ai-research-survey

scan.json (30568B)

---

 {
   "paper": {
     "title": "DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents",
     "authors": [
       "Hao Li",
       "Xiaogeng Liu",
       "Hung-Chun Chiu",
       "Dianqi Li",
       "Ning Zhang",
       "Chaowei Xiao"
     ],
     "year": 2025,
     "venue": "NeurIPS 2025",
     "arxiv_id": "2506.12104",
     "doi": "10.48550/arXiv.2506.12104"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "DRIFT reduces Attack Success Rate on GPT-4o-mini from 30.7% to 1.3% on AgentDojo while maintaining significantly higher utility than static-policy defenses like CaMeL (58.5% vs 38.4% benign utility). Dynamic policies are shown to be critical for complex tasks—static policies degrade sharply at trajectory lengths of 3+, while dynamic policies remain stable. The framework generalizes across 5 LLMs (GPT-4o, GPT-4o-mini, Claude-3.5-sonnet, Claude-3-haiku, Qwen2.5-7B-Instruct), consistently reducing ASR to single digits. Policy training via LoRA on Qwen2.5-7B achieves 0% ASR with improved utility.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "Code is released at https://github.com/SaFoLab-WISC/DRIFT, stated in the abstract and confirmed in the NeurIPS checklist."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "They use publicly available benchmarks (AgentDojo, ASB) and state 'We will release our DRIFT training dataset' in the NeurIPS checklist. The benchmarks themselves are open-sourced."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or detailed environment specification is provided in the paper. Training details (batch size, optimizer, learning rate) are mentioned in Section 3.1 but no software environment or dependency specifications."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "The paper describes implementation details in Section 3.1 but does not provide step-by-step reproduction instructions. Code is released in supplementary materials but the paper lacks a 'Reproducing Results' section."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are point estimates without confidence intervals or error bars. The NeurIPS checklist item 7 explicitly answers 'No' for error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used. Claims like 'DRIFT outperforms CaMeL by 20.1%' are based on comparing point estimates without any tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are given as absolute and relative differences with baseline context: e.g., 'ASR is successfully reduced from 30.7% to 1.3%', 'utility outperforms CaMeL by 20.1% under no attack' (Section 3.2). Both baseline and DRIFT numbers are provided throughout."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for the sample sizes. AgentDojo has 97 user tasks and 629 injection tasks; ASB has 10 scenarios. No power analysis or discussion of whether these are sufficient."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "All results appear to be single-run with no standard deviations, variance, or multi-run analysis. The NeurIPS checklist confirms no error bars are reported."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Multiple baselines compared: repeat_user_prompt, spotlighting_with_delimiting, tool_filter, transformers_pi_detector, CaMeL, Progent on AgentDojo (Figure 3); delimiters_defense, ob_sandwich_defense, instructional_prevention, Progent on ASB (Figure 4)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include CaMeL (2025) and Progent (2025), both concurrent system-level defenses. Other baselines span 2023-2025."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 presents a thorough ablation: Native Agent → +Planner → +Planner+Validator → +Planner+Validator+Isolator, plus Isolator alone. Each component's contribution is measured."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three metrics are used throughout: Benign Utility (task completion without attacks), Utility Under Attack (task completion with attacks), and Attack Success Rate (ASR)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is fully automated using benchmark success criteria. No human evaluation of agent outputs, defense decisions, or utility quality."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Training data is collected from ToolBench (Section 2.5.1) while evaluation uses AgentDojo and ASB, which are completely separate benchmarks."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Appendix D (Tables 6-8) provides per-scenario breakdowns across Banking, Slack, Travel, and Workspace for all models. Figure 6a also shows per-session comparison."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section C.1 analyzes failure on open-ended tasks (Table 4 shows DRIFT achieves 17.6% vs base agent's 25.7%). Section C.3 provides a detailed case study. Section 3.5 shows where static policies fail (trajectory length ≥3)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 shows the strict static policy (Planner only) causes severe utility drops (63.55% → 37.71%). Table 4 shows DRIFT reduces open-ended task completion. Claude-3-haiku shows limited utility improvement (Table 6). These negative aspects are reported transparently."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims (ASR reduced from 30.7% to 1.3%, utility outperforms CaMeL) are supported by Figure 3 and detailed results in Section 3.2. Cross-model generalization claims are supported by Figure 5."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims about each component's contribution are supported by the ablation study (Table 1), which uses controlled single-variable manipulation. Each component is added incrementally, isolating its effect."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The abstract specifies evaluation on 'AgentDojo and ASB benchmark' with specific models. The limitations section (Appendix A) explicitly states 'the benchmark domains are limited and do not fully cover the diverse tasks and attack scenarios encountered in real-world agentic systems.'"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of alternative explanations. For example, the utility improvements could partly stem from additional LLM reasoning calls rather than the security mechanism itself. The paper doesn't consider confounding factors."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "Metrics (Benign Utility, Utility Under Attack, ASR) are clearly defined and match the granularity of claims. The paper doesn't inflate 'success on AgentDojo tasks' into broader claims about real-world security beyond what's measured."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "GPT-4o-mini is specified as 'GPT-4o-mini-2024-07-18' (Section 3.1), but GPT-4o has no snapshot date, Claude-3.5-sonnet and Claude-3-haiku lack version identifiers. Per schema, 'GPT-4o' without a snapshot date does not count."