ai-research-survey

scan.json (33319B)

---

 {
   "paper": {
     "title": "DRIP: Defending Prompt Injection via Token-wise Representation Editing and Residual Instruction Fusion",
     "authors": [
       "Ruofan Liu",
       "Yun Lin",
       "Zhiyong Huang",
       "Jin Song Dong"
     ],
     "year": 2025,
     "venue": "arXiv preprint",
     "arxiv_id": "2511.00447",
     "doi": "10.48550/arXiv.2511.00447"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "DRIP proposes a two-component defense against prompt injection: a token-wise representation editing layer that shifts data token embeddings away from the instruction manifold, and a residual instruction fusion pathway that anchors the output to the intended instruction. Evaluated on SEP, AlpacaFarm, and InjecAgent benchmarks against StruQ, SecAlign, ISE, and PFT baselines on LLaMA-8B and Mistral-7B, DRIP achieves 0% ASR on all heuristic-based attacks and reduces GCG adaptive attack ASR to 1–3%, while maintaining utility comparable to the undefended model (83.89% vs 85.37% on AlpacaEval 2.0 for LLaMA-8B).",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "An anonymous code repository is provided at https://anonymous.4open.science/r/PromptInjection-BD09 (footnote 1, Open Science section). The paper states 'All the documents and installation guidance are available.' However, this is an anonymous review link and long-term availability is uncertain."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "Evaluation uses publicly available benchmarks: SEP (Zverev et al.), AlpacaFarm (Dubois et al.), InjecAgent (Zhan et al.), AlpacaEval 2.0, IFEval, and MT-Bench. Training data is curated from the public SEP training split and SQuAD. The curated DPO training data itself may be in the code repository."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Section 3.4 mentions hardware (6 NVIDIA RTX 5880 GPUs, 48GB each) and training hyperparameters, but no software dependencies, Python version, library versions, requirements.txt, or Dockerfile are provided in the paper."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "The paper describes the training and evaluation setup conceptually (Sections 3.4, 4.1) but provides no step-by-step reproduction instructions, commands to run, or a 'Reproducing Results' section. The anonymous repo may contain a README but this cannot be verified from the paper."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 3–7 are reported as point estimates only. No confidence intervals, error bars, or ± notation appear anywhere in the paper."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims DRIP 'improves role separation score by 12–49%' and 'reduces attack success rate by over 66%' but provides no p-values, t-tests, or any statistical significance tests to support these comparisons."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Results are reported with baseline context throughout. For example, Table 3 shows DRIP at 80.9% vs SecAlign 31.9% SEP on LLaMA-8B. Table 5 shows GCG ASR of 1.06% vs 66.67% for SecAlign. The reader can assess the magnitude of improvements from the absolute numbers."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "Benchmark sizes are stated (SEP: 9,160 tuples, AlpacaFarm: 208 examples after filtering, InjecAgent: 1,054 test cases) but no justification is given for why these sizes are adequate, especially the filtered AlpacaFarm subset of only 208 examples."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance, or spread measures are reported. All results appear to be from single experimental runs with no indication of multiple seeds or runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Five baselines are compared: Undefended, StruQ, SecAlign, ISE, and PFT (Section 4.1.2). All are evaluated on the same benchmarks under the same conditions."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "All baselines are from 2024–2025: StruQ (2024), SecAlign (2024), ISE (2024), PFT (2024/2025). These represent the current state-of-the-art in training-time prompt injection defenses."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.4 presents a thorough ablation study (Table 7) testing removal of Case 2, Case 3, replacing token-wise editing with embedding shift, using concat vs sum fusion, and removing fusion entirely. Each variant modifies one component while keeping others fixed."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Multiple metrics are used: SEP score for role separation, ASR for attack success (under heuristic and optimization-based attacks), and three utility metrics (AlpacaEval 2.0 win%, IFEval accuracy%, MT-Bench scores across 8 axes)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluations are automated: SEP uses witness string detection, ASR uses string matching, AlpacaEval and MT-Bench use LLM-as-judge (GPT-4), and IFEval uses rule-based checks. No human evaluation of defense quality is conducted."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Training uses the SEP training split (10k tuples, Section 3.2), while evaluation uses the separate SEP evaluation benchmark (9,160 tuples, Section 4.1.1). AlpacaFarm and InjecAgent are entirely separate benchmarks not used in training."