ai-research-survey

scan.json (31699B)

---

 {
   "paper": {
     "title": "Goal-Guided Generative Prompt Injection Attack on Large Language Models",
     "authors": [
       "Chong Zhang",
       "Mingyu Jin",
       "Qinkai Yu",
       "Chengzhi Liu",
       "Haochen Xue",
       "Xiaobo Jin"
     ],
     "year": 2024,
     "venue": "Industrial Conference on Data Mining",
     "arxiv_id": "2404.07234",
     "doi": "10.1109/ICDM59182.2024.00119"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval", "theoretical"],
   "key_findings": "The paper proposes G2PIA, a query-free black-box prompt injection attack that maximizes KL-divergence between clean and adversarial text posterior distributions, proving this is equivalent to maximizing Mahalanobis distance under Gaussian assumptions. Experiments on 7 LLMs (GPT-3.5/4, Llama-2 variants) and 4 QA datasets show ASR up to 81.46% (SQuAD2.0 with GPT-3.5-Turbo), outperforming BertAttack, TextFooler, and other baselines. Parameter sensitivity analysis finds optimal attack at ε=0.2, γ=0.5, and transferability analysis shows GPT-4-Turbo-generated attacks transfer most effectively.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, GitHub link, or code archive is provided anywhere in the paper. The paper describes the method algorithmically but does not release an implementation."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available datasets: GSM8K, SQuAD2.0, MATH, and Web-based QA, all of which are standard public benchmarks. However, the generated adversarial examples are not released."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or environment specification is provided. The paper mentions using BERT for embeddings and word2vec for semantic distance but does not specify library versions or environment details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The method is described at an algorithmic level (Sections III-D through III-F) but there are no scripts, commands, or reproducibility guide."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Tables I, II, and III report only point estimates for Aclean, Aattack, and ASR. No confidence intervals, error bars, or ± notation appears anywhere in the results."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims their method 'achieves the best results on both data sets' (Section IV-C) and outperforms baselines, but provides no statistical significance tests (no p-values, t-tests, or similar). Comparisons are based solely on raw ASR numbers."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports Clean Accuracy, Attack Accuracy, and ASR in context for each method, allowing direct comparison. For example, 'our algorithm with ASR 44.87% compared to BertAttack's 33.46%' (Section IV-C), providing baseline context for the magnitude of improvement."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "Section IV-A states 'We randomly selected 300 examples from the following dataset' but provides no justification for why 300 was chosen. No power analysis or discussion of whether 300 is sufficient."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance, or spread measures are reported. It is unclear whether experiments were run multiple times or only once. All results are single point estimates."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table II compares G2PIA against 6 baseline methods: BertAttack, DeepWordBug, TextFooler, TextBugger, Stress Test, and CheckList on two datasets."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include PromptBench (2023), BertAttack (2020), CheckList (2020), and TextFooler (2020). PromptBench is contemporary, and the others represent the established state of the art for black-box text attacks."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table III presents ablation studies on GSM8K and Web-based QA with GPT-3.5-Turbo, comparing random position prompt injection (ASR 29.18%), random component replacement (ASR 18.33%), and the full method (ASR 47.60%)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three evaluation metrics are used: Clean Accuracy, Attack Accuracy, and Attack Success Rate (ASR). The relationship between them is formally defined in Section IV-A3."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is conducted. The paper claims attacks are 'imperceptible' (Section III-A) but this claim is never validated by human judges assessing whether the injected text is detectable."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The paper randomly selects 300 examples per dataset for testing. Parameters ε=0.2, γ=0.5 are selected based on Table V using GSM8K with GPT-3.5, then applied to all datasets/models. There is no explicit separation of a validation set for parameter tuning versus a held-out test set for final reporting."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table I provides per-dataset breakdowns (GSM8K, Web-based QA, SQuAD2.0, Math) and per-model breakdowns (7 LLMs). Table V provides per-parameter breakdowns."