ai-research-survey

scan.json (31007B)

---

 {
   "paper": {
     "title": "Defense Against Indirect Prompt Injection via Tool Result Parsing",
     "authors": [
       "Qiang Yu",
       "Xinran Cheng",
       "Chuanyi Liu"
     ],
     "year": 2026,
     "venue": "arXiv.org",
     "arxiv_id": "2601.04795",
     "doi": "10.48550/arXiv.2601.04795"
   },
   "scan_version": 3,
   "active_modules": [
     "experimental_rigor",
     "data_leakage"
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "The paper proposes ParseData and CheckTool, two prompt-based defense modules against indirect prompt injection in LLM agents. ParseData extracts only needed data from tool results using format/logic constraints, while CheckTool detects and removes content that triggers unauthorized tool calls. On the AgentDojo benchmark with three LLMs (gpt-oss-120b, llama-3.1-70b, qwen3-32b), the combined methods achieve average ASR of 0–1.33% and average Risk of 0–1.33%, roughly 1/10 that of the next-best defense (Tool Filter), at the cost of 28–45% reduction in benign utility.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "Abstract states 'Code is available at GitHub' with a link to https://github.com/qiang-yu/agentdojo/tree/tool-result-extract."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The benchmark used is AgentDojo (Debenedetti et al., 2024), which is a publicly available framework. No custom data was collected."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Only temperature (0) and context length (64KB) are specified. No requirements.txt, Dockerfile, or detailed environment setup listing library versions is provided."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. Code is released but no README or reproduction guide is described."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1–5 are point estimates with no confidence intervals, error bars, or uncertainty measures."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims its methods 'significantly outperform' baselines (abstract, Section 4.2) but provides no statistical significance tests — comparisons are made by inspecting raw numbers only."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are reported with baseline context: 'our methods yield a risk value of only 0.2%–1%, which is approximately 1/10 to 1/8 that of Tool Filter' (Section 4.2.1). Tables provide absolute values for all methods enabling direct comparison."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "AgentDojo contains 97 user tasks across 4 domains. No justification for why this sample size is adequate for the claims made, and no power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported. Results appear to be single-run numbers. Temperature is set to 0 but this is not discussed as justification for omitting variance."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Four baseline defenses are compared: DeBERTa Detector, Repeat User Prompt, Spotlighting with Delimiting, and Tool Filter (Section 4.1)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "All baselines are from 2024: DeBERTa Detector (ProtectAI.com, 2024), AgentDojo defenses (Debenedetti et al., 2024), Spotlighting (Hines et al., 2024). These represent the current state of the art."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 presents ablation studies showing individual contributions of ParseData and CheckTool (Table 3), and ParseData vs ParseFull (Table 4). Multiple combination orderings are tested."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Four metrics are used: Benign Utility (BU), Utility under Attack (UA), Attack Success Rate (ASR), and Risk (ASR/UA). Defined in Section 4.1."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is included. All evaluation is automated through the AgentDojo benchmark. Human evaluation could assess false positives where legitimate data is incorrectly filtered by ParseData."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No distinction between development and test sets. The prompts in Appendices B–C were likely designed iteratively while observing AgentDojo results, but no held-out subset was used for final evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 5 provides per-attack-type breakdowns (Direct, Ignore Previous, Important Messages) and per-model breakdowns across all defense methods."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section discusses parameter hijacking as a specific failure mode that bypasses the defense. Section 4.3.1 discusses how CheckTool's reasoning leads to errors. Section 4.2.2 notes that qwen3-32b's deep thinking causes more mistakes with defenses."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results are reported: CheckTool decreases BU with stronger reasoning models (Section 4.3.1), ParseFull decreases BU by 32.43% for llama-3.1-70b (Section 4.3.2), and combining modules 'diminishes overall utility compared to their standalone performance' (Section 4.3.1)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'competitive Utility under Attack (UA) while maintaining the lowest Attack Success Rate (ASR) to date.' Table 1 confirms the lowest ASR (0–0.34%). UA is moderate but comparable to DeBERTa Detector (the other low-ASR method), supporting 'competitive' UA relative to ASR-comparable defenses."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The conclusion claims 'deeper reasoning in LLMs positively correlates with improved BU, UA and ASR for ParseData' and that 'increased reasoning depth tends to introduce more errors' for CheckTool. These causal claims about reasoning depth are based on comparing only 3 models that differ in many ways beyond reasoning depth, with no controlled manipulation."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Defense Against Indirect Prompt Injection' broadly, and the abstract motivates with 'autonomous systems and robotics.' Results are only on AgentDojo's four domains (banking, slack, travel, workspace) with 3 models and 3 attack types. The Limitations section notes English-only but doesn't bound to AgentDojo specifically."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of alternative explanations for the results. For example, the UA improvement under attack (Section 4.2.2) could have alternative explanations beyond the proposed mechanism, but only one interpretation is offered."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures ASR, UA, BU, and Risk on AgentDojo, which directly tests defense against indirect prompt injection — the claimed outcome. The metrics measure exactly what is claimed (task completion rate and attack success rate). The broader framing about robotics is motivation, not a measured claim."