ai-research-survey

scan-v5.json (28685B)

---

 {
   "scan_version": 5,
   "paper_type": "empirical",
   "paper": {
     "title": "DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents",
     "authors": [
       "Hao Li",
       "Xiaogeng Liu",
       "Hung-Chun Chiu",
       "Dianqi Li",
       "Ning Zhang"
     ],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2506.12104",
     "doi": "10.48550/arXiv.2506.12104"
   },
   "checklist": {
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims ASR reduction from 30.7% to 1.3% and 20.1% utility improvement over CaMeL; Figure 3 confirms these exact figures (CaMeL=38.4%, DRIFT=58.5%, delta=20.1%). Minor inconsistency in Section 3.2 body text ('21.8%') vs figure, but abstract matches figures.",
         "source": "haiku"
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Ablation study (Table 1) incrementally adds Secure Planner, Dynamic Validator, and Injection Isolator to isolate each component's contribution to both ASR and utility, providing a valid design for causal component claims.",
         "source": "haiku"
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper repeatedly makes claims about 'real-world agentic systems' and 'broad adaptability' despite evaluation being limited to 4 simulated AgentDojo scenarios and 10 ASB scenarios; the limitations section acknowledges scope limitations only vaguely.",
         "source": "haiku"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether performance gains could stem from the additional LLM calls (acting as sanity checks) rather than the specific DRIFT design, nor whether a simpler multi-LLM verification approach would achieve similar results.",
         "source": "haiku"
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "ASR (attack success rate), Benign Utility, and Utility Under Attack are defined clearly and measure exactly what is claimed; no conflation between proxy and target metrics.",
         "source": "haiku"
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A is a dedicated Limitations section that goes beyond a single sentence, noting that benchmark domains are limited and do not fully cover real-world diversity.",
         "source": "haiku"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The limitations section only states that 'benchmark domains are limited and do not fully cover diverse tasks'; no specific threats such as single-run variance, benchmark contamination, or model-version sensitivity are identified.",
         "source": "haiku"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show; no explicit boundary on attack types, task complexity levels, or deployment environments beyond a vague acknowledgment of benchmark limitations.",
         "source": "haiku"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "'This project is partially supported by Schmidt Science AI2050 Early Career Fellow and Open philanthropy' is disclosed in the Acknowledgments and Disclosure of Funding section.",
         "source": "haiku"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed on the title page: Washington University in St. Louis, Johns Hopkins University, and Independent Researcher.",
         "source": "haiku"
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Schmidt Science and Open Philanthropy have no financial stake in GPT-4o-mini, Claude, or the AgentDojo/ASB benchmarks being evaluated.",
         "source": "haiku"
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "There is no competing interests statement, no declaration of patents or equity interests; the acknowledgments section only discloses funding sources.",
         "source": "haiku"
       }
     },
     "scope_and_framing": {
       "key_terms_defined": {
         "applies": true,
         "answer": true,
         "justification": "Prompt injection attacks are defined with concrete examples, LLM agents are characterized, ASR/utility metrics are defined in Section 3.1, and control/data constraints are explained in Section 2.",
         "source": "haiku"
       },
       "intended_contribution_clear": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly lists two contributions: the DRIFT framework itself and extensive experiments demonstrating effectiveness and adaptability; the three components (Secure Planner, Dynamic Validator, Injection Isolator) are clearly described.",
         "source": "haiku"
       },
       "engagement_with_prior_work": {
         "applies": true,
         "answer": true,
         "justification": "Appendix B provides a structured related work section contrasting model-level vs system-level defenses; the paper explicitly positions DRIFT against CaMeL (static policy) and Progent (dynamic policy without memory isolation) and explains what each lacks.",
         "source": "haiku"
       }
     }
   },
   "type_checklist": {
     "empirical": {
       "artifacts": {
         "code_released": {
           "applies": true,
           "answer": true,
           "justification": "Code is released at https://github.com/SaFoLab-WISC/DRIFT as stated in the abstract.",
           "source": "haiku"
         },
         "data_released": {
           "applies": true,
           "answer": true,
