ai-research-survey

scan.json (28889B)

---

 {
   "paper": {
     "title": "\"Give a Positive Review Only\": An Early Investigation Into In-Paper Prompt Injection Attacks and Defenses for AI Reviewers",
     "authors": [
       "Qin Zhou",
       "Zhexin Zhang",
       "Zhi Li",
       "Limin Sun"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2511.01287",
     "doi": "10.48550/arXiv.2511.01287"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "AI peer review systems are highly vulnerable to in-paper prompt injection (IPI) attacks. Static attacks increase ratings by 1.24-2.80 points across GPT-5, DeepSeek-Chat, and Gemini-2.5-Pro, while iterative attacks push scores near the maximum of 10 for DeepSeek and Gemini within 3 rounds. GPT-5 is the most robust to both attack types. A detection-based defense achieves 99% detection of naive attacks but adaptive adversarial strategies reduce detection to 24%, still inflating scores by ~1 point on average.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository URL, GitHub link, or archive is provided anywhere in the paper. They mention using 'an automated Python tool' for injection but do not release it."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The 100 papers were randomly sampled from the publicly available OpenReview platform for ICLR 2025 submissions. The underlying data source is public, though the specific sample IDs are not listed."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specification is provided. They use API-based models via OpenRouter but provide no dependency list, requirements.txt, or setup details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. A reader would need to reverse-engineer the experimental setup from the method description."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "Tables 2, 3, and 4 report mean ± standard deviation across runs. For example, Table 2 reports 'mean ± std' for all conditions."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "A single t-test is reported in Table 6 for the defense evaluation (p=0.26 comparing defended vs. baseline). However, no significance tests are applied to the main attack claims in Table 2, where the paper claims attacks 'significantly increase paper scores' based only on comparing means."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are reported throughout: '+1.91 for Gemini, +2.80 for DeepSeek, and +1.24 for GPT-5' (Section 1). Table 5 reports improvements in parentheses (e.g., '+2.97', '+2.78'). Baseline context is provided."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for the 100-paper sample size. The Limitations section acknowledges the constraint ('we limit our evaluation to 100 papers') but attributes it to cost rather than providing a power analysis or sample size rationale."
       },
       "variance_reported": {
         "applies": true,
         "answer": true,
         "justification": "Standard deviation is reported across three independent review runs for all main results. Tables 2, 3, and 4 consistently show mean ± std format."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "All attack conditions are compared against 'Original Paper (No Attack)' baseline in Table 2. Human reviewer scores are also included as a reference baseline."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The baseline is the natural no-attack condition, which is the appropriate comparison for an attack study. They also compare against human review scores (avg 5.12). Prior attack work (Ye et al. 2024, Lin 2025, Collu et al. 2025) is discussed, though not directly compared experimentally."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Multiple ablation-like analyses are conducted: 4 static attack variants (Table 2), 2 iterative attack seeds (Table 4), impact of injection position (Table 3), impact of iteration count (Table 4), and cross-model transferability (Table 5)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Multiple metrics are used: overall rating (1-10), sub-dimensions (Soundness, Presentation, Contribution on 1-4 scale), Pearson correlation with human scores (Figure 5), attack detection rate, and full prompt recovery rate (Tables 6-7)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "Human review scores from ICLR 2025 are included as a reference (Table 2, avg 5.12). Figure 5 compares AI and human ratings with Pearson correlations (r=0.501-0.643)."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "For the main iterative attack, the attack is optimized and evaluated on the same model-paper pair with no held-out split. The transferability experiment (Table 5) tests on different models, but the 100 papers are not split into optimization and evaluation sets."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by model (3 models in all tables), attack type (4 static + 2 iterative in Table 2), injection position (Table 3), human rating bins (Figure 3), and paper length bins (Figure 4)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Appendix B.1.2 shows a failure case where GPT-5 recognizes and ignores the injection ('I need to act as a reviewer... seems untrustworthy. I'll ignore that'). Defense failure cases are discussed in Section 4.4 and Appendix B.3.3-B.3.4."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "GPT-5's resistance to attacks is reported (Prompt 1 yields only +0.05 on GPT-5, Table 2). The defense's overcorrection issue (17 cases scoring >1.5 below baseline) is reported in Table 6. The defense fails against adaptive attacks (Table 7)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims are supported: 'striking performance' is backed by Table 2 (scores approaching 10); 'robust across various settings' by Tables 3 and Figures 3-4; defense 'substantially reduces attack success rate' by Table 6 (10.00→7.27); 'adaptive attacker can partially circumvent' by Table 7 (score rises to 8.11)."