ai-research-survey

scan.json (24934B)

---

 {
   "paper": {
     "title": "Enhancing Security in Large Language Models: A Comprehensive Review of Prompt Injection Attacks and Defenses",
     "authors": ["Eleena Sarah Mathew"],
     "year": 2025,
     "venue": "Journal of Artificial Intelligence",
     "doi": "10.32604/jai.2025.069841"
   },
   "scan_version": 3,
   "active_modules": ["survey_methodology"],
   "methodology_tags": ["meta-analysis"],
   "key_findings": "This narrative review covers a small set of prompt injection attacks (HouYi, VPI) and defenses (StruQ, Signed-Prompt, RA-LLM, LLM Self Defense, PAP defense, GUARDIAN) along with three benchmarks (PromptBench, INJECAGENT, BIPIA). The summarized results suggest defenses like StruQ and RA-LLM can significantly reduce attack success rates (e.g., 98.7% to 10%), though none provide complete protection. The review lacks systematic methodology — no search protocol, no quality assessment of sources, and extremely limited scope despite claiming comprehensiveness.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code or analysis scripts are released. The paper is a literature review that could have released its classification data or analysis materials but did not."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "No dataset or structured extraction of reviewed papers is released. A survey could release its corpus of reviewed papers, extracted data tables, or classification annotations."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment or tooling information is provided. If any analysis scripts or data extraction tools were used, they are not described."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No instructions are provided for reproducing the review. There is no description of how to replicate the paper selection, classification, or synthesis process."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": false,
         "answer": false,
         "justification": "This is a narrative survey that does not run experiments or perform statistical aggregation. No statistical results of its own are produced."
       },
       "significance_tests": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper with no experiments of its own. No comparative statistical claims are made."
       },
       "effect_sizes_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments conducted. The paper only reports effect sizes from reviewed papers."
       },
       "sample_size_justified": {
         "applies": false,
         "answer": false,
         "justification": "No experiments or statistical analyses are performed in this survey."
       },
       "variance_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are run. The paper only summarizes results from other studies."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not compare itself against prior surveys of prompt injection attacks and defenses. No positioning relative to existing review papers is provided."
       },
       "baselines_contemporary": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are conducted requiring baseline comparisons."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "No system to ablate — this is a survey paper."
       },
       "multiple_metrics": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are conducted. No evaluation metrics are defined for the review itself."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "No system outputs to evaluate. This is a narrative review."
       },
       "held_out_test_set": {
         "applies": false,
         "answer": false,
         "justification": "No experiments requiring test/validation splits."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "The paper organizes its review by category: attacks are broken into direct (role-playing, scenario nesting, context-based, code injection, template-based, obfuscation) and indirect (data poisoning, external source manipulation). Defenses are categorized as prevention-based and detection-based. Tables 1 and 2 summarize results by defense type and attack type respectively."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 discusses where defenses fall short: 'StruQ is only capable of defending programmatic applications, which makes it vulnerable against web-based chatbots,' VPI settings do not address all possible cases, and evaluation was limited to 7B and 13B models."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports defense limitations: StruQ struggled against TAP attacks (reducing only to 9-36%), debiasing prompting was less effective for VPI, and LLaMA-2 had lower performance (77%) compared to GPT-3.5 (98%) for LLM Self Defense."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims to provide a 'comprehensive review' and a 'systemic classification framework,' but the paper only covers ~6 attack/defense methods and 3 benchmarks. The abstract also claims to 'integrate and compare results from multiple recent benchmarks' but Tables 1 and 2 contain only 2 entries each, which is far from a meaningful comparison."
       },
       "causal_claims_justified": {
         "applies": false,
         "answer": false,
         "justification": "The paper makes no causal claims of its own. It reports findings from reviewed papers without making independent causal assertions."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'A Comprehensive Review' but the paper only reviews a handful of methods (~6 attacks/defenses, 3 benchmarks) from a vast and rapidly growing literature. The scope is not bounded — no explicit statement of what is excluded or what makes this sample representative."
       },
       "alternative_explanations_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This is a pure survey/taxonomy paper that presents no empirical results of its own."