           "justification": "Evaluation uses AgentDojo and ASB, both publicly available benchmarks used unmodified; the custom ToolBench-derived training dataset is only promised ('We will release') in the NeurIPS checklist.",
           "source": "haiku"
         },
         "environment_specified": {
           "applies": true,
           "answer": false,
           "justification": "No requirements.txt, Dockerfile, or explicit dependency list is provided in the paper; only training hyperparameters (batch size, learning rate) are mentioned, not the software environment.",
           "source": "haiku"
         },
         "reproduction_instructions": {
           "applies": true,
           "answer": false,
           "justification": "The paper references code in supplementary materials and a GitHub repo, but no step-by-step reproduction instructions appear in the paper itself; the NeurIPS checklist says 'code in supplementary' but no commands or workflow are described.",
           "source": "haiku"
         }
       },
       "statistical_methodology": {
         "confidence_intervals_or_error_bars": {
           "applies": true,
           "answer": false,
           "justification": "The NeurIPS checklist Q7 explicitly answers [No] for error bars; all results are single point estimates with no confidence intervals reported.",
           "source": "haiku"
         },
         "significance_tests": {
           "applies": true,
           "answer": false,
           "justification": "No statistical significance tests are performed for any comparative claims; all comparisons are raw percentage point differences without significance testing.",
           "source": "haiku"
         },
         "effect_sizes_reported": {
           "applies": true,
           "answer": true,
           "justification": "Percentage improvements are reported consistently throughout (e.g., ASR from 30.7% to 1.3%, 20.1% utility improvement over CaMeL), providing interpretable effect sizes in the benchmark context.",
           "source": "haiku"
         },
         "sample_size_justified": {
           "applies": true,
           "answer": false,
           "justification": "The paper uses 97 user tasks and 629 injection tasks from AgentDojo as fixed benchmark sizes without any justification of whether these sizes are sufficient to detect meaningful differences.",
           "source": "haiku"
         },
         "variance_reported": {
           "applies": true,
           "answer": false,
           "justification": "No variance, standard deviation, or results from multiple runs are reported; the NeurIPS checklist explicitly acknowledges no error bars are provided.",
           "source": "haiku"
         }
       },
       "evaluation_design": {
         "baselines_included": {
           "applies": true,
           "answer": true,
           "justification": "Seven baselines are included in AgentDojo comparisons: undefended agent, repeat_user_prompt, spotlighting, tool_filter, pi_detector, CaMeL, and Progent; five in ASB.",
           "source": "haiku"
         },
         "baselines_contemporary": {
           "applies": true,
           "answer": true,
           "justification": "CaMeL (arXiv 2503.18813, 2025) and Progent (arXiv 2504.11703, 2025) are concurrent or recent system-level defenses; the paper explicitly compares against the most advanced available methods.",
           "source": "haiku"
         },
         "ablation_study": {
           "applies": true,
           "answer": true,
           "justification": "Table 1 provides a proper ablation study incrementally adding Secure Planner, Dynamic Validator, and Injection Isolator, with both utility and security metrics reported at each step.",
           "source": "haiku"
         },
         "multiple_metrics": {
           "applies": true,
           "answer": true,
           "justification": "Three metrics are reported: Benign Utility (no-attack task completion), Utility Under Attack, and Targeted Attack Success Rate (ASR), covering both security and utility dimensions.",
           "source": "haiku"
         },
         "human_evaluation": {
           "applies": false,
           "answer": false,
           "justification": "The evaluation uses fully automated benchmarks (AgentDojo, ASB) for measuring attack success and task completion rates; human evaluation is not relevant for this type of system defense evaluation.",
           "source": "haiku"
         },
         "held_out_test_set": {
           "applies": true,
           "answer": true,
           "justification": "LoRA fine-tuning is done on ToolBench-derived training data while evaluation is performed on AgentDojo and ASB test benchmarks, maintaining separation between training and test distributions.",
           "source": "haiku"
         },
         "per_category_breakdown": {
           "applies": true,
           "answer": true,
           "justification": "Tables 6-8 in Appendix D provide per-scenario breakdowns across Banking, Slack, Travel, and Workspace for all models on AgentDojo.",
           "source": "haiku"
         },
         "failure_cases_discussed": {
           "applies": true,
           "answer": true,
           "justification": "Appendix C.1 analyzes 6 open-ended tasks where DRIFT underperforms (17.6% vs 25.7% for base agent); adaptive attack experiments in Section 3.6 also reveal partial failures under curated attacks.",