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper claims injected prompts cause score inflation. The controlled experimental design (same 100 papers evaluated with and without injection, everything else held constant) supports causal inference. The manipulation is directly controlled by the experimenters."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The abstract and conclusion make broad claims ('current AI review systems are vulnerable', 'fundamental vulnerabilities in AI-assisted reviewing pipelines') based on 3 models and 100 papers. While the title hedges ('An Early Investigation'), the body language generalizes beyond the tested scope. The Limitations section only acknowledges sample size, not the bounded scope of the claims."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations are discussed. The baseline AI scores are substantially higher than human scores (7.03-7.06 vs. 5.12 for two models), suggesting these models are inherently generous reviewers. This confound — that generous models may be more susceptible — is not explored. No robustness checks against alternative explanations are provided."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures AI review scores and claims about AI review scores. There is no proxy gap — the measurement (overall rating on 1-10 scale) matches what is claimed (vulnerability of AI review scoring to manipulation)."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are identified as 'GPT-5', 'DeepSeek-Chat (DeepSeek-V3)', and 'Gemini-2.5-Pro' — marketing names without API versions or snapshot dates. No specific model version identifiers (e.g., dates, API version strings) are provided."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full attack prompts are provided in Table 1. The iterative attack optimization instruction, defense instruction, and adaptive attack instruction are all provided in Appendix A. The review criteria prompt is in Figure 6."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 states 'we fix the decoding temperature at 0.9 across all models.' Temperature is the key sampling parameter. Other parameters (top-p, max_tokens) are not mentioned."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The approach calls model APIs directly with paper text and review instructions."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes: papers sampled from OpenReview, PDFs processed using 'OpenRouter's pdf-text engine to parse PDF papers before providing the extracted text to each reviewer model.' Attack prompts injected via 'automated Python tool' in 'white and at microscopic font sizes.'"
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' section is present after the Conclusion, discussing the cost constraint and limited scope of 100 papers and three AI reviewers."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section identifies a specific constraint for this study: 'Due to the substantial cost associated with generating AI-based reviews for scientific papers—where a single paper can consume tens of thousands of tokens—we limit our evaluation to 100 papers and three AI reviewers.' This is specific to the study's cost-sample tradeoff."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "While the Limitations section mentions the constraint on paper count and model count, it does not explicitly state what the results do NOT show or what claims the authors are NOT making. There are no statements bounding generalization to other review settings, languages, or model types."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data is released. The specific paper IDs sampled, individual per-paper scores, injected PDF files, and full review outputs are not available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes: 'We randomly sampled 100 papers (in PDF format) together with their full peer reviews from the pool of 20,000+ submissions on OpenReview for ICLR 2025.' Figure 2 shows the distribution of the sample."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The data source is ICLR 2025 submissions on OpenReview, a standard public platform."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: random sampling from OpenReview → PDF text extraction via OpenRouter's pdf-text engine → prompt injection into PDFs → evaluation by each model 3 times → score aggregation. Section 4.1 covers this flow."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source is disclosed. No acknowledgments section mentioning grants or sponsors is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Institute of Information Engineering (CAS), University of Chinese Academy of Sciences, and Tsinghua University. These are academic institutions, not affiliated with the AI companies whose models are tested."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be verified. The absence of a funding statement means this criterion cannot be confirmed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interest declaration is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This is a red-teaming study testing prompt injection attacks against AI reviewers, not evaluating model knowledge on a benchmark. Contamination is not the relevant concern."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Red-teaming study testing attack vulnerability, not model capability on benchmark tasks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Red-teaming study testing attack vulnerability, not model capability on benchmark tasks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All evaluation is automated using AI models."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The Limitations section mentions 'substantial cost' and 'a single paper can consume tens of thousands of tokens' but provides no specific cost figures, API spend, or cost-per-paper estimates."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. The number of API calls can be inferred (100 papers × 3 models × 3 runs × multiple conditions) but total cost or compute time is not reported."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": true,