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt texts are provided in Appendix E (Figures 8-13) for the Secure Planner, Privilege Assignment, Intent Alignment Validation, Injection Detection, Planning Sampling, and Injection Sampling."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "Training hyperparameters are reported (batch size 4, 3 epochs, Adam optimizer, lr 2e-5 in Section 3.1). However, LLM API inference settings (temperature, top-p, max tokens) for the online models are not reported."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The agentic scaffolding is described in detail across Sections 2.1-2.4, with workflow diagrams (Figures 1, 2), including the Secure Planner, Dynamic Validator, Injection Isolator, and their interaction with the agent and tools."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 2.5.1 describes the full data construction pipeline: ToolBench conversations are modified using GPT-4o-mini for both Planner and Isolator training data. Tool environment reconstruction adds 0-25 extra tools. 1,000 samples collected for each component."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A contains a dedicated 'Limitations' section discussing benchmark domain limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The limitations section states only that 'the benchmark domains are limited and do not fully cover the diverse tasks and attack scenarios encountered in real-world agentic systems.' This is close to boilerplate — it doesn't identify specific threats like benchmark overfitting, GPT-4o-mini's weaknesses affecting generalization, or whether the training data generation pipeline introduces biases."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The limitations section does not enumerate specific untested scenarios, attack types, deployment contexts, or populations. 'Diverse tasks and attack scenarios' is vague. No equivalent of 'What the evidence does not show.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (per-task results, logs, model outputs) is released. Only aggregate metrics are presented in figures and tables."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 2.5.1 describes how training data was collected from ToolBench: assistant messages rewritten by GPT-4o-mini, injection content simulated and placed by GPT-4o-mini. Evaluation uses standard benchmarks with described setups."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data comes from standard benchmarks (AgentDojo, ASB) and ToolBench."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 2.5.1 documents the pipeline: ToolBench conversations → GPT-4o-mini rewrites assistant messages → 1,000 Planner samples and 1,000 Isolator samples collected → tool environment augmented with 0-25 extra tools from 10,000+ unique tools across 5,000 samples."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgments section states: 'This project is partially supported by Schmidt Science AI2050 Early Career Fellow and Open philanthropy.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations clearly listed: Washington University in St. Louis, Johns Hopkins University, and Independent Researchers. No conflicts with evaluated products."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Schmidt Science and Open Philanthropy are independent foundations with no financial stake in the evaluated defense mechanism or the models used."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement is present in the paper. Absence of disclosure is not absence of conflict."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests defense mechanisms against prompt injection attacks, not model knowledge or capability on benchmarks. Contamination of benchmark tasks in training data is not the primary concern."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Paper evaluates a defense system, not pre-trained model capabilities. Any contamination would affect all compared methods equally."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Paper evaluates defense effectiveness, not model knowledge. Benchmark contamination is not structurally relevant to the defense comparison."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. Evaluation is entirely automated via benchmarks."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 reports total token usage for DRIFT (2.37M tokens) and all baselines on AgentDojo, plus an efficiency metric (Utility−ASR)/Total Tokens. DRIFT uses ~1.89× more tokens than the undefended agent."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Token usage for inference is reported in Table 3, but no GPU hours, training time, or total API spend for the LoRA fine-tuning of Qwen2.5-7B-Instruct is provided."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "All results appear to be single-run. No seed sensitivity analysis or multi-seed results are reported."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. Results are presented as point estimates without indication of how many runs produced them."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. Training hyperparameters (lr, batch size, epochs) are stated but not how they were selected."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No explanation of how the final configuration was selected or whether alternative configurations were tried."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Multiple comparisons across 5 models, 2 benchmarks, 4 scenarios, and multiple baselines are made without any correction for multiple testing."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Authors implement and evaluate their own system against baselines without acknowledging potential self-comparison bias. No independent evaluation."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 compares DRIFT's performance against token cost for all methods, and computes an efficiency metric. DRIFT's cost relative to performance is explicitly analyzed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AgentDojo or ASB actually measure real-world agent security. The limitations section notes benchmark domains are limited but does not question construct validity of the benchmarks themselves."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Model comparisons in Figure 5 use ReAct as the consistent baseline scaffold across all models. DRIFT is applied as a system-level addition on top of the same base scaffold, controlling for scaffold confounds."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether evaluated models may have seen AgentDojo or ASB benchmark tasks during training, or whether the benchmarks were created before model training cutoffs."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information about attack presence or correct task execution."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of independence between training data (ToolBench) and evaluation data (AgentDojo), or structural similarities that might bias results."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is applied."
