ai-research-survey

scan.json (30306B)

---

 {
   "paper": {
     "title": "Detection Method for Prompt Injection by Integrating Pre-trained Model and Heuristic Feature Engineering",
     "authors": [
       "Yi Ji",
       "Runzhi Li",
       "Baolei Mao"
     ],
     "year": 2025,
     "venue": "Knowledge Science, Engineering and Management",
     "arxiv_id": "2506.06384",
     "doi": "10.48550/arXiv.2506.06384"
   },
   "scan_version": 3,
   "active_modules": [
     "experimental_rigor",
     "data_leakage"
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "DMPI-PMHFE, a dual-channel feature fusion framework combining DeBERTa-v3-base semantic extraction with heuristic rule-based feature engineering, outperforms four existing detection baselines (Fmops, ProtectAI, SafeGuard, InjecGuard) on accuracy, recall, and F1-score across three datasets. Ablation experiments confirm each module contributes positively. When deployed as an active defense, it reduces attack success rates to 10-14% across five LLMs (GLM-4, LLaMA 3 variants, Qwen 2.5, GPT-4o), outperforming Self-Reminder and Self-Defense baselines. However, no statistical tests, error bars, or multi-run results are reported.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, code archive, or link to source code is provided anywhere in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper creates safeguard-v2 by augmenting a public HuggingFace dataset and constructing deepset-v2 and ivanleomk-v2, but does not release these custom datasets. The base HuggingFace datasets are public, but the augmented versions used for training and evaluation are not made available."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper specifies DeBERTa-v3-base and en_core_web_sm tokenizer, plus training hyperparameters (Section 4.2), but provides no requirements.txt, Python version, GPU specifications, or dependency versions needed to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. A researcher would need to reconstruct the entire pipeline from the method description."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Tables 1, 2, and 3 report only point estimates for all metrics (accuracy, precision, recall, F1, ASR). No confidence intervals, error bars, or uncertainty measures are provided."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims DMPI-PMHFE 'outperforms' and is 'superior to' baselines based solely on comparing raw numbers. No statistical significance tests (p-values, t-tests, etc.) are used."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Results are reported with baseline context throughout. For example, Table 3 and Section 4.3 state 'reduces the ASR of glm-4-9b-chat from 71.71% to 14.34%' and the ablation shows recall improving 'from 93.27% to 98.59%' on safeguard-v2, providing clear before/after context for the magnitude of improvements."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is given for the dataset sizes (10,400 training, 1,300 test, etc.) or the 251-sample defense benchmark. No power analysis is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance across runs, or any spread measures are reported. All results appear to be from single runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Four detection baselines (Fmops, ProtectAI, SafeGuard, InjecGuard) are compared in Table 1, and two defense baselines (Self-Reminder, Self-Defense) plus undefended base models in Table 3."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include InjecGuard (2024), SafeGuard (2023), ProtectAI (2024), and Self-Reminder (2023). These are recent and described as 'currently widely applied on Hugging Face, enjoying high recognition and practical value.'"
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 presents ablation experiments progressively adding modules: M1 (DeBERTa only), M1+M2 (+ synonym matching), M1+M2+M3 (+ pattern matching), showing each module's contribution across all three datasets."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Four metrics (accuracy, precision, recall, F1-score) are used for detection evaluation (Table 1, 2) and attack success rate (ASR) for defense evaluation (Table 3)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation of the system's detection outputs is performed. Manual verification was used only during dataset creation (quality assurance for safeguard-v2), not to evaluate the model's predictions."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 states safeguard-v2 is 'divided into training (10,400 samples, 80%), validation (1,300 samples, 10%), and test sets (1,300 samples, 10%).' Additionally, two external validation datasets (deepset-v2, ivanleomk-v2) are used."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down per dataset (safeguard-v2, Ivanleomk-v2, deepset-v2) in Tables 1-2, and per LLM model in Table 3. However, no per-attack-type breakdown is provided."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No qualitative examples of failures or error analysis are shown. The paper mentions precision decreases when M3 is added and notes performance variation across datasets, but does not examine specific cases where the detector fails."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that adding M3 causes precision to decrease (e.g., from 99.58% to 98.00% on safeguard-v2) and discusses the trade-off: 'M3 expands detection coverage to capture more attack variants, inevitably introducing some false positives.'"