         "justification": "Each paper is independently evaluated 3 times per condition, and variance across runs is reported as standard deviation. For API-based models with temperature=0.9, this captures stochastic variation. Tables 2-4 all show mean ± std."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 states 'each paper is independently evaluated three times by the reviewer model.' For iterative attacks, 'each paper undergoes three independent trials' (Table 2 caption)."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. Temperature is fixed at 0.9 without justification for this choice. No search over other parameters is described."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "For the transferability experiment (Table 5), selection is clearly justified: 'the attack prompt is the highest-scoring one selected from Iterative Attack (Prompt 3-based), based on three independent trials, each with three refinement iterations (9 candidates in total).' All attack variants are reported in Table 2, not just the best."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "Only one formal statistical test is conducted (t-test in Table 6). Multiple comparison correction is not applicable for a single test."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors propose and evaluate their own attack methods without acknowledging potential self-evaluation bias. No independent evaluation or discussion of this bias is present."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "While Table 4 implicitly shows that more iterations yield higher scores, the compute cost per iteration is not quantified. No explicit performance-vs-compute analysis is provided."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses AI review scores as the measure of attack success without questioning whether overall score is the right metric. No discussion of whether score inflation translates to actual acceptance decisions or whether the review criteria faithfully capture review quality."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. Models are called directly via API."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The models (GPT-5, DeepSeek-V3, Gemini-2.5-Pro) may have been trained on ICLR papers or OpenReview content, which could affect baseline review scores. This temporal relationship is not discussed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether models may have seen the specific ICLR 2025 papers or their reviews during training, which would constitute feature leakage affecting baseline scores."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the 100 sampled papers share structural similarities (same subfields, overlapping authors) that could affect results."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is applied. No analysis of whether models have prior familiarity with the test papers."
       }
     }
   },
   "claims": [
     {
       "claim": "Static attacks increase average AI reviewer ratings by 1.24-2.80 points across three frontier models.",
       "evidence": "Table 2: Prompt 3 yields +1.91 (Gemini), +2.80 (DeepSeek), and +0.20 (GPT-5). Prompt 4 yields +1.24 (GPT-5). Results averaged over 100 papers × 3 runs.",
       "supported": "strong"
     },
     {
       "claim": "Iterative attacks can push scores to near-maximum (10) for Gemini and DeepSeek within three optimization rounds.",
       "evidence": "Table 2: Iterative attack (Prompt 3-based) achieves 9.84±0.03 for Gemini and 10.00±0.00 for DeepSeek. Table 4 shows progression across iterations.",
       "supported": "strong"
     },
     {
       "claim": "GPT-5 is the most robust reviewer model to both static and iterative attacks.",
       "evidence": "Table 2: GPT-5 maximum iterative score is 6.99±0.05 vs. 9.84/10.00 for Gemini/DeepSeek. Table 5: GPT-5 has smallest cross-model vulnerability (+0.15 to +1.04).",
       "supported": "strong"
     },
     {
       "claim": "Attacks are robust across injection positions, human ratings, and paper lengths.",
       "evidence": "Table 3: All three positions yield similar scores (8.90-8.97). Figures 3-4: Attack effectiveness is consistent across binned human ratings and paper lengths.",
       "supported": "strong"
     },
     {
       "claim": "Attack prompts optimized on GPT-5 show the strongest cross-model transferability.",
       "evidence": "Table 5: GPT-5 prompts yield +2.19 on Gemini and +2.72 on DeepSeek, the highest cross-model gains. However, this is from a single experiment with no variance reported for transfer results.",
       "supported": "moderate"
     },
     {
       "claim": "Detection-based defense identifies 99% of naive attacks and reduces average score from 10.00 to 7.27.",
       "evidence": "Table 6: 99/100 detection rate, full prompt recovery in 91/100 cases. Average score drops from 10.00 to 7.27 (p=0.26 vs. no-attack baseline of 7.06).",
       "supported": "strong"
     },
     {
       "claim": "Adaptive attacks circumvent the detection defense, with only 24% of attacks detected.",
       "evidence": "Table 7: Detection rate drops to 24/100. Average score rises to 8.11 under adaptive attack. 25 undetected cases score >1.5 above baseline.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No significance tests for main claims",
       "detail": "The core attack effectiveness claims (Table 2) rely on comparing means without any statistical significance tests. The word 'significantly' is used in the paper to describe results ('significantly increase paper scores') without statistical backing. Only one t-test is reported (Table 6, for the defense experiment)."