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper notes that 'mathematical problems are the most difficult to attack' (Section IV-B) but does not analyze specific failure examples or discuss why particular attacks fail. No error analysis or qualitative failure examples beyond this observation."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The ablation study (Table III) shows that random position injection and random component replacement perform substantially worse than the full method. Parameter sensitivity analysis (Figs. 5-6, Table V) shows configurations with poor performance."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims: (1) theoretical equivalence of KL-divergence and Mahalanobis distance (proved in Theorem 1/Appendix B), (2) effectiveness on seven LLM models and four datasets (Table I), (3) query-free black-box attack (the method design confirms this). All claims are supported by results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims through ablation studies (Table III): removing the guided component selection and replacing with random selection degrades ASR. This controlled manipulation adequately supports the causal claim that the guided approach improves attack success."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims attacks 'on Large Language Models' generally, but experiments cover only 7 specific models from two families (GPT and Llama-2) on Q&A tasks only. No discussion of whether results generalize to other model families (Claude, Gemini, Mistral), other task types (summarization, translation, coding), or non-English languages."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations are discussed for the attack's effectiveness. For instance, the paper doesn't consider whether the success is due to the Gaussian assumption being approximately correct, or whether simpler mechanisms (e.g., distraction from irrelevant text) explain the same results."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures ASR (whether the model gives incorrect answers after injection) and claims attack effectiveness. The measurement directly matches the claim — no proxy gap exists. The formal definition of ASR in Section IV-A3 is precise."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model versions are provided: 'text-davinci-003', 'gpt-3.5-turbo-0125', 'gpt-4-0613', 'gpt-4-0125-preview', 'llama-2-7b-chat', 'llama-2-13b-chat', 'llama-2-70b-chat' (Table I, Section IV-A)."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The paper describes the attack pipeline conceptually (Fig. 3) and shows examples of injected sentences (Table IV), but does not provide the actual prompt template sent to GPT-4-Turbo for generating adversarial sentences. The reader cannot reconstruct the exact prompts used."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "The method hyperparameters are stated (ε=0.2, δ=0.05, γ=0.5, random number range 10-100), but LLM API settings (temperature, top-p, max tokens) for the auxiliary GPT-4-Turbo model and for the victim models are not reported. These settings significantly affect output."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The attack pipeline is a fixed sequence of POS extraction, synonym lookup, sentence generation, and constraint checking — not an agentic workflow."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper states '300 examples were randomly selected' per dataset but does not describe how random selection was performed, whether any filtering was applied, or how questions were formatted for input to the models."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations, threats-to-validity, or discussion section. The paper goes directly from ablation studies (Section V) to conclusion (Section VI) without discussing limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed anywhere in the paper. The Gaussian distribution assumption underlying the entire theoretical framework is acknowledged as unverifiable ('We cannot confirm whether these assumptions hold', Appendix A) but no specific threats to the experimental validity are identified."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper does not identify what the results do NOT show — e.g., that results are limited to Q&A tasks, English text, specific model families, or the particular injection strategy tested."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The generated adversarial examples, model outputs, and raw experimental data are not made available. Only aggregated metrics (Aclean, Aattack, ASR) are reported in tables."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section IV-A2 describes the four datasets used (GSM8K, Web-based QA, MATH, SQuAD2.0) with citations and brief descriptions. Section IV-A states 300 examples were randomly selected from each."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are standard public benchmarks (GSM8K, SQuAD2.0, MATH, Web-based QA)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The attack generation pipeline is described (POS extraction → synonym selection → sentence generation → constraint checking), but the end-to-end data pipeline from raw dataset selection through to metric computation is not documented with filtering counts or intermediate step details."