       }
     }
   },
   "claims": [
     {
       "claim": "DRIFT reduces ASR from 30.7% to 1.3% on GPT-4o-mini while outperforming CaMeL in utility by 20.1% (no attack) and 12.5% (under attack) on AgentDojo.",
       "evidence": "Figure 3 and Section 3.2 show DRIFT achieves 1.3% ASR vs CaMeL's 0.0%, with utility of 58.5% vs 38.4% (no attack) and 47.9% vs 35.4% (under attack).",
       "supported": "strong"
     },
     {
       "claim": "DRIFT generalizes across 5 LLMs, consistently reducing ASR to single-digit levels while maintaining utility.",
       "evidence": "Figure 5 shows ASR reductions across GPT-4o (51.7%→1.5%), GPT-4o-mini (30.7%→1.3%), Claude-3.5-sonnet (37.1%→4.4%), Claude-3-haiku (11.2%→3.0%), Qwen2.5-7B (15.1%→0.0%). Utility is preserved or improved in most cases.",
       "supported": "moderate"
     },
     {
       "claim": "Dynamic policies are necessary for complex tasks — static policies cause sharp utility drops at trajectory length ≥3.",
       "evidence": "Figure 6b shows static policy success rate drops sharply from ~55% (length 2) to ~25% (length 3), while dynamic policy remains stable at ~50-55%.",
       "supported": "moderate"
     },
     {
       "claim": "The Injection Isolator is necessary for defending against attacks that don't alter the tool-call trajectory.",
       "evidence": "Section C.3 provides a case study where injected content affects only the final answer text, not tool calls. Table 1 ablation shows Isolator reduces ASR from 3.66% to 1.29%.",
       "supported": "moderate"
     },
     {
       "claim": "Policy training on Qwen2.5-7B achieves 0% ASR with improved utility compared to untuned DRIFT.",
       "evidence": "Figure 5 shows tuned Qwen2.5-7B achieves 0% ASR (from 15.1% undefended), utility improves from 26.6% to 32.2% (no attack) and 19.1% to 22.2% (under attack).",
       "supported": "moderate"
     },
     {
       "claim": "DRIFT is robust to adaptive attacks, with ASR increasing by only 0.81% under combined isolator and validator adaptive attacks.",
       "evidence": "Table 2 shows IAA+VAA results in 2.10% ASR vs 1.29% baseline, and PAIR attack yields 1.60% ASR. Utility remains stable.",
       "supported": "moderate"
     },
     {
       "claim": "DRIFT is more cost-efficient than other policy-based defenses, using 2.37M tokens vs CaMeL's 6.09M.",
       "evidence": "Table 3 shows token usage comparison across all defenses. DRIFT's efficiency metric (19.7) exceeds CaMeL (5.8) and Progent (13.9).",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or variance across runs",
       "detail": "All results throughout the paper are single-run point estimates. The NeurIPS checklist explicitly acknowledges this (question 7: 'No'). Without variance estimates, it is impossible to assess whether observed differences are meaningful or due to random fluctuation."
     },
     {
       "flag": "No statistical significance tests",
       "detail": "Comparisons across methods and models rely entirely on comparing point estimates. Claims like 'DRIFT outperforms Progent' are based on numeric differences that could be within noise, especially on smaller scenario subsets (e.g., 10 ASB scenarios)."
     },
     {
       "flag": "Arbitrary efficiency metric",
       "detail": "Table 3 defines efficiency as (Utility - ASR) / Total Tokens. This metric conflates utility and security into a single number with no theoretical justification for why subtraction and division are appropriate. Different weighting would change rankings."
     },
     {
       "flag": "Training data quality concerns",
       "detail": "Policy training data for both Planner and Isolator is generated by GPT-4o-mini rewriting ToolBench conversations. Potential quality issues and biases introduced by this synthetic data generation pipeline are not discussed."
     },
     {
       "flag": "Limited adaptive attack evaluation",
       "detail": "Adaptive attacks (Section 3.6) are manually crafted or use PAIR on sampled cases. A more systematic adaptive attack (e.g., targeting the specific prompt structures in Figures 8-13) could be more effective. The paper doesn't explore attacks that exploit knowledge of the full system architecture."