       },
       "proxy_outcome_distinction": {
         "applies": false,
         "answer": false,
         "justification": "No measurements are taken in this survey paper. It reports other papers' measurements."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": false,
         "answer": false,
         "justification": "No models are used by the authors. This is a literature review."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "No prompting is performed. This is a literature review."
       },
       "hyperparameters_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are conducted."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used in this survey."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "No paper selection pipeline is documented. There is no description of search queries, databases searched, inclusion/exclusion criteria, or screening stages. The paper does not explain how the reviewed papers were identified or selected."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations section for the review itself. Section 6 discusses limitations of the reviewed methods (StruQ, VPI, etc.) but not limitations of the review methodology. Section 7 (Conclusion) discusses future directions but not the review's own shortcomings."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity of the review are discussed. The paper does not acknowledge potential selection bias in its choice of papers, the lack of systematic methodology, or the narrow scope of the review."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper does not clarify what types of attacks/defenses are excluded, what time period is covered, or what criteria determined inclusion. The title claims 'Comprehensive Review' without bounding what that means."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data (e.g., list of all papers considered, screening decisions, extracted data) is made available. The review's data sources are not independently verifiable."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "No description of how papers were found or selected. There is no mention of search queries, databases, date ranges, or any systematic collection procedure."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "No data pipeline is documented. There is no PRISMA-style flow diagram, no counts of papers at each screening stage, and no description of the process from initial collection to final inclusion."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The funding statement explicitly says: 'The author did not receive funding from public, commercial, or non-profit sectors.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliation is disclosed: Department of Computer Science and Engineering, Motilal Nehru National Institute of Technology, Allahabad, India."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "The paper is unfunded per the funding statement."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": true,
         "justification": "The paper states: 'The author declares no conflicts of interest to report regarding the present study.'"
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This is a survey paper that does not evaluate any pre-trained model on a benchmark."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper — no model evaluation is conducted."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper — no benchmark evaluation is performed."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this literature review."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper states: 'This study is a literature review that does not involve human subjects.'"
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper — no system or method whose costs could be reported."
       },
       "compute_budget_stated": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper — no computational experiments are run."
       }
     },
     "survey_methodology": {
       "prisma_or_structured_protocol": {
         "applies": true,
         "answer": false,
         "justification": "No PRISMA flow diagram, no structured search protocol, no reproducible search queries, and no stated review methodology. The paper selection appears entirely ad hoc."
       },
       "quality_assessment_of_sources": {
         "applies": true,
         "answer": false,
         "justification": "No quality assessment of the reviewed papers is performed. All cited works are treated as equally valid regardless of their methodological rigor. The review does not use any quality scoring rubric or risk-of-bias assessment."
       },
       "publication_bias_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of publication bias. The paper does not consider whether its sources are biased toward positive results or whether negative findings are underrepresented."
       }
     }
   },
   "claims": [
     {
       "claim": "HouYi revealed vulnerabilities in 31 of 36 tested LLM-powered applications, achieving an 86.1% attack success rate.",
       "evidence": "Section 3.1 cites Liu et al. (2024) [reference 36]. The claim is directly imported from the reviewed paper with no independent verification.",
       "supported": "moderate"
     },
     {
       "claim": "StruQ reduced attack success rates to below 2% for nearly all attack types on Alpaca and Mistral, though TAP attacks were only reduced to 9% (Alpaca) and 36% (Mistral).",
       "evidence": "Section 4.1, Table 1. Results are directly cited from Chen et al. (2024) [reference 38].",
       "supported": "moderate"
     },
     {
       "claim": "RA-LLM reduced attack success rates from 98.7% to 10% on Vicuna-7B and from 96% to 6.7% on Guanaco-7B.",
       "evidence": "Section 4.3, Table 1. Results are directly cited from Phute et al. (2024) [reference 17].",
       "supported": "moderate"
     },
     {
       "claim": "This paper provides a 'comprehensive review' with a 'systemic classification framework' for prompt injection attacks and defenses.",
       "evidence": "Abstract and Section 2. The classification distinguishes direct vs indirect attacks and prevention vs detection defenses, but only ~6 methods are reviewed in detail. Tables 1 and 2 contain only 2 entries each.",
       "supported": "weak"
     },
     {
       "claim": "VPI can change half of answers on targeted topics by poisoning just 0.1% of instruction tuning data.",
       "evidence": "Section 3.2 cites Yan et al. (2024) [reference 37]. The claim is imported from the reviewed paper.",
       "supported": "moderate"
     },
     {
       "claim": "LLM Self Defense achieves 99% accuracy for GPT-3.5 and 94.6% for LLaMA-2 in classifying harmful content.",
       "evidence": "Section 4.4 cites Phute et al. (2024) [reference 17]. Results directly imported from reviewed paper.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Comprehensive claim with narrow scope",
       "detail": "The title claims 'A Comprehensive Review' but only ~6 attack/defense methods and 3 benchmarks are reviewed in detail. The prompt injection literature is vastly larger. Tables 1 and 2 contain only 2 entries each, which is insufficient for meaningful comparison."