           "source": "haiku"
         },
         "negative_results_reported": {
           "applies": true,
           "answer": true,
           "justification": "The ablation shows that using only the Secure Planner causes severe utility loss (25.84% drop); open-ended task analysis shows DRIFT achieves only 70% of base agent capability on those tasks.",
           "source": "haiku"
         }
       },
       "setup_transparency": {
         "model_versions_specified": {
           "applies": true,
           "answer": false,
           "justification": "Only GPT-4o-mini is specified with a version date ('GPT-4o-mini-2024-07-18'); Claude-3.5-sonnet, Claude-3-haiku, and GPT-4o are referenced only by marketing names without snapshot dates.",
           "source": "haiku"
         },
         "prompts_provided": {
           "applies": true,
           "answer": true,
           "justification": "All six system prompts used by DRIFT components (constraint generation, privilege assignment, intent alignment, injection detection, planning sampling, injection sampling) are provided in Appendix E as Figures 8-13.",
           "source": "haiku"
         },
         "hyperparameters_reported": {
           "applies": true,
           "answer": false,
           "justification": "LoRA fine-tuning hyperparameters are reported (batch size 4, 3 epochs, lr 2e-5, Adam optimizer), but inference hyperparameters for all LLM calls (temperature, top-p, max tokens) are not mentioned anywhere in the paper.",
           "source": "haiku"
         },
         "scaffolding_described": {
           "applies": true,
           "answer": true,
           "justification": "Section 2 provides detailed descriptions of all three DRIFT components with accompanying workflow diagrams (Figures 1-2) showing data flow between Secure Planner, Dynamic Validator, and Injection Isolator.",
           "source": "haiku"
         },
         "data_preprocessing_documented": {
           "applies": true,
           "answer": true,
           "justification": "Section 2.5.1 describes the full training data pipeline: ToolBench conversation rewriting via GPT-4o-mini, planner data sampling (1,000 samples), isolator data sampling with synthetic injection generation (1,000 samples), and tool environment reconstruction (10,000+ tools).",
           "source": "haiku"
         }
       },
       "data_integrity": {
         "raw_data_available": {
           "applies": true,
           "answer": false,
           "justification": "Raw evaluation results (individual task outcomes, per-attack-instance decisions) are not released; only aggregate metrics are reported, and the custom training dataset is only promised for future release.",
           "source": "haiku"
         },
         "data_collection_described": {
           "applies": true,
           "answer": true,
           "justification": "Section 2.5.1 describes the ToolBench-to-training-data pipeline in detail, including conversation rewriting procedures, injection simulation methods, and tool list construction from 5,000 samples.",
           "source": "haiku"
         },
         "recruitment_methods_described": {
           "applies": false,
           "answer": false,
           "justification": "Evaluation uses standard public benchmarks (AgentDojo, ASB) with no human participant recruitment involved.",
           "source": "haiku"
         },
         "data_pipeline_documented": {
           "applies": true,
           "answer": true,
           "justification": "Section 2.5.1 documents the complete pipeline from ToolBench source data through GPT-4o-mini rewriting, injection simulation, and training sample construction with sample counts and turn ranges specified.",
           "source": "haiku"
         }
       },
       "contamination": {
         "training_cutoff_stated": {
           "applies": true,
           "answer": false,
           "justification": "Training data cutoffs are not stated for any of the evaluated models; GPT-4o-mini-2024-07-18's training cutoff is not mentioned, and Claude/GPT-4o cutoffs are absent entirely.",
           "source": "haiku"
         },
         "train_test_overlap_discussed": {
           "applies": true,
           "answer": false,
           "justification": "No discussion of whether AgentDojo or ASB benchmark tasks were in the training data of the evaluated closed-source models (GPT-4o-mini, GPT-4o, Claude); AgentDojo was published at NeurIPS 2024.",
           "source": "haiku"
         },
         "benchmark_contamination_addressed": {
           "applies": true,
           "answer": false,
           "justification": "AgentDojo was published at NeurIPS 2024 and ASB at ICLR 2025, both potentially within the training window of GPT-4o-mini-2024-07-18 and Claude models; this is not addressed anywhere in the paper.",
           "source": "haiku"
         }
       },
       "human_studies": {
         "pre_registered": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved; NeurIPS checklist Q14 explicitly confirms this.",
           "source": "haiku"
         },
         "irb_or_ethics_approval": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved; NeurIPS checklist Q15 explicitly confirms no human research.",
