ai-research-survey

scan.json (31724B)

---

 {
   "paper": {
     "title": "PromptScreen: Efficient Jailbreak Mitigation Using Semantic Linear Classification in a Multi-Staged Pipeline",
     "authors": [
       "Akshaj Prashanth Rao",
       "Advait Singh",
       "Saumya Kumaar Saksena",
       "Dhruv Kumar"
     ],
     "year": 2025,
     "venue": "arXiv preprint",
     "arxiv_id": "2512.19011",
     "doi": "10.48550/arXiv.2512.19011"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "PromptScreen proposes a multi-stage defense pipeline against LLM jailbreak and prompt injection attacks, centered on a lightweight Linear SVM classifier operating on TF-IDF features. The SVM module achieves 93.4% accuracy and 96.5% specificity on a held-out test set of 2,000+ prompts, substantially outperforming ShieldGemma (35.1% accuracy) while being 10× faster. The full pipeline combining SVM, VectorDB, and classifier cluster achieves 0% Attack Success Rate on 1,456 adversarial prompts. An ablation study shows character n-gram features (94.09%) outperform word-level features (90.27%) on an augmented adversarial dataset.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "GitHub repository URL provided in Section 7: https://github.com/dronefreak/PromptScreen. The paper states 'the source code is available at' this URL."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 states: 'Both the corpus and associated preprocessing scripts are included in the open-source release of this work to facilitate continued benchmarking and community evaluation.' The dataset of 30,937 labeled prompts is described as released."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, conda environment file, or detailed environment specification is mentioned in the paper. Library versions are not listed."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README with commands, or 'Reproducing Results' section is included in the paper. The algorithms are described in pseudocode but no executable reproduction guide is provided."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 2, 3, and 4 are reported as point estimates only (e.g., '93.40% accuracy'). No confidence intervals, error bars, or ± notation appears anywhere."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims the SVM 'outperforms' ShieldGemma and other baselines based solely on comparing raw metric values. No statistical significance tests (p-values, t-tests, bootstrap tests, etc.) are used."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports improvements with baseline context: 'improves overall accuracy from 35.1% to 93.4%' and 'reducing average time-to-completion from ≈450s to 47s, yielding over 10× lower latency.' Tables 2 and 3 provide sufficient context to assess magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification given for the corpus size of 30,937 prompts or the test set of 2,000+ prompts. No power analysis or discussion of whether the sample size is adequate for the claims being made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "All results appear to be from single runs. No standard deviations, variance across seeds, or multi-run spread measures are reported in any table."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 compares three defense approaches: ShieldGemma, the classifier cluster, and the LSVM. Table 3 compares three pipeline configurations with different defense subsets."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "ShieldGemma (Google, 2024) is a recent production-grade defense. The classifier cluster uses contemporary HuggingFace models (textdetox/xlmr-large-toxicity-classifier-v2, jackhhao/jailbreak-classifier)."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 presents a systematic SVM ablation study across 8 feature configurations (word n-grams, char n-grams, hybrid). Table 3 also ablates pipeline configurations by including/excluding defense stages."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Tables 2 and 4 report precision, sensitivity, specificity, negative predictive value, and accuracy. Table 3 adds block rate, ASR, and average TTC. Well over two metrics are used."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated. Classification performance uses standard metrics; ASR is judged by an LLM-as-a-judge and verified by Gemini. No human evaluation of the system's outputs or classifications is performed."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 states: 'A held-out test set of more than 2,000 prompts is reserved exclusively for evaluation of defense configurations and Attack Success Rate. No prompt appears in more than one split.'"