     },
     {
       "flag": "No systematic review methodology",
       "detail": "No search protocol, no stated databases, no search queries, no inclusion/exclusion criteria, no PRISMA diagram. The paper selection appears entirely ad hoc, making it impossible to assess completeness or bias."
     },
     {
       "flag": "No quality assessment of sources",
       "detail": "All reviewed papers are treated equally without any assessment of their methodological quality. This is a recognized weakness in survey methodology — the review launders the signal-to-noise ratio of its sources."
     },
     {
       "flag": "Results are entirely imported from reviewed papers",
       "detail": "The paper presents no original analysis. All numbers in Tables 1 and 2 and the discussion are directly copied from cited papers without independent verification or cross-comparison under consistent conditions."
     },
     {
       "flag": "No limitations of the review itself discussed",
       "detail": "The paper discusses limitations of the reviewed methods but never acknowledges limitations of its own review methodology, such as the narrow scope, lack of systematic search, or potential selection bias."
     },
     {
       "flag": "Writing quality concerns",
       "detail": "The paper contains redundant paragraphs (the introduction repeats the same points about prevention and detection-based defenses in Section 1), the abstract mentions 'INJECENT' (likely a typo for INJECAGENT), and the reference numbering for RA-LLM and LLM Self Defense both point to [17]."
     }
   ],
   "cited_papers": [
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["A. Zou", "Z. Wang", "N. Carlini", "M. Nasr", "J.Z. Kolter", "M. Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Foundational work on automated adversarial attacks against aligned LLMs, demonstrating transfer across open and closed-source models."
     },
     {
       "title": "Prompt injection attack against LLM-integrated applications",
       "authors": ["Y. Liu", "G. Deng", "Y. Li", "K. Wang", "Z. Wang", "X. Wang"],
       "year": 2024,
       "arxiv_id": "2306.05499",
       "relevance": "Introduces the HouYi black-box prompt injection attack achieving 86.1% success rate across 36 LLM-integrated applications."
     },
     {
       "title": "Backdooring instruction-tuned large language models with virtual prompt injection",
       "authors": ["J. Yan", "V. Yadav", "S. Li", "L. Chen", "Z. Tang", "H. Wang"],
       "year": 2024,
       "arxiv_id": "2307.16888",
       "relevance": "Novel data poisoning attack (VPI) that manipulates LLM behavior by poisoning just 0.1% of instruction tuning data."
     },
     {
       "title": "StruQ: defending against prompt injection with structured queries",
       "authors": ["S. Chen", "J. Piet", "C. Sitawarin", "D. Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Proposes structured queries as a defense against prompt injection, reducing attack success to below 2% for most techniques."
     },
     {
       "title": "Signed-prompt: a new approach to prevent prompt injection attacks against LLM-integrated applications",
       "authors": ["X. Suo"],
       "year": 2024,
       "arxiv_id": "2401.07612",
       "relevance": "Defense strategy using cryptographic signatures on authorized instructions to prevent prompt injection."