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims DMPI-PMHFE 'outperforms existing methods in terms of accuracy, recall, and F1-score' — Table 1 confirms the highest values in these metrics across all three datasets. The abstract claims it 'significantly reduces attack success rates across mainstream LLMs' — Table 3 confirms the lowest ASR across all five tested LLMs."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The main causal claims come from the ablation study (Table 2), which uses controlled single-variable manipulation: progressively adding M2 and M3 to M1. The claim that each module 'contributes positively' is supported by consistent improvements across all datasets and metrics."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims a general 'Detection Method for Prompt Injection' but the paper only tests direct prompt injection (explicitly stated: 'We focus on detecting direct prompt injection'). The paper does not bound its title-level claims to this scope. Additionally, only English-language datasets are used without noting this limitation."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations for the results are discussed. The paper does not consider confounds such as whether the heuristic rules simply overfit to the specific attack patterns in the test sets, or whether the improvement is driven by dataset overlap between safeguard-v2 training and test distributions."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures detection accuracy/F1 and claims detection effectiveness, and measures ASR and claims defense effectiveness. The measurements directly correspond to the claims — there is minimal proxy-outcome gap."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "DeBERTa-v3-base is specified for the detection model. For LLMs, 'glm-4-9b-chat, Llama-3-8B-Instruct, Llama-3.3-70B-Instruct, Qwen2.5-7B-Instruct' are adequately specified, but 'ChatGPT-4o' lacks a snapshot date or API version. GPT-4o is also used for data generation without version specification."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "GPT-4o was used to generate 3,000 training samples via 'prompt engineering' but the prompts are not provided. The defense evaluation uses a benchmark (ref [28]) but the system prompts or how attacks were presented to LLMs are not fully documented."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 reports: Adam optimizer, cross-entropy loss, learning rate 2e-5, batch size 16, weight decay 0.02, early stopping with patience 3. The many-shot threshold of 3 is also documented. However, LLM inference parameters (temperature, etc.) for defense evaluation are not stated."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. DMPI-PMHFE is a classifier that operates as a filter before LLM input."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 documents dataset construction: augmenting xTRam1/safeguard-prompt-injections with 15 attack patterns, generating 3,000 samples via GPT-4o, and a three-stage quality process (manual verification, deduplication, balanced sampling). Train/val/test split ratios (80/10/10) are specified."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations section. The Conclusion contains two sentences: 'Nevertheless, this study has certain limitations. The precision of DMPI-PMHFE requires further enhancement.' This is insufficient for a substantive discussion."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The only limitation mentioned is precision needing improvement. No specific threats to validity are discussed — no consideration of overfitting to known attack patterns, generalization to new attacks, dataset bias, or language limitations."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 1 explicitly states 'We focus on detecting direct prompt injection,' distinguishing from indirect prompt injection. This bounds the scope of the work to a specific attack category."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The safeguard-v2 dataset, deepset-v2, and ivanleomk-v2 (the augmented versions) are not released. Only the original base datasets are public on HuggingFace."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes data collection: base dataset from HuggingFace (7,000 benign + 3,000 malicious), augmented with 15 attack patterns via GPT-4o (3,000 samples), quality assured through manual verification, deduplication, and balanced sampling."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are public HuggingFace datasets and GPT-4o generated samples."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from base dataset (10,000) + GPT-4o generation (3,000) → safeguard-v2 (13,000) → 80/10/10 split (10,400/1,300/1,300) is documented with counts at each stage. External validation datasets (354 and 610 samples) are identified by source."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All three authors list Zhengzhou University affiliations with ORCID IDs and email addresses. They are not evaluating their own commercial product."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funding is disclosed. The work appears to be unfunded university research."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper trains its own classifier (fine-tuned DeBERTa) and tests defenses against prompt injection attacks. It does not evaluate a pre-trained model's zero-shot capability on a benchmark. The LLMs are tested for vulnerability, not knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same rationale: the paper tests defense effectiveness, not model knowledge capability on benchmarks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same rationale: this is a defense evaluation study, not a model capability benchmark."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference latency or cost is reported for the detection model. For a system proposed as an active defense filter that processes every input before reaching the LLM, latency is a critical practical concern."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No GPU hours, training time, hardware specifications, or total computational budget are stated anywhere in the paper."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds or seed sensitivity analysis. Results appear to be from single runs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. It is unclear whether results are from one run or averaged over multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "A sensitivity analysis is described for the many-shot threshold (selected as 3), but no overall hyperparameter search budget is reported — number of configurations tried, search method, or compute spent on tuning are not documented."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The many-shot threshold selection is justified via sensitivity analysis, but the overall model configuration (learning rate, batch size, weight decay) appears to use standard defaults without justification for why these specific values were chosen."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed at all, so correction for multiple comparisons is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own system against baselines without acknowledging author-evaluation bias. While the baselines are published HuggingFace models (not re-implementations), the evaluation setup and datasets are controlled by the authors."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No comparison of computational costs between DMPI-PMHFE and baselines. The dual-channel architecture may be more expensive than single-model baselines, but this is not discussed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the benchmarks (safeguard-v2, deepset-v2, ivanleomk-v2) adequately represent real-world prompt injection attacks, or whether high detection scores on these datasets translate to effective real-world defense."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved in the detection approach."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "DeBERTa-v3-base is pre-trained on general text. No discussion of whether any test data patterns appeared in DeBERTa's pre-training corpus or in GPT-4o's training data (used to generate samples)."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the heuristic features (keyword lists, pattern rules) derived from training data leak information about the test distribution, or whether GPT-4o-generated training samples share distributional properties with the test set."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Training and test data for safeguard-v2 come from the same augmented dataset via random splitting. No discussion of whether samples within the same attack category share structural similarities that could inflate test performance."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are used. No deduplication between train and test beyond the general deduplication step during dataset construction."