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 5 (and full Table 8) breaks down ASR by attack family (Naive, Ignore variants 0–10, Completion variants, Escape variants, HackaPrompt, GCG, NeuralExec). Figure 8 shows MT-Bench scores across 8 skill categories."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.5.1 discusses a failure case where DRIP produces a 'semantic echo' — the model avoids direct execution of the injected instruction but integrates the injected concept ('sleep') into an open-ended pun task (Figure 10)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The ablation study (Table 7) reports configurations that degrade performance: removing Case 2 drops SEP by 22.4%, concat fusion drops utility by 13.75%, removing fusion spikes GCG ASR to 62.8%. Section 4.5.2 shows test-time defenses that degrade utility (Fake Completion)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of 12–49% SEP improvement are supported by Table 3 (80.9% vs 31.9% on LLaMA, 70.7% vs 58.6% on Mistral). The 66% ASR reduction claim is supported by Table 5 (GCG: 1.06% vs 66.67%). Utility 'on par with undefended' is supported by Table 6 (83.89% vs 85.37% AlpacaEval)."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims like 'DRIP improves role separation' are supported by ablation studies (Table 7) that isolate individual components through controlled single-variable manipulation. Each ablation modifies one design element while keeping others fixed."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The abstract specifies 'on LLaMA-8B and Mistral-7B across three prompt injection benchmarks.' Section 4.5.4 explicitly bounds scope: only 7–8B models, single-turn settings, text-only attacks. Model scale, multi-turn, and multimodal limitations are all stated."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "While the ablation study isolates component contributions, the paper does not discuss alternative explanations for the observed improvements. For example, it does not consider whether the DPO training alone (without architectural changes) or the data curation improvements might account for gains, or whether the additional parameters (0.21%) could confound comparisons."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper measures ASR and SEP score on specific benchmarks and frames these as measuring 'robustness against prompt injection' generally. No discussion of whether benchmark injection scenarios reflect real-world prompt injection threats, or whether the witness-string-based SEP metric captures the full spectrum of injection success."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper refers to 'LLaMA-8B' and 'Mistral-7B' without specifying exact model versions or checkpoints. Reference [19] points to 'The Llama 3 herd of models' but no specific snapshot (e.g., Meta-Llama-3-8B-Instruct) is given. Reference [25] for Mistral also lacks a specific version."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Figure 11 provides the full prompt used for training response generation via GPT-4o. Figure 12 provides the full auditor prompt for response verification. Evaluation follows standard benchmark protocols whose prompts are publicly available."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.4 reports LoRA rank r=16, α=8, dropout=0.05, one epoch, global batch size 24, learning rate 1×10⁻⁴. Hardware: 6 NVIDIA RTX 5880 GPUs with 48GB each. GCG suffix length of 20 tokens is stated (Table 2/Figure 2)."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. DRIP is a training-time defense applied to standard LLM architectures."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 documents the data curation pipeline: starting from SEP training split (10k tuples), discarding original injected tasks, resampling from SQuAD, generating responses with GPT-4o, applying XML-tagging sanitization and LLM-as-judge auditing. The iterative refinement process is described with the specific strategies used."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.5.4 'Future Work' serves as a limitations section, discussing three specific limitations: model scale (7–8B only), single-turn evaluation only, and text-only modality. Section 4.5.1 also discusses a failure mode."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.5.4 identifies threats specific to this study: 'All experiments in this work are conducted on open-source models in the 7B–8B parameter range... primarily due to computational and training resource constraints,' 'designed and evaluated in single-turn settings,' and lack of multimodal evaluation."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.5.4 explicitly states what was NOT tested: larger models ('13B or 34B'), multi-turn interactions ('multi-turn reasoning and memory'), and multimodal attacks ('vision-language models'). The threat model (Section 2) bounds the attack surface to indirect text injection."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The curated DPO training data (GPT-4o generated responses, audited pairs) is not independently available for verification. Evaluation benchmarks are public, but the core training data artifact that drives DRIP's performance is not verifiable."