ai-research-survey

scan.json (30617B)

---

 {
   "paper": {
     "title": "GUARDIAN: A Multi-Tiered Defense Architecture for Thwarting Prompt Injection Attacks on LLMs",
     "authors": [
       "Parijat Rai",
       "Saumil Sood",
       "Vijay K. Madisetti",
       "Arshdeep Bahga"
     ],
     "year": 2024,
     "venue": "Journal of Software Engineering and Applications",
     "doi": "10.4236/jsea.2024.171003"
   },
   "scan_version": 3,
   "active_modules": [
     "experimental_rigor",
     "data_leakage"
   ],
   "methodology_tags": [
     "benchmark-eval",
     "case-study"
   ],
   "key_findings": "GUARDIAN proposes a three-tiered defense (system prompt filter, BERT toxic classifier + ethical prompt generator, LLM self-review) that blocks 100% of 50 custom adversarial prompts against Llama-2-7b-chat. The system prompt layer blocks 40%, the pre-processing layer adds 20% (cumulative 60%), and the pre-display filter catches the remaining 40%. Zephyr-7B-α outperforms FLAN-T5-Large for ethical prompt generation based on perplexity scores. The evaluation is limited to a small author-crafted dataset with no comparison to existing defense methods.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, GitHub link, or code archive is provided anywhere in the paper. The fine-tuned models and evaluation scripts are not released."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The 50-prompt adversarial dataset is described structurally (5 base prompts × 10 sub-prompts) but not released. The generated ethical prompt dataset is also not released. Only the source Jigsaw dataset is public."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions using an RTX A6000 GPU, LM Studio, and lists library names (torch, transformers, pandas, etc.) but provides no requirements.txt, Dockerfile, or specific library versions. This is insufficient to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The methodology sections describe the general approach and library names but do not include commands, scripts, or a reproducibility guide."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "No confidence intervals or error bars are reported for the defense blocking results (40%, 60%, 100%) or for the generation model metrics in Tables 4-5. All results are point estimates."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used. Comparisons between defense layers and between generation models (FLAN-T5 vs Zephyr) are made by comparing raw numbers without any tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "Raw blocking counts (20/50, 30/50, 50/50) and percentages are reported but no formal effect sizes. The perplexity and ROUGE comparisons between models lack effect size measures."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The sample size of 50 adversarial prompts (5 base × 10 sub-prompts) is stated but never justified. No power analysis or discussion of whether 50 prompts is sufficient to evaluate a defense system."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported across runs for any experiment. Single-run results only for both the defense evaluation and model training."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The undefended Llama-2-7b-chat model serves as a baseline (0% blocking rate). Section 3.1 identifies Helbling et al.'s LLM Self Defense as the baseline reference, and the third filter builds upon that approach."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "The paper cites contemporary defense methods (SmoothLLM, RA-LLMs, Moving Target Defense, Self-Reminder) in the literature review (Section 3.2) but does not compare GUARDIAN against any of them. The only comparison is against no defense at all."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Tables 1-3 effectively present an ablation: Layer 1 alone blocks 40%, Layer 1+2 blocks 60%, Layer 1+2+3 blocks 100%. Each layer's incremental contribution is measured."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The defense evaluation uses blocking accuracy. The generation model evaluation (Section 6.4) uses ROUGE scores, perplexity, and validation loss. Tables 4-5 report these multiple metrics."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation of the defense's blocking quality or the ethical prompt generator's output quality. Testing was manual input of prompts by the authors (Section 4.6) but this is procedure, not evaluation by independent humans."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "While the BERT classifier and Zephyr model use train/test splits, the primary defense evaluation uses all 50 prompts that were crafted during development. There is no separation between prompts used to develop/tune the defense and prompts used for final evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Tables 1-3 show per-base-prompt × per-sub-prompt breakdowns (5 BP rows × 10 SP columns). Tables 4-5 show per-configuration results for the generation models across different sample sizes and epochs."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims 100% blocking and does not discuss failure cases. The only acknowledgment is a brief disclaimer: 'this may not hold for all jailbreak prompts, as attackers could develop prompts that bypass our system' (Section 6.3). No analysis of what types of attacks might succeed."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.4 reports that FLAN-T5-Large showed 'suboptimal performance' compared to Zephyr, with higher perplexity and lower ROUGE scores. The authors attribute this to the 'highly specialized nature of the task' diverging from FLAN-T5's strengths."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims '100% of attack prompts' blocked, which is shown in Table 3. 