       }
     }
   },
   "claims": [
     {
       "claim": "DMPI-PMHFE outperforms existing detection methods (Fmops, ProtectAI, SafeGuard, InjecGuard) in accuracy, recall, and F1-score across three benchmark datasets.",
       "evidence": "Table 1 (Section 4.3): Highest accuracy (97.94%, 94.75%, 91.24%), recall (98.59%, 93.93%, 84.31%), and F1-score (98.29%, 96.03%, 90.21%) on safeguard-v2, Ivanleomk-v2, and deepset-v2 respectively.",
       "supported": "moderate"
     },
     {
       "claim": "Each module (DeBERTa, synonym matching, pattern matching) contributes positively to detection performance.",
       "evidence": "Table 2 (Section 4.3): Progressive addition of M2 and M3 consistently improves accuracy, recall, and F1 across all three datasets. E.g., recall on safeguard-v2 goes from 93.27% (M1) to 95.64% (M1+M2) to 98.59% (M1+M2+M3).",
       "supported": "moderate"
     },
     {
       "claim": "DMPI-PMHFE significantly reduces attack success rates across mainstream LLMs compared to Self-Reminder and Self-Defense.",
       "evidence": "Table 3 (Section 4.3): ASR reduced to 10.35-14.34% across five LLMs. On glm-4-9b-chat, ASR drops from 71.71% (undefended) to 14.34% (DMPI-PMHFE) vs 35.45% (Self-Reminder) and 39.04% (Self-Defense).",
       "supported": "moderate"
     },
     {
       "claim": "DMPI-PMHFE offers consistent protection across diverse LLM architectures, unlike Self-Reminder and Self-Defense which vary significantly.",
       "evidence": "Table 3: DMPI-PMHFE ASR ranges 10.35-14.34% (4pp spread) across LLMs, while Self-Reminder ranges 19.52-39.84% (20pp spread) and Self-Defense 15.53-41.03% (25pp spread).",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or uncertainty quantification",
       "detail": "All results across Tables 1-3 are point estimates with no confidence intervals, standard deviations, or indication of how many runs were performed. It is impossible to know if the reported differences are meaningful or within noise."
     },
     {
       "flag": "Best performance on internal dataset",
       "detail": "DMPI-PMHFE performs best on safeguard-v2, which the authors created and whose distribution is 'closely aligned with the training data' (their own words). Performance degrades notably on external datasets (e.g., F1 from 98.29% to 90.21% on deepset-v2)."
     },
     {
       "flag": "GPT-4o used for both training data generation and defense evaluation",
       "detail": "3,000 training samples were generated by GPT-4o, and GPT-4o is also one of the five LLMs evaluated for defense effectiveness. The paper does not discuss whether GPT-4o-generated attack patterns in training data bias the model toward defending GPT-4o specifically."
     },
     {
       "flag": "No code or custom dataset release",
       "detail": "Neither the code nor the safeguard-v2 dataset is released, making independent verification or replication impossible."
     },
     {
       "flag": "No latency analysis for proposed active defense",
       "detail": "DMPI-PMHFE is proposed as a real-time pre-processing filter for every LLM input. No inference latency or throughput analysis is provided, which is critical for practical deployment."
     },
     {
       "flag": "Small defense evaluation benchmark",
       "detail": "Defense effectiveness is evaluated on only 251 attack samples from a single benchmark (CyberSecEval 2). The diversity and representativeness of these attacks relative to real-world threats is not discussed."
     }
   ],
   "cited_papers": [
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": [
         "Kai Greshake",
         "Sahar Abdelnabi",
         "Shailesh Mishra",
         "Christoph Endres",
         "Thorsten Holz",
         "Mario Fritz"
       ],
       "year": 2023,
       "relevance": "Foundational work on indirect prompt injection attacks against LLM-integrated applications, defines the attack taxonomy this paper builds on."