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 describes the data curation process in detail: source (SEP training split, SQuAD), resampling strategy, GPT-4o response generation with specific prompts (Figure 11), XML-tagging sanitization, and LLM-as-judge auditing (Figure 12)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are standard public benchmarks (SEP from SQuAD/Alpaca, AlpacaFarm, InjecAgent)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Figure 4 visualizes the full data curation pipeline: DPO pair construction → GPT-4o response generation → LLM-as-judge auditing → iterative refinement. Section 3.2 describes each step including sanitization strategies (response integrity and response utility)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No acknowledgments section, funding statement, or grant information appears anywhere in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: National University of Singapore and Shanghai Jiao Tong University. These are academic institutions with no obvious commercial stake in the evaluated methods."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. The absence of a funding disclosure means this criterion cannot be satisfied."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial disclosure appears in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense mechanism against prompt injection, not a pre-trained model's knowledge or capability on a benchmark. Contamination of the base model's training data is not relevant to evaluating defense effectiveness."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates defenses against injection attacks, not model knowledge. The relevant train/test separation (SEP training split vs evaluation set) is maintained by design."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Benchmark contamination (model having seen test tasks during pre-training) is not the concern here — the paper evaluates whether injected instructions are executed, which tests defense behavior rather than model knowledge."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All evaluation is automated using benchmark datasets."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The Ethical Considerations section confirms: 'This work does not involve human subjects, personally identifiable information, or any sensitive user data.'"
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or per-example timing is reported. Section 3.5 discusses parameter efficiency (0.21% additional parameters) but does not report wall-clock inference time or throughput."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Hardware is specified (6 NVIDIA RTX 5880 GPUs, 48GB each) and training runs for 1 epoch, but total GPU hours, training time, or API costs for GPT-4o data generation are not quantified."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds. All results appear to be from single experimental runs with no seed sensitivity analysis."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. Results are presented without indicating how many runs produced them."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is described. The ablation study tests architectural variants but does not report any systematic hyperparameter search budget for the chosen configuration."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The default configuration (linear shift + sum fusion + curated DPO data) is presented as the final method. While ablations show this combination performs well, the selection process for hyperparameters like LoRA rank, learning rate, and batch size is not described."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparisons across 5 baselines, 7+ attack types, 2 models, and 3+ benchmarks without any statistical testing, let alone correction for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors re-implement all four baselines (StruQ, SecAlign, ISE, PFT) but do not acknowledge the potential bias of evaluating their own system against their own re-implementations of competing methods."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Section 3.5 notes that DRIP adds only 0.21% parameters, but no comparison of training or inference compute across methods is provided. It is unclear whether DRIP and baselines use comparable compute budgets."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether SEP's witness-string-based evaluation, AlpacaFarm's exact-match 'hacked' criterion, or InjecAgent's API-call detection actually capture real-world prompt injection risk. No discussion of construct validity for any benchmark."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. DRIP modifies model architecture and training; comparisons are at the model level, not scaffold level."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the base models (LLaMA-8B, Mistral-7B) were pre-trained on data that includes SEP, AlpacaFarm, or InjecAgent benchmark content, which could affect the baseline performance levels."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For example, the SEP evaluation uses witness strings that the model may recognize from training data patterns."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The SEP training and evaluation sets are from the same benchmark suite (both use SQuAD-based tasks). No analysis of structural similarity or potential overlap between training and evaluation data."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method (canary strings, membership inference, decontamination) is applied."