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 breaks down performance per individual defense module. Table 3 shows results per pipeline configuration. Table 4 shows per-SVM-configuration results. Table 1 shows dataset composition by class (jailbreak, benign, prompt-injection)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.1 explicitly discusses 'defenses that were implemented but did not meet our robustness or usability requirements,' including the heuristic vector analyzer (false positive issues) and PPA (insufficient protection). Section 8 discusses failure scenarios."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.1 reports two failed defense strategies: the heuristic vector analyzer ('prone to false positives on benign prompts') and Polymorphic Prompt Assembly ('protection was not sufficient against the strongest attacks')."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of 93.4% accuracy, 96.5% specificity, and 10× lower latency than ShieldGemma are directly supported by Tables 2 and 3. The '35.1% to 93.4%' improvement and '≈450s to 47s' TTC claims match the tabulated results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims ('LSVM improves accuracy,' 'this module achieves...'). The ablation study (Section 6) and pipeline configuration comparisons (Table 3) provide controlled manipulation of components, supporting these claims through single-variable ablation design."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims 'scalable, resource-efficient protection against prompt-based adversarial behavior' broadly, but the system is tested only on English prompts with specific attack types from known datasets. While Section 8 acknowledges multilingual limitations, the title and conclusion make sweeping claims about 'modern LLM-driven applications' that exceed the tested scope."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for its results. For instance: could ShieldGemma's poor 35.1% accuracy be due to misconfiguration? Could the dataset composition favor keyword-based detection? Could the 0% ASR reflect the attack corpus rather than the defense quality? None of these alternatives are considered."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper directly measures classification accuracy, ASR, and TTC — the same quantities it claims to evaluate. There is no proxy gap: the paper claims to measure defense accuracy and latency, and that is what it measures."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model identifiers are provided: ShieldGemma-2B, gpt-oss:20b (target LLM), textdetox/xlmr-large-toxicity-classifier-v2, jackhhao/jailbreak-classifier. These are sufficiently specific model identifiers to reproduce the setup."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "ShieldGemma is described as consuming 'the prompt alongside structured safety guidelines' but these guidelines are not shown. The LLM-as-a-judge Attack Evaluator uses 'predefined criteria' that are not provided. No actual prompt text is given for any LLM-based component."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameters are reported for the Linear SVM (C value, regularization), TF-IDF vectorizer (max_features, min/max df), VectorDB similarity threshold τ, or any model component. The paper describes the architecture but not its parameterization."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The system is a sequential classification pipeline, not an agent with tool use, memory, or iterative reasoning."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.3.1 documents the text preprocessing pipeline in detail: lowercasing, emoji-to-text conversion, punctuation removal, tokenization, alphabetic filtering, stopword removal, and POS-aware WordNet lemmatization. Dataset construction is documented in Section 3.2."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 8 ('Limitations') is a dedicated limitations section with three specific subsections: Multilingual Constraints, Contextual and Multi-turn Awareness, and Generalization to Zero-Day Attacks."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations are specific to this study: (1) preprocessing pipeline is optimized for English only, (2) evaluates single-turn prompts and may miss multi-turn distributed attacks, (3) SVM performance bounded by training corpus diversity for zero-day attacks. These are concrete, study-specific threats."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 8 explicitly states the system 'does not address or evaluate protection against multilingual jailbreak attempts,' is limited to 'isolated, single-turn inputs,' and performance is 'bounded by the diversity of its training corpus' for novel attack strategies."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 states: 'Both the corpus and associated preprocessing scripts are included in the open-source release.' All dataset instances are 'serialized in structured JSON with explicit source metadata and taxonomy labels.'"