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are listed as 'gpt-oss-120b', 'Llama-3.1-70b', and 'qwen3-32b' (Section 4.1). No snapshot dates or API versions are provided. 'gpt-oss-120b' is not a recognized public model identifier."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt text for ParseData (Appendix B) and CheckTool (Appendix C) modules is provided, including the anticipation prompt, data extraction prompt, and trigger removal prompt."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 states 'Temperature and context length are set to 0 and 64KB respectively.' These are the key LLM generation hyperparameters."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "Figure 1 provides architecture diagrams for both ParseData and CheckTool modules. Section 3.3–3.4 describe the workflow in detail: anticipation step, data extraction with format/logic constraints, tool trigger detection, and sanitization. Prompt text is in appendices."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "The benchmark (AgentDojo) is used directly. Section 4.1 describes the benchmark structure: 4 domains, 97 total tasks, attack injection mechanism. No custom preprocessing is applied to the data."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' section is present after the Conclusion, discussing parameter hijacking attacks and English-only evaluation."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section identifies a specific threat: parameter hijacking attacks (e.g., redirecting payments via injected email addresses) bypass the defense because no unauthorized tool is called. This is specific to this study's approach."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section explicitly states what is NOT covered: parameter hijacking attacks and non-English languages. It also notes the lack of benchmarks for parameter hijacking."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Code is released but no raw experimental logs, model outputs, or per-task results are mentioned as available. Only aggregated results in tables are provided."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes AgentDojo's structure: 4 domains (banking, slack, travel, workspace), 16+21+20+40 tasks, tool-based interactions, injection mechanism, and verification process."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study uses the AgentDojo benchmark exclusively."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The experimental pipeline is clear: user task → LLM reasoning → tool call → defense module (ParseData/CheckTool) → sanitized output → LLM response. Metric formulas are explicitly stated in Table 5."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information is disclosed anywhere in the paper. No acknowledgments section mentioning grants or sponsors."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: all three authors are from Harbin Institute of Technology with institutional email addresses."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. The absence of a funding disclosure is not the same as confirming no conflicts."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial disclosure is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defense mechanisms against prompt injection, not model knowledge on benchmarks. AgentDojo evaluates agent behavior under attack, not whether models have memorized benchmark solutions."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defenses/tools rather than model knowledge. Contamination of AgentDojo tasks is not relevant to the defense evaluation."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defenses/tools rather than model knowledge. The benchmark measures whether attacks succeed and tasks complete, not model recall capability."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The method adds extra LLM calls per tool invocation (ParseData requires 2 additional LLM calls, CheckTool requires 1-2). No inference cost, latency, or token overhead is reported."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. The paper runs experiments across 3 models, 3 attacks, and 12 defense configurations but does not quantify total API costs or compute time."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. Temperature is set to 0 which reduces but does not eliminate stochasticity in API-based models."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is not stated. Results appear to be from single runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. The prompt designs in Appendices B–C were presumably iterated but no search process is documented."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "Multiple configurations are tested (ParseData, ParseFull, CheckTool, and combinations in both orderings) but no justification for how the 'best' configuration was selected. No validation set is used for selection."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "No statistical tests are performed at all, so no correction for multiple comparisons. The paper makes many comparisons across 3 models × 4 attacks × 12 defenses without any statistical framework."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement their own defense modules and compare against baselines within the same framework. No acknowledgment of potential bias in implementing and evaluating their own system."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "The proposed method adds multiple extra LLM calls per tool invocation compared to baselines that add zero or one. This compute cost difference is never discussed in relation to performance gains."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AgentDojo accurately represents real-world indirect prompt injection threats. The benchmark's 4 domains and 97 tasks may not capture the full diversity of real-world agent deployments."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper compares model performance (gpt-oss-120b vs llama-3.1-70b vs qwen3-32b) and attributes differences to 'reasoning depth' without controlling for other model differences. The defense modules interact with each model's capabilities differently but this confound is not addressed."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the models could have seen AgentDojo tasks or similar patterns during training. AgentDojo was published in 2024; models may have been trained on its contents."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of feature leakage. The evaluation setup provides models with full tool definitions and conversation context, but whether this mirrors real-world information availability is not discussed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of independence between AgentDojo tasks. Tasks within domains may share structural patterns that inflate performance estimates."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is used."