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Funding is disclosed in the footnote: 'This work was partially supported by Research Development Fund with No. RDF-22-01-020, the Qing Lan Project in Jiangsu universities and National Natural Science Foundation of China under Grant U1804159.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Xi'an Jiaotong-Liverpool University and University of Liverpool. These are academic institutions not affiliated with any evaluated product."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Funding comes from academic sources (university research fund, Qing Lan Project, NSFC). None of the funders have a financial interest in the outcome of LLM attack research."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is included in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates are stated for any of the 7 models tested. The paper uses GSM8K, SQuAD2.0, MATH, and Web-based QA — all public benchmarks that could be in the training data — without stating when model training data was collected."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the benchmark examples appeared in model training data. GSM8K, SQuAD2.0, and MATH are widely known benchmarks that GPT-4 and Llama-2 may have been trained on."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "All four benchmarks (GSM8K 2021, SQuAD2.0 2018, MATH 2021, Web-based QA 2022) were published before the models' training periods. No contamination analysis or decontamination is mentioned."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims 'low computational cost' and the method is described as 'query-free', but no actual cost figures are provided — no API costs, tokens consumed, wall-clock time, or cost per attack example."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No computational budget is stated. The experiments involve calling GPT-4-Turbo to generate adversarial text and testing 7 models × 4 datasets × 300 examples, but total API spend, GPU hours, or hardware are not reported."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds or sensitivity analysis across seeds. The method involves random synonym selection and random number generation (Nt' between 10-100) but results for different seeds are not reported."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is not stated. It is unclear whether each configuration was tested once or multiple times. Section III-F mentions iterating N times to generate adversarial text but N is not specified."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Table V shows a parameter grid for (ε, γ) but does not report the total compute budget for this search. Nine values are tested for each parameter but total search cost is unstated."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Table V shows ASR for all (ε, γ) combinations tested on GSM8K with GPT-3.5, and the best configuration (ε=0.2, γ=0.5) is selected based on highest ASR. The full grid is transparent."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "No statistical tests are performed at all, let alone corrections for multiple comparisons. The paper compares 7 methods across 4 datasets without any statistical testing."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors compare their system against baselines reported from PromptBench (Table II) and their own ablations, but do not acknowledge self-comparison bias or discuss whether their implementation of baselines might differ from original results."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No performance-vs-compute analysis is provided. The paper claims to be 'query-free' with 'low computational cost' but does not compare compute requirements against query-dependent baselines like BertAttack or TextFooler."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether ASR on Q&A benchmarks actually measures what is claimed about prompt injection attack effectiveness in real-world settings. The paper does not question whether benchmark performance translates to practical attack capability."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The attack uses GPT-4-Turbo as an auxiliary model for generating adversarial text. The paper does not discuss how the choice of auxiliary model affects results or whether using a different auxiliary model would change attack effectiveness."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. All benchmarks (SQuAD2.0 from 2018, MATH from 2021, GSM8K from 2021) predate the models tested, meaning clean accuracy baselines could be inflated by training contamination."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. The evaluation setup where the full question is provided to the model is standard, but no analysis of whether model familiarity with benchmark format constitutes feature leakage."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. No analysis of whether the 300 randomly selected examples per dataset are independent or share structural similarities that could bias results."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are used. No canary strings, membership inference, or decontamination pipelines."