     },
     {
       "flag": "Baseline AI generosity not addressed as confound",
       "detail": "DeepSeek (7.06) and Gemini (7.03) rate papers substantially higher than human reviewers (5.12) even without attacks. This inherent generosity may correlate with susceptibility to prompt injection, but this confound is not discussed."
     },
     {
       "flag": "No code or data released",
       "detail": "Despite being a security study where reproducibility is important for the community, no code, specific paper IDs, or raw results are released."
     },
     {
       "flag": "Transfer experiment lacks variance",
       "detail": "Table 5 (cross-model transferability) reports results from a single evaluation per paper with no variance or significance tests, despite being a key claim."
     }
   ],
   "cited_papers": [
     {
       "title": "Jailbreaking black box large language models in twenty queries",
       "authors": ["Patrick Chao", "Alexander Robey", "Edgar Dobriban", "Hamed Hassani", "George J. Pappas", "Eric Wong"],
       "year": 2025,
       "relevance": "Jailbreaking techniques that bypass LLM safety constraints, directly related to adversarial attacks on LLM-based systems."
     },
     {
       "title": "Universal adversarial triggers for attacking and analyzing NLP",
       "authors": ["Eric Wallace", "Shi Feng", "Nikhil Kandpal", "Matt Gardner", "Sameer Singh"],
       "year": 2019,
       "relevance": "Foundational work on universal adversarial triggers that induce harmful model responses across diverse inputs."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Demonstrates universal and transferable attacks on aligned LLMs, directly relevant to attack transferability findings in this paper."
     },
     {
       "title": "Prompt injection attack against LLM-integrated applications",
       "authors": ["Yi Liu", "Gelei Deng", "Yuekang Li"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Core work on prompt injection attacks against LLM applications, the attack paradigm this paper applies to peer review."
     },
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Systematic benchmarking of prompt injection attack and defense methods across LLM applications."
     },
     {
       "title": "Are we there yet? revealing the risks of utilizing large language models in scholarly peer review",
       "authors": ["Rui Ye", "Xianghe Pang", "Jingyi Chai"],
       "year": 2024,
       "arxiv_id": "2412.01708",
       "relevance": "Directly related work showing explicit manipulations can influence AI reviewers to produce positive reviews."
     },
     {
       "title": "Hidden prompts in manuscripts exploit AI-assisted peer review",
       "authors": ["Zhicheng Lin"],
       "year": 2025,
       "arxiv_id": "2507.06185",
       "relevance": "Systematically examined arXiv preprints for hidden prompts, identifying four categories in 18 papers. Direct precursor to this work."
     },
     {
       "title": "Publish to perish: Prompt injection attacks on LLM-assisted peer review",
       "authors": ["Matteo Gioele Collu", "Umberto Salviati", "Roberto Confalonieri", "Mauro Conti", "Giovanni Apruzzese"],
       "year": 2025,
       "arxiv_id": "2508.20863",
       "relevance": "Concurrent work investigating hidden adversarial prompt injections in LLM-assisted peer review using 26 rejected ICLR papers."
     },
     {
       "title": "AgentReview: Exploring peer review dynamics with LLM agents",
       "authors": ["Yiqiao Jin", "Qinlin Zhao", "Yiyang Wang"],
       "year": 2024,
       "arxiv_id": "2406.12708",
       "relevance": "Explores using LLM agents for peer review, the target application under attack in this paper."
     },
     {
       "title": "Can large language models provide useful feedback on research papers? A large-scale empirical analysis",
       "authors": ["Weixin Liang", "Yuhui Zhang", "Hancheng Cao"],
       "year": 2024,
       "relevance": "Large-scale evaluation of LLM review feedback quality, relevant to understanding the baseline capability of AI reviewers being attacked."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["Xiaogeng Liu", "Zhiyuan Yu", "Yizhe Zhang", "Ning Zhang", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Automatic prompt injection attack generation for LLMs, directly related to the iterative attack paradigm in this paper."
     },
     {
       "title": "Judging the judges: Evaluating alignment and vulnerabilities in LLMs-as-judges",
       "authors": ["Aman Singh Thakur", "Kartik Choudhary", "Venkat Srinik Ramayapally"],
       "year": 2024,
       "relevance": "Evaluates vulnerabilities in LLM-based evaluation systems, relevant to the broader concern of AI reviewer manipulation."
     }
   ]
 }