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 describes data sources in detail: manually curated jailbreaks from prior literature, automated adversarial prompts from ADV-LLM, prompt-injection examples from gentelbench-v1, and benign prompts from public instruction-following datasets. Labeling taxonomy with three classes is defined."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": true,
         "justification": "Data sources are described: adversarial prompts from prior academic literature (Liu et al., Sun et al., Pathade), ADV-LLM automated outputs, gentelbench-v1 dataset, and public instruction-following datasets for benign prompts. Each source's purpose and origin is stated in Section 3.2."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "While data sources and final composition (Table 1: 30,937 total) are described, the pipeline from source collection to final dataset lacks detail. How many examples came from each source is not stated. The filtering process ('manually reviewed to remove ambiguous cases') gives no counts of how many were removed or what criteria defined 'ambiguous.'"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding sources are disclosed. The Acknowledgement section (Section 9) only mentions the use of ChatGPT for writing assistance, with no mention of grants, sponsors, or funding agencies."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly stated: BITS Pilani and Trustwise. Dhruv Kumar has a dual affiliation with both institutions."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Cannot assess funder independence since funding is not disclosed. One author (Dhruv Kumar) is affiliated with Trustwise, a company in the AI trust/safety space that could benefit commercially from demonstrating lightweight defense effectiveness."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement appears in the paper. The Trustwise affiliation raises potential commercial interest in the defense pipeline's success, but this is not discussed."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defense mechanisms (SVM, classifier cluster, etc.) against adversarial prompts, not a pre-trained model's capability on a benchmark. The target LLM (gpt-oss:20b) is used only to measure ASR (whether attacks pass through defenses), not to evaluate model knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates defense tools rather than a pre-trained model's capability on a benchmark. Contamination in the traditional sense (model has seen test data during pre-training) does not apply."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defense mechanisms, not model capability on benchmarks. The SVM is trained by the authors on their own dataset, not a pre-trained model being evaluated on a potentially contaminated benchmark."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All evaluation is automated on a curated prompt dataset."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study evaluates defense mechanisms on text prompts without involving human subjects."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Time-to-Classify (TTC) is reported in Table 3: {VectorDB, Classifier} at 30.13s, {YARA, Cluster, VectorDB, ShieldGemma} at 450.35s, and {SVM, VectorDB, Classifier} at 47.24s. Section 5.3 discusses computational efficiency as a primary evaluation dimension."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. Hardware specifications, GPU/CPU used for experiments, total training time for the SVM, or total evaluation time across the test set are not reported."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds or seed sensitivity analysis. The SVM training and all evaluations appear to be single-run results with no assessment of seed-dependent variance."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. Results appear to come from single runs but this is not explicitly confirmed."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. The SVM ablation (Section 6) tests different feature configurations but the number of configurations tried, search method, or computational cost of the search is not disclosed."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The main results (Table 2) use the LSVM module but it is unclear which specific TF-IDF configuration was used — the ablation (Table 4) shows char n-gram (2,4) as best at 94.09%, but the main results report 93.4%. The selection of the final configuration is not justified."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Multiple comparisons are made across defense configurations (Table 2, 3) and SVM variants (Table 4) without any correction for multiple comparisons. No statistical tests are performed at all, let alone corrected ones."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors train, configure, and evaluate their own SVM system against baselines without acknowledging author-evaluation bias. No independent evaluation is performed, and no discussion of the bias inherent in self-evaluation appears."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 reports both defense effectiveness (block rate, ASR) and TTC per configuration, enabling performance-vs-compute comparison. Section 5.3 explicitly discusses the latency trade-off between lightweight (SVM, 47s) and heavyweight (ShieldGemma, 450s) defenses."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether its curated corpus of 30,937 prompts is representative of real-world attack distributions, whether the attack difficulty matches production threats, or whether the benchmark actually measures what is claimed about 'robust defense.'"
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is involved. The defense pipeline is a sequential classifier, and comparisons are between defense modules, not between models in different scaffolds."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether adversarial prompts in the training set were generated or collected before or after the test prompts, or whether temporal ordering could introduce leakage in the SVM's training."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup provides information not available in real deployment. The VectorDB stores known attack signatures that could overlap structurally with test attacks from the same source campaigns."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'No prompt appears in more than one split' but does not address whether train and test prompts from the same source (e.g., ADV-LLM) share structural patterns or were generated by the same attack algorithms, which would compromise independence."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is described. Only basic non-overlap between splits is ensured, without n-gram analysis, membership inference, or decontamination pipelines."