     },
     {
       "title": "Ignore previous prompt: Attack techniques for language models",
       "authors": [
         "Fábio Perez",
         "Ian Ribeiro"
       ],
       "year": 2022,
       "relevance": "Early systematic study of direct prompt injection attack techniques for language models."
     },
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": [
         "Yupei Liu",
         "Yuqi Jia",
         "Runpeng Geng",
         "Jinyuan Jia",
         "Neil Zhenqiang Gong"
       ],
       "year": 2024,
       "relevance": "Provides formal framework and benchmarks for evaluating prompt injection attacks and defenses."
     },
     {
       "title": "InjecGuard: Benchmarking and mitigating over-defense in prompt injection guardrail models",
       "authors": [
         "Hao Li",
         "Xiaogeng Liu"
       ],
       "year": 2024,
       "arxiv_id": "2410.22770",
       "relevance": "Addresses the over-defense problem in prompt injection detection models, serving as a baseline in this paper."
     },
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": [
         "Sizhe Chen",
         "Julien Piet",
         "Chawin Sitawarin",
         "David Wagner"
       ],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Architecture-based defense that separates prompts and data into two channels to prevent injection."
     },
     {
       "title": "Jatmo: Prompt injection defense by task-specific finetuning",
       "authors": [
         "Julien Piet",
         "Maha Alrashed",
         "Chawin Sitawarin",
         "Sizhe Chen"
       ],
       "year": 2024,
       "relevance": "Defense method using non-instruction fine-tuning for specific tasks, representing architecture-based defenses."
     },
     {
       "title": "LLM Self Defense: By self examination, LLMs know they are being tricked",
       "authors": [
         "Mansi Phute",
         "Alec Helbling",
         "Matthew Daniel Hull",
         "ShengYun Peng"
       ],
       "year": 2024,
       "relevance": "Self-supervision defense baseline where LLMs evaluate their own outputs for harmful content."
     },
     {
       "title": "Defending ChatGPT against jailbreak attack via self-reminders",
       "authors": [
         "Yueqi Xie",
         "Jingwei Yi",
         "Jiawei Shao",
         "Justin Curl"
       ],
       "year": 2023,
       "relevance": "Self-reminder defense baseline that integrates system prompts into user queries to enhance LLM safety."
     },
     {
       "title": "Many-shot jailbreaking",
       "authors": [
         "Cem Anil",
         "Esin Durmus",
         "Nina Panickssery",
         "Mrinank Sharma"
       ],
       "year": 2025,
       "relevance": "Describes the many-shot jailbreaking attack pattern that this paper's pattern matching module specifically targets."
     },
     {
       "title": "Security and privacy challenges of large language models: A survey",
       "authors": [
         "Badhan Chandra Das",
         "M Hadi Amini",
         "Yanzhao Wu"
       ],
       "year": 2025,
       "relevance": "Comprehensive survey of LLM security and privacy challenges providing broader context for prompt injection defense work."
     },
     {
       "title": "CyberSecEval 2: A wide-ranging cybersecurity evaluation suite for large language models",
       "authors": [
         "Manish Bhatt",
         "Sahana Chennabasappa",
         "Yue Li",
         "Cyrus Nikolaidis"
       ],
       "year": 2024,
       "arxiv_id": "2404.13161",
       "relevance": "Provides the 251-sample prompt injection benchmark used for defense effectiveness evaluation in this paper."
     },
     {
       "title": "Soft begging: Modular and efficient shielding of LLMs against prompt injection and jailbreaking based on prompt tuning",
       "authors": [
         "Simon Ostermann",
         "Kevin Baum",
         "Christoph Endres"
       ],
       "year": 2024,
       "arxiv_id": "2407.03391",
       "relevance": "Modular defense approach against prompt injection using prompt tuning, addressing similar goals of protecting LLMs."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "Proposes a prompt injection detection framework but releases no code, no dataset, and no latency analysis, making it unusable without significant reimplementation."
     },
     "surprise_contrarian": {
       "score": 0,
       "justification": "Confirms the expected finding that combining semantic and heuristic features improves detection over either alone, with no counterintuitive results."
     },
     "fear_safety": {
       "score": 1,
       "justification": "Addresses prompt injection as a security threat but focuses on defense rather than demonstrating novel attacks or revealing new vulnerabilities."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no challenge to specific companies or popular approaches — straightforward incremental improvement over existing baselines."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, no dataset, no demo released; the custom safeguard-v2 dataset and model weights are unavailable."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "From Zhengzhou University with no well-known authors; published in a niche KSEM workshop, not a major venue."
     }
   }
 }