       }
     }
   },
   "claims": [
     {
       "claim": "ParseData+CheckTool and CheckTool+ParseData achieve the lowest Attack Success Rate (ASR) to date, with average ASR below 1%.",
       "evidence": "Table 1 shows average ASR of 0.19%/0.11% (gpt-oss-120b), 0.34%/0.24% (llama-3.1-70b), and 0.11%/0.00% (qwen3-32b) for the two combined methods, compared to next-best Tool Filter at 1.71%/2.32%/2.58%.",
       "supported": "strong"
     },
     {
       "claim": "The proposed methods achieve a Risk metric of 0.2%–1%, approximately 1/10 to 1/8 that of Tool Filter.",
       "evidence": "Figure 3 shows Avg Risk values of 0.22–1.33% for the proposed methods vs 2.93–6.28% for Tool Filter across three models.",
       "supported": "strong"
     },
     {
       "claim": "Deeper LLM reasoning positively correlates with improved ParseData performance.",
       "evidence": "Section 4.3.1 compares three models: qwen3-32b achieves BU 51.22% higher than CheckTool and ASR 19.26% lower, attributed to stronger reasoning. However, this is based on only 3 models that differ in many dimensions beyond reasoning.",
       "supported": "weak"
     },
     {
       "claim": "CheckTool performance degrades with deeper reasoning as the LLM mistakenly identifies normal data as tool triggers.",
       "evidence": "Section 4.3.1 notes that for qwen3-32b, CheckTool's BU is 42.27% (lowest), attributed to the model's deep thinking introducing errors. Only 3 models compared.",
       "supported": "weak"
     },
     {
       "claim": "The proposed defense maintains competitive Utility under Attack (UA) compared to existing methods.",
       "evidence": "Table 1: for gpt-oss-120b, ParseData+CheckTool achieves 51.84% Avg UA vs 61.46% No Defense. For llama-3.1-70b, 26.64% vs 40.35%. UA is comparable to DeBERTa Detector (the other low-ASR method) but substantially lower than no-defense and some prompt-based defenses.",
       "supported": "moderate"
     },
     {
       "claim": "Under severe attack (Important Messages), the proposed methods improve utility compared to no-defense conditions, unlike other defense mechanisms which show utility decline.",
       "evidence": "Table 2: for qwen3-32b, ParseData+CheckTool achieves 47.42% UA under Important Messages attack vs 45.36% BU under no attack — an increase. Section 4.2.2 explains this anomaly: parsing filters attacks that otherwise cause task failures.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No uncertainty quantification",
       "detail": "All results are single-run point estimates with no error bars, confidence intervals, or variance measures across any of the 108+ experimental configurations (3 models × 4 attack conditions × 12 defenses). Claims of 'significantly outperforming' are made without statistical tests."
     },
     {
       "flag": "Unrecognized model identifier",
       "detail": "'gpt-oss-120b' is not a publicly recognized model name. It may be anonymized, a private model, or a future release. This undermines reproducibility since readers cannot identify or access this model."
     },
     {
       "flag": "Significant utility cost downplayed",
       "detail": "BU drops of 28% (gpt-oss-120b) to 45% (llama-3.1-70b, qwen3-32b) compared to no defense are noted in passing but not prominently discussed as a major limitation. A defense that halves task completion rate has serious practical implications."
     },
     {
       "flag": "Causal claims from 3 data points",
       "detail": "The conclusion makes causal claims about 'reasoning depth' affecting ParseData and CheckTool performance based on comparing only 3 models that differ in many dimensions (architecture, training data, size, instruction tuning approach)."
     },
     {
       "flag": "No cost analysis despite extra LLM calls",
       "detail": "ParseData adds 2 LLM calls per tool invocation (anticipation + extraction), and CheckTool adds 1-2 more (check + optional sanitization). This potentially triples or quadruples inference cost, but no cost analysis is provided."
     },
     {
       "flag": "Potential benchmark overfitting",
       "detail": "The prompts were presumably iteratively designed while testing on AgentDojo, but no held-out set or cross-validation is used. Results may not generalize beyond AgentDojo's 97 tasks in 4 domains."
     }
   ],
   "cited_papers": [
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents",
       "authors": [
         "Edoardo Debenedetti",
         "Jie Zhang",
         "Mislav Balunovic",
         "Luca Beurer-Kellner",
         "Marc Fischer",
         "Florian Tramèr"
       ],
       "year": 2024,
       "relevance": "Primary benchmark used for evaluation; provides standardized framework for testing indirect prompt injection attacks and defenses on LLM agents."
     },
     {
       "title": "StruQ: Defending Against Prompt Injection with Structured Queries",
       "authors": [
         "Sizhe Chen",
         "Julien Piet",
         "Chawin Sitawarin",
         "David Wagner"
       ],
       "year": 2025,
       "relevance": "Training-based defense approach that fine-tunes LLMs to separate instructions from data using structured queries."