       }
     }
   },
   "claims": [
     {
       "claim": "The SVM-based semantic filter achieves 93.4% accuracy and 96.5% specificity on held-out data.",
       "evidence": "Table 2 reports accuracy of 0.9340 and specificity of 0.9650 for the 'Text processing + Semantic LSVM' configuration evaluated on the held-out test set.",
       "supported": "strong"
     },
     {
       "claim": "The SVM-based configuration improves overall accuracy from 35.1% to 93.4% while reducing average TTC from ~450s to 47s, yielding over 10× lower latency than ShieldGemma.",
       "evidence": "Tables 2 and 3 show ShieldGemma at 35.13% accuracy / 450.35s TTC versus the SVM configuration at 93.4% accuracy / 47.24s TTC. The comparison is between different system types (LLM-based moderator vs. classical ML classifier).",
       "supported": "moderate"
     },
     {
       "claim": "The full pipeline {SVM, VectorDB, Classifier} achieves 0% Attack Success Rate across all evaluated adversarial attempts.",
       "evidence": "Table 3 shows 0 successful attacks out of 51 attempted (1,405 of 1,456 blocked), yielding 0.00% ASR. Results independently verified using Gemini.",
       "supported": "moderate"
     },
     {
       "claim": "Character n-gram features outperform word-level features for adversarial prompt detection under perturbation.",
       "evidence": "Table 4 shows char n-gram (2,4) achieving 94.09% accuracy vs. baseline word unigram at 90.27% on the augmented (perturbed) dataset. The pattern is consistent across char n-gram variants.",
       "supported": "strong"
     },
     {
       "claim": "Lightweight semantic classifiers can outperform heavier LLM-based moderators in accuracy-focused evaluation settings.",
       "evidence": "Table 2 shows LSVM at 93.4% accuracy vs ShieldGemma at 35.1%. However, ShieldGemma's anomalously low accuracy may indicate suboptimal configuration rather than an inherent limitation of LLM-based approaches.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "Anomalously poor baseline performance",
       "detail": "ShieldGemma achieves only 35.1% accuracy, well below random chance for binary classification. This suggests possible misconfiguration, suboptimal prompt design, or a mismatch between the evaluation setup and ShieldGemma's intended use case. The paper does not investigate or explain this anomalously poor performance."
     },
     {
       "flag": "No error bars or repeated runs",
       "detail": "All results in Tables 2, 3, and 4 are single-run point estimates with no uncertainty quantification. For an SVM that depends on train/test split composition, this is a significant omission."
     },
     {
       "flag": "0% ASR may be artificially clean",
       "detail": "Achieving exactly 0% ASR on 1,456 adversarial prompts, with only 51 prompts reaching the target LLM, is claimed without uncertainty bounds. The low number of prompts actually reaching the LLM (51) means the true ASR may fluctuate significantly with different test samples."
     },
     {
       "flag": "Undisclosed conflict of interest",
       "detail": "Co-author Dhruv Kumar is affiliated with Trustwise, a company in the AI trust/safety space. A commercially viable lightweight defense pipeline directly serves Trustwise's business interests, yet no competing interests statement is provided."
     },
     {
       "flag": "Train-test independence not verified",
       "detail": "Adversarial prompts from the same source (e.g., ADV-LLM) may share structural patterns between train and test splits. The paper ensures no exact duplicates but does not verify independence of attack patterns across splits, risking inflated accuracy estimates."
     }
   ],
   "cited_papers": [
     {
       "title": "Prompt Injection Attacks and Defenses in Vision-Language Models",
       "authors": ["B. Greshake", "T. Lode", "R. Greshake"],
       "year": 2024,
       "relevance": "Foundational work on prompt injection attacks and defenses extending to vision-language models, directly relevant to LLM security research."
     },
     {
       "title": "Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study",
       "authors": ["Y. Liu", "S. Li", "T. Wang", "P. Zhang", "S. Yan"],
       "year": 2024,
       "arxiv_id": "2305.13860",
       "relevance": "Empirical study categorizing jailbreak strategies including role-playing and privilege escalation, directly relevant to LLM safety evaluation."