           "source": "haiku"
         },
         "demographics_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         },
         "inclusion_exclusion_criteria": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         },
         "randomization_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         },
         "blinding_described": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         },
         "attrition_reported": {
           "applies": false,
           "answer": false,
           "justification": "No human participants involved.",
           "source": "haiku"
         }
       },
       "cost_and_practicality": {
         "inference_cost_reported": {
           "applies": true,
           "answer": true,
           "justification": "Table 3 provides total token usage for all defense methods on AgentDojo (DRIFT=2.37M tokens vs undefended=0.82M), along with an efficiency metric combining utility, ASR, and token cost.",
           "source": "haiku"
         },
         "compute_budget_stated": {
           "applies": true,
           "answer": false,
           "justification": "Fine-tuning details (batch size, epochs, optimizer) are provided but GPU type, memory, training time, and total compute budget are not stated in the paper.",
           "source": "haiku"
         }
       }
     }
   },
   "claims": [
     {
       "claim": "DRIFT reduces ASR from 30.7% to 1.3% on GPT-4o-mini on AgentDojo benchmark.",
       "evidence": "Figure 3 shows undefended agent ASR=30.7% vs DRIFT ASR=1.3% on GPT-4o-mini.",
       "supported": "strong"
     },
     {
       "claim": "DRIFT outperforms CaMeL in utility by 20.1% under no-attack conditions while achieving comparable security.",
       "evidence": "Figure 3: CaMeL utility=38.4%, DRIFT utility=58.5%, delta=20.1%; ASR: CaMeL=0.0% vs DRIFT=1.3%.",
       "supported": "strong"
     },
     {
       "claim": "Dynamic policies significantly outperform static policies for tasks with trajectory length ≥ 3.",
       "evidence": "Figure 6b shows static and dynamic policies diverge sharply at trajectory length 3+, with dynamic maintaining stable success rate while static drops.",
       "supported": "moderate"
     },
     {
       "claim": "DRIFT maintains robustness under adaptive attacks with only 0.81% ASR increase under combined isolator+validator adaptive attack.",
       "evidence": "Table 2 shows combined IAA+VAA results in ASR of 2.10% vs baseline 1.29%, a 0.81pp increase.",
       "supported": "strong"
     },
     {
       "claim": "Fine-tuned Qwen2.5-7B DRIFT achieves 0% ASR while improving utility by 5.6% in safe conditions.",
       "evidence": "Figure 5 shows Qwen2.5-7B+DRIFT: ASR=0.0% vs ReAct=15.1%, utility 32.2% vs 26.6%.",
       "supported": "strong"
     },
     {
       "claim": "DRIFT significantly outperforms Progent on weaker models (GPT-4o-mini), demonstrating better design for lower-capability models.",
       "evidence": "Appendix Table 5: DRIFT achieves 1.64% ASR vs Progent 9.39% on AgentDojo with GPT-4o-mini; attributed to DRIFT's simpler subtask decomposition.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "DRIFT is a three-component system-level defense (Secure Planner, Dynamic Validator, Injection Isolator) that reduces prompt injection attack success rate from 30.7% to 1.3% on GPT-4o-mini on AgentDojo while outperforming static policy baseline CaMeL in utility by 20.1%. The Injection Isolator addresses a previously underserved threat: injection content embedded in tool results that does not alter the tool-call trajectory but corrupts the final response. Dynamic constraint updating is shown to be necessary for complex multi-step tasks, where static policies cause severe utility degradation at trajectory lengths ≥ 3. The framework generalizes across five diverse models including a locally fine-tuned Qwen2.5-7B that achieves 0% ASR after policy tuning.",
   "red_flags": [
     {
       "flag": "No error bars or significance tests",
       "detail": "All results are single point estimates with no variance across runs; the NeurIPS checklist explicitly acknowledges no error bars (Q7: [No]). Security benchmarks with 97-629 tasks and stochastic LLM calls warrant uncertainty quantification."
     },
     {
       "flag": "Benchmark contamination unaddressed",
       "detail": "AgentDojo was published at NeurIPS 2024 and may appear in training data of GPT-4o-mini-2024-07-18 and Claude models; no discussion of whether model familiarity with benchmark scenarios inflates defense or utility metrics."
     },
     {
       "flag": "Circular training data generation",
       "detail": "GPT-4o-mini is used to generate training labels (rewrite ToolBench conversations to match DRIFT policy) and is also the primary evaluation model; the model may be biased toward outputs that match its own labeled training format."
     },
     {
       "flag": "Minor numerical inconsistencies between abstract and body",
       "detail": "Abstract states '20.1% under no attack and 12.5% under attack' vs CaMeL; Section 3.2 body states '21.8% in the no-attack setting and 10.9% under attack'. The abstract matches Figure 3 values but the main text does not."