     },
     {
       "title": "MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents",
       "authors": [
         "Kaijie Zhu",
         "Xianjun Yang",
         "Jindong Wang",
         "Wenbo Guo",
         "William Yang Wang"
       ],
       "year": 2025,
       "relevance": "Detection-based defense that identifies prompt injections when suspicious tool calls are about to be executed."
     },
     {
       "title": "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection",
       "authors": [
         "Kai Greshake",
         "Sahar Abdelnabi",
         "Shailesh Mishra",
         "Christoph Endres",
         "Thorsten Holz",
         "Mario Fritz"
       ],
       "year": 2023,
       "relevance": "Foundational work demonstrating indirect prompt injection attacks on LLM-integrated applications including privacy leakage and malware distribution."
     },
     {
       "title": "Defending Against Indirect Prompt Injection Attacks With Spotlighting",
       "authors": [
         "Keegan Hines",
         "Gary Lopez",
         "Matthew Hall",
         "Federico Zarfati",
         "Yonatan Zunger",
         "Emre Kiciman"
       ],
       "year": 2024,
       "relevance": "Baseline defense method using delimiters to separate data from instructions, evaluated as a comparison in this work."
     },
     {
       "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions",
       "authors": [
         "Eric Wallace",
         "Kai Xiao",
         "Reimar Leike",
         "Lilian Weng",
         "Johannes Heidecke",
         "Alex Beutel"
       ],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Proposes training LLMs to prioritize user instructions over injected content, relevant to the instruction-data separation problem."
     },
     {
       "title": "The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents",
       "authors": [
         "Feiran Jia",
         "Tong Wu",
         "Xin Qin",
         "Anna Cinzia Squicciarini"
       ],
       "year": 2025,
       "relevance": "Defense approach that evaluates correlation between user instructions and assistant messages to detect workflow compromises."
     },
     {
       "title": "Can Indirect Prompt Injection Attacks Be Detected and Removed?",
       "authors": [
         "Yulin Chen",
         "Haoran Li",
         "Yuan Sui",
         "Yufei He",
         "Yue Liu",
         "Yangqiu Song",
         "Bryan Hooi"
       ],
       "year": 2025,
       "relevance": "Trains auxiliary lightweight models to detect and remove indirect prompt injections from external prompts."
     },
     {
       "title": "Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents",
       "authors": [
         "Qiusi Zhan",
         "Richard Fang",
         "Henil Shalin Panchal",
         "Daniel Kang"
       ],
       "year": 2025,
       "relevance": "Demonstrates that adaptive attacks can circumvent existing IPI defenses, relevant to evaluating defense robustness."
     },
     {
       "title": "IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems",
       "authors": [
         "Yuhao Wu",
         "Franziska Roesner",
         "Tadayoshi Kohno",
         "Ning Zhang",
         "Umar Iqbal"
       ],
       "year": 2025,
       "relevance": "Proposes execution isolation as a defense mechanism for LLM agents, representing the privilege-control approach to IPI defense."
     },
     {
       "title": "Ignore Previous Prompt: Attack Techniques For Language Models",
       "authors": [
         "Fábio Perez",
         "Ian Ribeiro"
       ],
       "year": 2022,
       "relevance": "Foundational work on prompt injection attack techniques, including the 'ignore previous instructions' attack pattern used in this paper's evaluation."
     },
     {
       "title": "A Survey on Trustworthy LLM Agents: Threats and Countermeasures",
       "authors": [
         "Miao Yu",
         "Fanci Meng",
         "Xinyun Zhou"
       ],
       "year": 2025,
       "relevance": "Comprehensive survey of threats and countermeasures for LLM agents, providing broader context for the prompt injection defense landscape."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Proposes deployable prompt-based defense modules (ParseData/CheckTool) that practitioners building LLM agents could integrate, though the 28-45% utility cost limits immediate adoption."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The approach of parsing/filtering tool results rather than detecting injections is a modest reframing, but the core finding that prompt-based defenses can achieve <1% ASR is incrementally better rather than surprising."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Directly addresses indirect prompt injection in LLM agents with concrete attack demonstrations and defense benchmarks, a real and growing security concern as agents gain tool-use capabilities."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy or conflict — straightforwardly proposes a defense and compares against baselines without challenging any company or widely-held belief."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Code is available on GitHub and uses the AgentDojo benchmark, but requires setting up multiple LLM APIs and the benchmark framework to reproduce."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "From Harbin Institute of Technology with no famous-lab cachet, uses an unrecognized model name (gpt-oss-120b), and the topic lacks association with a household-name product."
     }
   }
 }