       }
     }
   },
   "claims": [
     {
       "claim": "DRIP improves role separation score by 12–49% over existing defenses on the SEP benchmark.",
       "evidence": "Table 3: DRIP achieves 80.9% SEP on LLaMA-8B (vs SecAlign 31.9%, a 49pp improvement) and 70.7% on Mistral-7B (vs SecAlign 58.6%, a 12.1pp improvement).",
       "supported": "strong"
     },
     {
       "claim": "DRIP reduces attack success rate by over 66% for GCG adaptive attacks compared to existing defenses.",
       "evidence": "Table 5: Under GCG attack, DRIP achieves 1.06% ASR on LLaMA-8B vs SecAlign's 66.67%, and 3.37% on Mistral-7B vs SecAlign's 98.56%.",
       "supported": "strong"
     },
     {
       "claim": "DRIP achieves 0% ASR on all heuristic-based prompt injection attacks across both models.",
       "evidence": "Table 5: All heuristic attack families (Naive, Ignore, Completion, Escape, HackaPrompt) show 0.00% ASR for DRIP on both LLaMA-8B and Mistral-7B.",
       "supported": "strong"
     },
     {
       "claim": "DRIP maintains instruction-following utility comparable to the undefended model.",
       "evidence": "Table 6: AlpacaEval 2.0 win% is 83.89% (DRIP) vs 85.37% (Undefended) on LLaMA-8B. IFEval accuracy is actually higher for DRIP: 76.02% vs 72.66%. MT-Bench (Figure 8) shows DRIP closely tracks the undefended model.",
       "supported": "strong"
     },
     {
       "claim": "The de-instruction shift selectively applies stronger representation edits to instruction-like tokens while leaving neutral tokens largely unchanged.",
       "evidence": "Figure 7 visualizes token-wise ℓ2 shift magnitudes showing elevated shifts at boundary tokens and adversarial phrases ('ignore', 'disregard'). Figure 6 shows T-SNE visualization of linearly separable manifolds after editing.",
       "supported": "moderate"
     },
     {
       "claim": "Sum fusion provably halves the worst-case logit sensitivity to suffix perturbations compared to an undefended decoder.",
       "evidence": "Theorem 2 (Appendix B) provides a formal proof that sum fusion's Lipschitz constant is half the undefended decoder's. However, empirical validation of the bound's tightness is not provided.",
       "supported": "moderate"
     },
     {
       "claim": "Concat fusion significantly harms utility compared to sum fusion.",
       "evidence": "Table 7 ablation: concat fusion achieves 70.14% utility vs sum fusion's 83.89% on AlpacaEval 2.0, a 13.75pp degradation. Theorem 4 (Appendix C) provides information-theoretic justification.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or variance across runs",
       "detail": "All experimental results are reported as single-point estimates with no standard deviation, confidence intervals, or indication of multiple runs. Given that DPO training and LLM fine-tuning are sensitive to random seeds, this omission makes it impossible to assess result stability."
     },
     {
       "flag": "No statistical significance testing",
       "detail": "Claims of improvement (e.g., '12–49% improvement') are based entirely on comparing point estimates. With no significance tests, it is unclear whether observed differences are statistically meaningful or within natural variation."
     },
     {
       "flag": "Self-comparison bias in baseline re-implementation",
       "detail": "The authors re-implement all four baselines (StruQ, SecAlign, ISE, PFT) themselves. Lucic et al. (2018) showed that authors' re-implementations of baselines systematically underperform the original, yet this bias is not acknowledged or mitigated."
     },
     {
       "flag": "Small evaluation subset for AlpacaFarm",
       "detail": "The AlpacaFarm evaluation uses only 208 examples after filtering from 805 original prompts (Section 4.1.1). This small size combined with the lack of error bars raises questions about the stability of the reported ASR numbers."
     },
     {
       "flag": "Training data generated by model vulnerable to the studied attack",
       "detail": "Ground-truth DPO training responses are generated by GPT-4o, which the paper acknowledges is itself vulnerable to prompt injection (Section 3.2). While mitigated by XML-tagging and LLM auditing, this introduces a bootstrapping concern about training data quality."
     }
   ],
   "cited_papers": [
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Key baseline defense against prompt injection using adversarial training with structured delimiters and SFT objective."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2024,
       "arxiv_id": "2410.05451",
       "relevance": "Strongest prior baseline using DPO-based contrastive training for prompt injection defense."
     },
     {
       "title": "Instructional segment embedding: Improving LLM safety with instruction hierarchy",
       "authors": ["Tong Wu", "Shujian Zhang", "Kaiqiang Song"],
       "year": 2024,
       "arxiv_id": "2410.09102",
       "relevance": "Architectural defense using segment-type embeddings to distinguish instruction and data spans."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "GCG attack method used as the primary optimization-based adaptive attack in evaluation."