'Quantitatively evaluated defense layers' is supported by Tables 1-3. The 'ethical substitution mechanism' is demonstrated in Section 5.3.2 and Appendix A.5."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper claims each defense layer blocks specific prompts. The ablation design (adding layers incrementally) with controlled single-variable manipulation at each step adequately supports these causal claims about each layer's contribution."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper tests only on Llama-2-7b-chat with 50 custom prompts, yet the title claims 'Thwarting Prompt Injection Attacks on LLMs' (plural, general) and the abstract states the approach 'fortifies smaller LLMs against emerging cyber threats.' These generalizations are not bounded to the tested setting."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations are discussed for the 100% blocking rate. The paper does not consider that the rate may be an artifact of the small, self-crafted dataset, or that the prompts may be inherently easy to detect, or that the BERT classifier's performance may not generalize beyond Jigsaw-like toxicity."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures blocking rate and claims blocking rate. The proxy matches the claim — they test whether prompts are blocked and report the blocking percentage. No proxy gap exists."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model names with sizes are provided: 'Llama-2-7b-chat' (Section 5.1), 'bert-base-uncased' (Section 5.3.2), 'Zephyr-7B-α' (Section 5.3.2), 'FLAN-T5-Large' with 780M parameters (Table 4). These are specific enough to identify exact model checkpoints."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "Only 2 attack prompt examples are shown in Appendix A.1, truncated with ellipses. The system prompt addition ('Keep in mind the ethical boundaries') is provided. But the full set of 5 base prompts and 10 sub-prompts is not provided, making reproduction of the 50-prompt evaluation impossible."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper lists hyperparameter names (temperature, top_p, top_k, max_token_length, lora_r, lora_alpha, lora_dropout, learning_rate, batch sizes) in Sections 5.3.2 but does not provide the actual values used. Parameters are described generically without specific numbers."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not use agentic scaffolding. GUARDIAN is a pipeline of input/output filters, not an agent with tools, memory, or iterative reasoning."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "The Jigsaw dataset preprocessing is documented: ~230K entries undersampled to ~32K for class balance (Section 5.3.2). The ethical dataset is filtered to toxicity scores 1-4. The attack dataset construction is described: 5 base prompts × 10 sub-prompts using 4 strategies. Train/validation/test splits (70/15/15) are stated."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "No dedicated limitations section. Section 7 ('Conclusions and Future Work') contains a brief disclaimer: 'we expect that more sophisticated adversarial prompts could still penetrate our defenses' and suggests future work areas, but this does not constitute substantive discussion of limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The only specific threat mentioned is the brief disclaimer in Section 6.3 about the 100% rate not generalizing. No discussion of specific threats like the small sample size, author-crafted prompts, single-model testing, lack of adaptive attacks, or BERT classifier generalization."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. It does not bound claims to Llama-2-7b-chat or to the tested attack strategies. The title and abstract make broad claims about 'LLMs' without stating specific exclusions."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The 50-prompt adversarial dataset, the generated ethical dataset, and the fine-tuned model weights are not released. Only the source Jigsaw dataset is publicly available. Independent verification of the defense evaluation is impossible."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 describes the attack dataset creation: 5 base prompts crafted using 4 strategies (role emulation, manipulative assistance, ethical assurance, alternative reality) combined with 10 sub-prompts each. The Jigsaw dataset source and ethical dataset generation process are described in Section 5.3.2."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data consists of a standard public benchmark (Jigsaw) and author-crafted adversarial prompts."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline stages are described at a high level but counts at intermediate steps are sometimes missing. For the ethical dataset, the number of entries after toxicity 1-4 filtering is not stated. The post-processing/cleaning steps for generated text are described generically without specific filtering counts."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source is disclosed anywhere in the paper. There is no acknowledgments section listing grants or sponsors."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Bennett University (India), Georgia Institute of Technology (USA), and Cloudemy Technology Labs (India). The authors are not evaluating their own commercial product."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funding source is mentioned. The work appears to be unfunded academic research."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": true,