     }
   ],
   "cited_papers": [
     {
       "title": "Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "Primary evaluation benchmark for prompt injection attack/defense in LLM agents."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": ["Edoardo Debenedetti", "Ilia Shumailov", "Tianqi Fan", "Jamie Hayes", "Nicholas Carlini", "Daniel Fabian", "Christoph Kern", "Chongyang Shi", "Andreas Terzis", "Florian Tramèr"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "CaMeL static policy defense — primary baseline and comparison point for system-level prompt injection defense."
     },
     {
       "title": "Progent: Programmable privilege control for LLM agents",
       "authors": ["Tianneng Shi", "Jingxuan He", "Zhun Wang", "Linyu Wu", "Hongwei Li", "Wenbo Guo", "Dawn Song"],
       "year": 2025,
       "arxiv_id": "2504.11703",
       "relevance": "Concurrent dynamic policy-based defense for LLM agents, directly compared with DRIFT."
     },
     {
       "title": "IsolateGPT: An execution isolation architecture for LLM-based agentic systems",
       "authors": ["Yuhao Wu", "Franziska Roesner", "Tadayoshi Kohno", "Ning Zhang", "Umar Iqbal"],
       "year": 2025,
       "relevance": "System-level isolation defense for LLM agents, addresses cross-application information leakage."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "relevance": "Benchmark for indirect prompt injection attacks in tool-integrated LLM agents."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Sahar Abdelnabi", "Kai Greshake", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Foundational work on indirect prompt injection attacks against real-world LLM applications."
     },
     {
       "title": "Neural exec: Learning (and learning from) execution triggers for prompt injection attacks",
       "authors": ["Dario Pasquini", "Martin Strohmeier", "Carmela Troncoso"],
       "year": 2024,
       "relevance": "Advanced prompt injection attack using learned execution triggers."
     },
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David A. Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Model-level defense transforming queries to structured form to resist prompt injection."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2024,
       "arxiv_id": "2410.05451",
       "relevance": "Model-level defense using preference optimization to mitigate prompt injection."
     },
     {
       "title": "PiGuard: Prompt injection guardrail via mitigating overdefense for free",
       "authors": ["Hao Li", "Xiaogeng Liu", "Ning Zhang", "Chaowei Xiao"],
       "year": 2025,
       "relevance": "Prompt injection detection guardrail that addresses overdefense trade-offs."
     },
     {
       "title": "System-level defense against indirect prompt injection attacks: An information flow control perspective",
       "authors": ["Fangzhou Wu", "Ethan Cecchetti", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2409.19091",
       "relevance": "Information flow control approach to defending LLM agents against indirect prompt injection."
     },
     {
       "title": "RTBAS: defending LLM agents against prompt injection and privacy leakage",
       "authors": ["Peter Yong Zhong", "Siyuan Chen", "Ruiqi Wang", "McKenna McCall", "Ben L. Titzer", "Heather Miller", "Phillip B. Gibbons"],
       "year": 2025,
       "arxiv_id": "2502.08966",
       "relevance": "Runtime defense system for LLM agents against prompt injection and privacy leakage."
     },
     {
       "title": "ReAct: Synergizing reasoning and acting in language models",
       "authors": ["Shunyu Yao", "Jeffrey Zhao", "Dian Yu", "Nan Du", "Izhak Shafran", "Karthik R. Narasimhan", "Yuan Cao"],
       "year": 2023,
       "relevance": "Foundational agentic reasoning framework used as the baseline agent scaffold in DRIFT experiments."
     },
     {
       "title": "Agent Security Bench (ASB): formalizing and benchmarking attacks and defenses in LLM-based agents",
       "authors": ["Hanrong Zhang", "Jingyuan Huang", "Kai Mei", "Yifei Yao", "Zhenting Wang", "Chenlu Zhan", "Hongwei Wang", "Yongfeng Zhang"],
       "year": 2025,
       "relevance": "Secondary evaluation benchmark for LLM agent security with 10 attack scenarios."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "DRIFT is a deployable defense framework with released code applicable to existing LLM agents, but requires non-trivial integration into agentic systems."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Shows dynamic policies substantially outperform static ones and that memory isolation matters — useful but not deeply surprising given the motivation."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that even GPT-4o has 51.7% ASR when undefended against prompt injection, highlighting real security risks in LLM agentic systems."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy — straightforward defense paper comparing against other methods without contentious claims."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code released on GitHub (SaFoLab-WISC/DRIFT) and benchmarks are publicly available, but not pip-installable or live demo."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Authors from Washington University in St. Louis and Johns Hopkins University — reputable universities but not major AI labs. Uses well-known models (GPT-4o, Claude) in experiments."
     }
   }
 }