removes legitimate data. The defense does not address parameter hijacking attacks, which represent a significant uncovered attack class.",
   "red_flags": [
     {
       "flag": "Unrecognizable model name",
       "detail": "'gpt-oss-120b' is not a known public OpenAI model; results on this model cannot be independently verified or reproduced, undermining a third of the experimental evidence."
     },
     {
       "flag": "No statistical significance tests",
       "detail": "All comparative claims between defense methods are made without significance tests, confidence intervals, or variance across runs despite the small benchmark size (97 total tasks)."
     },
     {
       "flag": "Single-run results only",
       "detail": "With temperature=0 determinism reduces variance, but no multi-run or cross-domain breakdown is given; all results are single point estimates with no uncertainty quantification."
     },
     {
       "flag": "Large benign utility drop unaddressed",
       "detail": "The proposed methods reduce benign utility by 28–45% relative to No Defense, but the paper does not discuss the practical acceptability of this degradation or compare it to user tolerance thresholds."
     },
     {
       "flag": "No funding disclosure",
       "detail": "No funding source or acknowledgments section; conflicts of interest are absent."
     },
     {
       "flag": "Contamination not discussed",
       "detail": "Models tested (especially qwen3-32b, released 2025) may have been trained on AgentDojo (NeurIPS 2024); this could affect baseline susceptibility estimates but is not acknowledged."
     }
   ],
   "cited_papers": [
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents",
       "relevance": "Primary benchmark used for all experiments; provides the attack suite and evaluation framework"
     },
     {
       "title": "StruQ: Defending Against Prompt Injection with Structured Queries",
       "relevance": "Key baseline fine-tuning approach that separates instructions from data at the model level"
     },
     {
       "title": "Defending Against Indirect Prompt Injection Attacks With Spotlighting",
       "relevance": "Baseline defense using delimiters to distinguish data from instructions"
     },
     {
       "title": "MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents",
       "relevance": "Recent defense using monitoring of suspicious tool calls, directly comparable approach"
     },
     {
       "title": "Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents",
       "relevance": "Establishes threat model for adaptive attacks that defenses must handle"
     },
     {
       "title": "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection",
       "relevance": "Foundational work on IPI attacks including privacy leakage and fraud scenarios"
     },
     {
       "title": "Defense Against Prompt Injection Attack by Leveraging Attack Techniques",
       "relevance": "Baseline prompt-based defense that uses hijacking techniques defensively"
     },
     {
       "title": "The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents",
       "relevance": "Alternative defense using correlation between user instructions and assistant messages"
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Proposes deployable prompt-based defense modules (ParseData/CheckTool) that practitioners building LLM agents could integrate, though the 28-45% utility cost limits immediate adoption."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The approach of parsing/filtering tool results rather than detecting injections is a modest reframing, but the core finding that prompt-based defenses can achieve <1% ASR is incrementally better rather than surprising."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Directly addresses indirect prompt injection in LLM agents with concrete attack demonstrations and defense benchmarks, a real and growing security concern as agents gain tool-use capabilities."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy or conflict — straightforwardly proposes a defense and compares against baselines without challenging any company or widely-held belief."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Code is available on GitHub and uses the AgentDojo benchmark, but requires setting up multiple LLM APIs and the benchmark framework to reproduce."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "From Harbin Institute of Technology with no famous-lab cachet, uses an unrecognized model name (gpt-oss-120b), and the topic lacks association with a household-name product."
     }
   },
   "hn_data": {
     "threads": [
       {
         "hn_id": "46624374",
         "title": "Quantum Automated Theorem Proving",
         "points": 5,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=46624374",
         "created_at": "2026-01-14T22:06:27Z"
       }
     ],
     "top_points": 5,
     "total_points": 5,
     "total_comments": 0
   }
 }