       }
     }
   },
   "claims": [
     {
       "claim": "G2PIA achieves higher attack success rates than existing black-box attack methods on both SQuAD2.0 and Math datasets",
       "evidence": "Table II shows G2PIA achieves 79.50% ASR on SQuAD2.0 (vs BertAttack 65.33%, TextFooler 78.59%) and 44.87% ASR on Math (vs BertAttack 33.46%). Tested against 6 baseline methods on ChatGPT-3.5.",
       "supported": "moderate"
     },
     {
       "claim": "Maximizing KL-divergence between conditional distributions of clean and adversarial text is equivalent to maximizing Mahalanobis distance under Gaussian assumptions",
       "evidence": "Theorem 1 with full proof in Appendix B. The derivation shows KL(N1||N2) = 1/2 (z-x)^T Σ^{-1} (z-x) under the Gaussian assumption.",
       "supported": "strong"
     },
     {
       "claim": "The attack method is query-free with low computational cost",
       "evidence": "The method design uses an auxiliary model to generate adversarial text offline (Section III-D-F) without querying the victim model. However, no actual computational cost figures are reported.",
       "supported": "weak"
     },
     {
       "claim": "ChatGPT-4-Turbo attack model has the strongest transferability while Llama-2-7b has the weakest defensive ability",
       "evidence": "Figure 4 shows a transfer success rate heatmap across model pairs (Section V-A). Single heatmap without statistical tests or multiple runs.",
       "supported": "moderate"
     },
     {
       "claim": "Optimal attack parameters are ε=0.2 and γ=0.5",
       "evidence": "Table V shows ASR values for 18 (ε, γ) combinations on GSM8K with ChatGPT-3.5. The (0.2, 0.5) pair yields 46.35% ASR. Authors state 'This combination of parameters works very well when we apply it to other datasets' but do not show the full grid for other datasets.",
       "supported": "moderate"
     },
     {
       "claim": "Insertion position of injected text has minimal impact on attack performance",
       "evidence": "Table IV shows one example question with injection at 6 different positions, all producing wrong answers. However, this is a single example, not a systematic evaluation across the test set.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or variance reporting",
       "detail": "All experimental results across Tables I, II, III, and V are single-point estimates. With no variance information, it is impossible to assess whether observed differences between methods are meaningful or within noise. The attack involves random elements (synonym selection, random number generation) that would produce different results across runs."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper has no limitations, threats-to-validity, or broader impact discussion. It moves directly from ablation studies to a brief conclusion without acknowledging any weaknesses."
     },
     {
       "flag": "Imperceptibility claimed but not tested",
       "detail": "Section III-A claims the attack is 'imperceptible' and that 'the model's active defense mechanisms make it difficult to detect the presence of our prompt injections.' This is never validated — no human evaluation of whether injected text is detectable, and no automated detection tests."
     },
     {
       "flag": "Factual error in dataset description",
       "detail": "Section IV-A2 describes GSM8K as 'consisting of 800 billion words' and 'the largest language model training resource available today.' GSM8K is actually a grade school math dataset with ~8.5K problems. The citation [27] is attributed to 'Brown et al.' which does not match the actual GSM8K paper by Cobbe et al. (2021). This suggests carelessness in the writing."
     },
     {
       "flag": "Parameter tuning on test data",
       "detail": "Parameters ε=0.2, γ=0.5 are selected by exhaustive grid search on GSM8K test data with GPT-3.5 (Table V), then the same parameters are applied to report 'main results' that include GSM8K. No held-out validation set is used, risking overfitting to the evaluation data."
     },
     {
       "flag": "Insertion position claim based on single example",
       "detail": "Table IV claims insertion position has 'minimal impact on attack performance' but shows only one question with different insertion positions. A single example cannot support this general claim."
     }
   ],
   "cited_papers": [
     {
       "title": "Survey of vulnerabilities in large language models revealed by adversarial attacks",
       "authors": ["E. Shayegani", "M. A. A. Mamun", "Y. Fu", "P. Zaree", "Y. Dong", "N. Abu-Ghazaleh"],
       "year": 2023,
       "arxiv_id": "2310.10844",
       "relevance": "Comprehensive survey of LLM adversarial vulnerabilities, directly relevant to understanding the attack landscape."
     },
     {
       "title": "Ignore previous prompt: Attack techniques for language models",
       "authors": ["F. Perez", "I. Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Foundational work on prompt injection attacks defining target hijacking and prompt leakage goals."
     },
     {
       "title": "Prompt injection attack against LLM-integrated applications",
       "authors": ["Y. Liu", "G. Deng", "Y. Li", "K. Wang", "T. Zhang", "Y. Liu", "H. Wang", "Y. Zheng", "Y. Liu"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Studies LLM sensitivity to escape characters and delimiters as implicit prompt injection vectors."