     },
     {
       "title": "Neural exec: Learning (and learning from) execution triggers for prompt injection attacks",
       "authors": ["Dario Pasquini", "Martin Strohmeier", "Carmela Troncoso"],
       "year": 2024,
       "arxiv_id": "2403.03792",
       "relevance": "NeuralExec attack method for learning universal adversarial execution triggers for prompt injection."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Agentic prompt injection benchmark with tool-based interactions used for evaluation."
     },
     {
       "title": "Can LLMs separate instructions from data? And what do we even mean by that?",
       "authors": ["Egor Zverev", "Sahar Abdelnabi", "Soroush Tabesh", "Mario Fritz", "Christoph H. Lampert"],
       "year": 2025,
       "arxiv_id": "2403.06833",
       "relevance": "SEP benchmark defining the instruction-data separation evaluation framework used as the primary benchmark."
     },
     {
       "title": "ASIDE: Architectural separation of instructions and data in language models",
       "authors": ["Egor Zverev", "Evgenii Kortukov", "Alexander Panfilov"],
       "year": 2025,
       "arxiv_id": "2503.10566",
       "relevance": "Related architectural approach imposing orthogonality between latent representations of instruction and data."
     },
     {
       "title": "Meta SecAlign: A secure foundation LLM against prompt injection attacks",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "David Wagner", "Chuan Guo"],
       "year": 2025,
       "arxiv_id": "2507.02735",
       "relevance": "Extension of SecAlign to foundation model level for prompt injection defense."
     },
     {
       "title": "Melon: Provable defense against indirect prompt injection attacks in AI agents",
       "authors": ["Kaijie Zhu", "Xianjun Yang", "Jindong Wang", "Wenbo Guo", "William Yang Wang"],
       "year": 2025,
       "arxiv_id": "2502.05174",
       "relevance": "Provable defense against indirect prompt injection in agentic settings."
     },
     {
       "title": "Fath: Authentication-based test-time defense against indirect prompt injection attacks",
       "authors": ["Jiongxiao Wang", "Fangzhou Wu", "Wendi Li"],
       "year": 2024,
       "arxiv_id": "2410.21492",
       "relevance": "Inference-time defense using authentication and hashing for retrieved content integrity."
     },
     {
       "title": "Are you still on track!? Catching LLM task drift with activations",
       "authors": ["Sahar Abdelnabi", "Aideen Fay", "Giovanni Cherubin", "Ahmed Salem", "Mario Fritz", "Andrew Paverd"],
       "year": 2024,
       "arxiv_id": "2406.00799",
       "relevance": "Detection-based defense monitoring activation shifts to detect prompt injection via task drift."
     },
     {
       "title": "Defending against indirect prompt injection attacks with spotlighting",
       "authors": ["Keegan Hines", "Gary Lopez", "Matthew Hall", "Federico Zarfati", "Yonatan Zunger", "Emre Kiciman"],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Inference-time defense using trusted-region encoding to mitigate indirect injection."
     },
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Formalization of prompt injection attack taxonomy and benchmark used to define attack categories in the evaluation."
     },
     {
       "title": "The illusion of role separation: Hidden shortcuts in LLM role learning (and how to fix them)",
       "authors": ["Zihao Wang", "Yibo Jiang", "Jiahao Yu", "Heqing Huang"],
       "year": 2025,
       "arxiv_id": "2505.00626",
       "relevance": "Analysis of shortcut learning in LLM role separation defenses, directly relevant to PFT baseline."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "DRIP provides a concrete, implementable defense with code released, but requires fine-tuning open-source LLMs — not immediately deployable without ML engineering effort."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The representation editing framing is novel but the overall direction of training-time prompt injection defense is well-established; results extend rather than challenge the field."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that existing defenses (including SecAlign) have 66–98% ASR under adaptive GCG attacks, raising concerns about deployed prompt injection defenses."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy or conflict framing; straightforward technical defense paper."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Anonymous code repository exists and an anonymous demo website is referenced, but requires GPU resources and fine-tuning to actually try."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "From NUS and SJTU — respected academic institutions but not headline AI labs."
     }
   }
 }