     },
     {
       "flag": "Inference hyperparameters unreported",
       "detail": "Temperature, top-p, and max tokens for all LLM calls (Secure Planner, Dynamic Validator, Injection Isolator, base agent) are not reported, making exact reproduction of LLM behavior impossible."
     }
   ],
   "cited_papers": [
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents",
       "relevance": "Primary evaluation benchmark; provides the 97 user tasks and 629 injection tasks used for all main results."
     },
     {
       "title": "Defeating Prompt Injections by Design (CaMeL)",
       "relevance": "Key static policy-based baseline that DRIFT explicitly improves upon; demonstrates the utility-security tradeoff of static approaches."
     },
     {
       "title": "Progent: Programmable Privilege Control for LLM Agents",
       "relevance": "Concurrent dynamic policy baseline; detailed comparison in Appendix C.2 reveals DRIFT's advantage on weaker models due to simpler subtask decomposition."
     },
     {
       "title": "IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems",
       "relevance": "Related system-level defense using application isolation; DRIFT's Injection Isolator addresses its limitation of residual in-memory injection content."
     },
     {
       "title": "ToolLLM: Facilitating Large Language Models to Master 16000+ Real-World APIs (ToolBench)",
       "relevance": "Source of training data for DRIFT's policy fine-tuning; 2,000 samples derived from ToolBench conversations."
     },
     {
       "title": "ReAct: Synergizing Reasoning and Acting in Language Models",
       "relevance": "Baseline agent framework that DRIFT is applied on top of; used as the comparison point for all adaptation experiments."
     },
     {
       "title": "Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-Based Agents",
       "relevance": "Second evaluation benchmark providing 10 diverse scenarios for security assessment."
     },
     {
       "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents",
       "relevance": "Foundational work on prompt injection attack types and risk categories (economic loss, privacy leakage)."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 3,
       "justification": "Code is released on GitHub, the framework plugs into existing LLM agents without model modification, and it addresses a real security threat for deployed agentic systems."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The finding that dynamic policies outperform static ones and that memory isolation is needed is intuitive; no surprising inversions of conventional wisdom."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that even GPT-4o (the most capable model tested) has 51.7% ASR under prompt injection without defense, raising legitimate concern about production LLM agent deployments."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Standard academic positioning against CaMeL and Progent; no controversial claims or community-dividing arguments."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code released on GitHub and evaluation uses public AgentDojo benchmark, enabling researchers to reproduce and test DRIFT on the same tasks."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Washington University in St. Louis and Johns Hopkins are reputable but not AI-famous labs; NeurIPS 2025 venue adds some recognition."
     }
   },
   "hn_data": {
     "threads": [
       {
         "hn_id": "44770561",
         "title": "B-Splines and Fourier-Best Friends for Spatial-Temporal Video Super-Resolution",
         "points": 4,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=44770561"
       },
       {
         "hn_id": "47002668",
         "title": "LLMs exceed physicians on complex text-based differential diagnosis",
         "points": 3,
         "comments": 2,
         "url": "https://news.ycombinator.com/item?id=47002668"
       },
       {
         "hn_id": "45534337",
         "title": "Advancing medical artificial intelligence using a century of cases",
         "points": 3,
         "comments": 1,
         "url": "https://news.ycombinator.com/item?id=45534337"
       },
       {
         "hn_id": "43401539",
         "title": "CriteoPrivateAd: RealWorld Bidding Dataset to Design Private Advertising Systems",
         "points": 2,
         "comments": 1,
         "url": "https://news.ycombinator.com/item?id=43401539"
       },
       {
         "hn_id": "31894669",
         "title": "Protecting President Zelenskyy Against Deep Fakes",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=31894669"
       },
       {
         "hn_id": "27612994",
         "title": "LegoFormer: Transformers for Block-by-Block Multi-View 3D Reconstruction",
         "points": 2,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=27612994"
       },
       {
         "hn_id": "44971660",
         "title": "Scaling laws found in large generative medical event models",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=44971660"
       },
       {
         "hn_id": "41227450",
         "title": "Τ-Bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=41227450"
       },
       {
         "hn_id": "40782080",
         "title": "Should AI optimize your code? A studio",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=40782080"
       },
       {
         "hn_id": "28895006",
         "title": "IQ-Learn: Inverse Soft-Q Learning for Imitation",
         "points": 1,
         "comments": 0,
         "url": "https://news.ycombinator.com/item?id=28895006"
       }
     ],
     "top_points": 4,
     "total_points": 20,
     "total_comments": 4
   }
 }