     },
     {
       "title": "Gradient-based adversarial attacks against text transformers",
       "authors": ["C. Guo", "A. Sablayrolles", "H. Jégou", "D. Kiela"],
       "year": 2021,
       "arxiv_id": "2104.13733",
       "relevance": "Proposes GBDA white-box attack using Gumbel-Softmax, a key baseline for adversarial text attacks on transformers."
     },
     {
       "title": "BERT-ATTACK: adversarial attack against BERT using BERT",
       "authors": ["L. Li", "R. Ma", "Q. Guo", "X. Xue", "X. Qiu"],
       "year": 2020,
       "relevance": "Context-aware word replacement attack using masked language models, one of the baselines compared in this paper."
     },
     {
       "title": "PromptBench: towards evaluating the robustness of large language models on adversarial prompts",
       "authors": ["K. Zhu", "J. Wang", "J. Zhou", "Z. Wang", "H. Chen", "Y. Wang", "L. Yang", "W. Ye", "N. Z. Gong", "Y. Zhang"],
       "year": 2023,
       "arxiv_id": "2306.04528",
       "relevance": "Benchmark framework for evaluating LLM robustness to adversarial prompts; provides baseline attack methods compared against in this paper."
     },
     {
       "title": "Universal adversarial triggers for attacking and analyzing NLP",
       "authors": ["E. Wallace", "S. Feng", "N. Kandpal", "M. Gardner", "S. Singh"],
       "year": 2021,
       "arxiv_id": "1908.07125",
       "relevance": "Proposes gradient-guided universal adversarial triggers for NLP models, foundational work on trigger-based attacks."
     },
     {
       "title": "TextAttack: a framework for adversarial attacks, data augmentation, and adversarial training in NLP",
       "authors": ["J. X. Morris", "E. Lifland", "J. Y. Yoo", "J. Grigsby", "D. Jin", "Y. Qi"],
       "year": 2020,
       "arxiv_id": "2005.05909",
       "relevance": "Unified framework for adversarial attacks and defenses in NLP, relevant to attack tooling and methodology."
     },
     {
       "title": "MathAttack: attacking large language models towards math solving ability",
       "authors": ["Z. Zhou", "Q. Wang", "M. Jin", "J. Yao", "J. Ye", "W. Liu", "W. Wang", "X. Huang", "K. Huang"],
       "year": 2023,
       "arxiv_id": "2309.01686",
       "relevance": "Domain-specific attack on LLM mathematical reasoning; directly compared with G2PIA on GSM8K."
     },
     {
       "title": "Is BERT really robust? A strong baseline for natural language attack on text classification and entailment",
       "authors": ["D. Jin", "Z. Jin", "J. T. Zhou", "P. Szolovits"],
       "year": 2020,
       "relevance": "Proposes TextFooler attack method, one of the key baselines compared in this paper."
     },
     {
       "title": "GPT-4 technical report",
       "authors": ["OpenAI"],
       "year": 2023,
       "relevance": "Technical report for GPT-4, one of the victim models evaluated in the attack experiments."
     },
     {
       "title": "Llama: Open and efficient foundation language models",
       "authors": ["H. Touvron", "T. Lavril", "G. Izacard"],
       "year": 2023,
       "arxiv_id": "2302.13971",
       "relevance": "Describes the Llama model family; Llama-2 variants are used as victim models in the experiments."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "The attack method requires BERT, word2vec, and an auxiliary LLM to generate adversarial text — not immediately usable without significant implementation effort, and no code is released."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The theoretical connection between KL-divergence and Mahalanobis distance is novel, but the overall finding that LLMs are vulnerable to prompt injection is well-established."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates a query-free generative prompt injection attack with up to 81% ASR on production models (GPT-4), raising concerns about LLM robustness in deployed systems."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no accusations, no challenge to specific companies or claims."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or tool is released; the method cannot be tried without reimplementation."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Attacks GPT-3.5/4 and Llama-2 (well-known models) but authors are from a lesser-known university without major industry affiliation."
     }
   }
 }