     },
     {
       "title": "LLM self defense: by self examination, LLMs know they are being tricked",
       "authors": ["M. Phute", "A. Helbling", "M. Hull", "S.-Y. Peng", "S. Szyller", "C. Cornelius"],
       "year": 2024,
       "arxiv_id": "2308.07308",
       "relevance": "Uses a second LLM to screen generated content for harmful output, achieving 99% accuracy with GPT-3.5."
     },
     {
       "title": "How johnny can persuade LLMs to jailbreak them: rethinking persuasion to challenge AI safety by humanizing LLMs",
       "authors": ["Y. Zeng", "H. Lin", "J. Zhang", "D. Yang", "R. Jia", "W. Shi"],
       "year": 2024,
       "arxiv_id": "2401.06373",
       "relevance": "Demonstrates persuasive adversarial prompts (PAP) using 40 social science persuasion techniques to jailbreak LLMs."
     },
     {
       "title": "GUARDIAN: A multi-tiered defense architecture for thwarting prompt injection attacks on LLMs",
       "authors": ["P. Rai", "S. Sood", "V.K. Madisetti", "A. Bahga"],
       "year": 2024,
       "doi": "10.4236/jsea.2024.171003",
       "relevance": "Multi-layer guardrail framework combining system prompt analysis, fine-tuned classification, and pre-display filtering for LLM safety."
     },
     {
       "title": "PromptBench: towards evaluating the robustness of large language models on adversarial prompts",
       "authors": ["K. Zhu", "J. Wang", "J. Zhou", "Z. Wang", "H. Chen", "Y. Wang"],
       "year": 2023,
       "arxiv_id": "2306.04528",
       "relevance": "Benchmark for evaluating LLM resilience to adversarial prompts using Performance Drop Rate metric."
     },
     {
       "title": "InjecAgent: benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Q. Zhan", "Z. Liang", "Z. Ying", "D. Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Benchmark for evaluating LLM agent vulnerability to indirect prompt injection with realistic attack scenarios involving tool use."
     },
     {
       "title": "Benchmarking and defending against indirect prompt injection attacks on large language models",
       "authors": ["J. Yi", "Y. Xie", "B. Zhu", "E. Kiciman", "G. Sun", "X. Xie"],
       "year": 2023,
       "arxiv_id": "2312.14197",
       "relevance": "BIPIA benchmark evaluating indirect prompt injection risk across 5 application contexts with 250 distinct attacker goals."
     },
     {
       "title": "Prompt injection attacks and defenses in LLM-integrated applications",
       "authors": ["Y. Liu", "Y. Jia", "R. Geng", "J. Jia", "N.Z. Gong"],
       "year": 2023,
       "arxiv_id": "2310.12815",
       "relevance": "Comprehensive study of prompt injection attacks and defenses including paraphrasing, retokenization, and LLM-based detection methods."
     },
     {
       "title": "Jailbroken: how does LLM safety training fail?",
       "authors": ["A. Wei", "N. Haghtalab", "J. Steinhardt"],
       "year": 2023,
       "arxiv_id": "2307.02483",
       "relevance": "Analyzes failure modes of LLM safety training, foundational for understanding jailbreak vulnerabilities."
     },
     {
       "title": "Defending against indirect prompt injection attacks with spotlighting",
       "authors": ["K. Hines", "G. Lopez", "M. Hall", "F. Zarfati", "Y. Zunger", "E. Kiciman"],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Defense technique using spotlighting to protect against indirect prompt injection attacks on LLMs."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "Provides a high-level overview of attack/defense landscape useful for awareness but offers no new tools, techniques, or actionable guidance."
     },
     "surprise_contrarian": {
       "score": 0,
       "justification": "Confirms well-known concerns about prompt injection vulnerabilities without challenging any conventional wisdom."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Reviews high attack success rates (86.1% for HouYi) and incomplete defenses, reinforcing concerns about LLM security."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no strong claims against any organization or established approach."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or tool is provided. Purely textual review."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Mentions GPT-4, ChatGPT, and LLaMA but is authored by a single researcher at a lesser-known institution."
     }
   }
 }