     },
     {
       "title": "Greedy Coordinate Gradient-Based Search for Universal Adversarial Attacks",
       "authors": ["A. Zou", "Z. Li", "D. Zhou", "Y. Wu", "J. Gu", "Y. Wang"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Introduces GCG universal adversarial suffix attack, a foundational attack method against LLM safety alignment."
     },
     {
       "title": "Iterative Self-Tuning LLMs for Enhanced Jailbreaking Capabilities",
       "authors": ["K. Sun", "H. Yang", "Q. Liu"],
       "year": 2024,
       "arxiv_id": "2410.18469",
       "relevance": "Demonstrates automated iterative jailbreak refinement achieving near-perfect success rates, relevant to adversarial attack research on LLMs."
     },
     {
       "title": "From LLMs to MLLMs to Agents: A Survey of Emerging Security Challenges",
       "authors": ["Y. Mao", "T. Huang", "Z. Liu"],
       "year": 2025,
       "arxiv_id": "2506.15170",
       "relevance": "Survey of security challenges in the progression from LLMs to multimodal models to agentic systems."
     },
     {
       "title": "Intention Analysis Makes LLMs a Good Jailbreak Defender",
       "authors": ["Y. Zhang", "X. Wang", "M. Liu"],
       "year": 2024,
       "arxiv_id": "2401.06561",
       "relevance": "Pre-generation intent analysis for jailbreak defense, directly relevant to LLM safety and defense methodology."
     },
     {
       "title": "Attention Tracker: Detecting Prompt Injection Attacks in LLMs",
       "authors": ["S. Hung", "H. Chien", "Y. Lee"],
       "year": 2025,
       "arxiv_id": "2411.00348",
       "relevance": "Uses model-internal attention signals to detect prompt injection, representing an alternative detection approach to external classifiers."
     },
     {
       "title": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically",
       "authors": ["S. Mehrotra", "S. Dathathri", "A. Garg"],
       "year": 2023,
       "arxiv_id": "2312.02119",
       "relevance": "Automated black-box jailbreak method using Tree-of-Thought exploration, relevant to LLM safety and adversarial attack research."
     },
     {
       "title": "Multi-Turn Jailbreaking Large Language Models via Attention Shifting",
       "authors": ["X. Du", "F. Mo", "M. Wen", "T. Gu", "H. Zheng", "H. Jin", "J. Shi"],
       "year": 2025,
       "relevance": "Demonstrates multi-turn jailbreak attacks exploiting dialogue history, relevant to agentic LLM security challenges."
     },
     {
       "title": "Emoji Attack: A Method for Misleading Judge LLMs in Safety Risk Detection",
       "authors": ["Y. Wei", "J. Chen", "Z. Li"],
       "year": 2024,
       "arxiv_id": "2411.01077",
       "relevance": "Demonstrates token-manipulation attacks (emoji insertion) that mislead safety classifiers, relevant to LLM safety evaluation."
     },
     {
       "title": "Embedding-based classifiers can detect prompt injection attacks",
       "authors": ["M. A. Ayub", "S. Majumdar"],
       "year": 2024,
       "arxiv_id": "2410.22284",
       "relevance": "Prior work on using embedding-based classification for prompt injection detection, a directly comparable approach to PromptScreen."
     },
     {
       "title": "ShieldGemma: A Generative AI Safety Classifier",
       "authors": ["Google"],
       "year": 2024,
       "relevance": "Production-grade LLM safety classifier used as a primary baseline in this paper's evaluation."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Proposes a deployable defense pipeline with released code, useful for practitioners securing LLM applications, though not a plug-and-play solution."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The finding that a simple SVM outperforms an LLM-based moderator is somewhat surprising but aligns with known advantages of classical ML for specific classification tasks."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Directly addresses LLM jailbreak and prompt injection attacks, a growing security concern for AI-powered applications."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Implicit criticism of ShieldGemma's performance (35.1% accuracy) could generate mild discussion, but no dramatic controversy."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code and dataset released on GitHub, allowing practitioners to test and replicate the defense pipeline."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "Authors are from BITS Pilani and Trustwise, neither of which are widely recognized in the AI safety community."
     }
   }
 }