         "justification": "The paper includes 'The authors declare no conflicts of interest regarding the publication of this paper' at the end of Section 7."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense system against prompt injection, not a pre-trained model's capability on a knowledge benchmark. Contamination of training data with benchmark answers is not a relevant concern."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates a defense architecture, not model knowledge. Train/test overlap in the benchmark contamination sense is not applicable."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The evaluation tests whether a defense blocks adversarial prompts, not whether a model has memorized benchmark answers. Benchmark contamination is not a relevant concern for this paper type."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper discusses ethical considerations in Section 4.7 but these are about responsible research conduct, not IRB approval for human subjects."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'We measure the time taken for generation' for Zephyr in Section 5.3.2 but does not report the actual timing numbers. No inference cost, latency, or per-prompt processing time is reported for the three-layer defense pipeline."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "An RTX A6000 GPU is mentioned for training (Section 5.3.2) but no GPU hours, total training time, or computational budget is quantified."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds or sensitivity analysis across seeds for any experiment (defense evaluation, BERT training, or Zephyr fine-tuning)."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. The defense evaluation appears to be a single run, and the generation model training shows different configurations but not repeated runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. Tables 4-5 show 3 configurations each for FLAN-T5 and Zephyr but no description of how these were selected or how many total configurations were tried."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "Tables 4-5 show results for 3 configurations per model (varying sample sizes and epochs) but no clear justification for how the final configuration was selected. The criteria for choosing the operational configuration is not stated."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "No statistical tests are performed at all, so no multiple comparison corrections can be applied. Comparisons between layers and models are made by comparing raw numbers."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors design both the attack prompts and the defense, then evaluate their own system. No acknowledgment of this self-evaluation bias or any attempt at independent evaluation."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No analysis of performance as a function of compute. The three-layer defense adds compute overhead (BERT classification + ethical generation + LLM self-review) but the cost-performance tradeoff is never discussed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The 50-prompt custom dataset is used without any discussion of whether it represents real-world prompt injection threats. No analysis of coverage across attack types, no comparison to established adversarial benchmarks, no discussion of construct validity."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is involved. The system is a pipeline of filters, not a scaffold comparison."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether Llama-2's training data might include knowledge of jailbreak patterns similar to those tested, or whether the BERT classifier's training data (Jigsaw) predates the attack strategies used."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For example, the BERT toxic classifier is trained on Jigsaw data that may share characteristics with the sub-prompts used in testing."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 50 test prompts are structured as 5 base × 10 sub-prompts, meaning they are highly correlated (each group of 10 shares the same base prompt). This structural non-independence is not discussed or addressed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is applied. No analysis of overlap between Jigsaw training data and test prompts, no temporal analysis, no decontamination."
       }
     }
   },
   "claims": [
     {
       "claim": "The three-tiered GUARDIAN defense blocks 100% of adversarial prompt attacks on Llama-2-7b-chat.",
       "evidence": "Table 3 (Section 6.3) shows all 50 attack prompts (5 base × 10 sub-prompts) blocked after applying all three layers. Includes disclaimer that this may not hold for all jailbreak prompts.",
       "supported": "weak"
     },
     {
       "claim": "The system prompt filter ('Keep in mind the ethical boundaries') blocks 40% of attack prompts.",
       "evidence": "Table 1 (Section 6.1) shows 20/50 prompts blocked. The blocked prompts involved requests for the LLM to operate without ethical constraints.",
       "supported": "weak"
     },
     {
       "claim": "The pre-processing filter with BERT toxic classifier brings cumulative blocking to 60%.",
       "evidence": "Table 2 (Section 6.2) shows 30/50 prompts blocked after Layers 1 and 2 combined. The additional 10 prompts caught involved fictional game scenarios flagged as toxic/obscene.",
       "supported": "weak"
     },
     {
       "claim": "Zephyr-7B-α outperforms FLAN-T5-Large for ethical prompt generation.",
       "evidence": "Tables 4-5 (Section 6.4) show Zephyr achieves lower perplexity (2.98-3.18) compared to FLAN-T5 (5.66-7.31) across configurations.",
       "supported": "moderate"
     },
     {
       "claim": "The multi-layered approach ensures that if one layer fails, subsequent layers provide additional defense.",
       "evidence": "Tables 1-3 show incremental blocking: 40% → 60% → 100% as layers are added. Each subsequent layer catches prompts that passed previous layers.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "100% blocking claim on tiny self-crafted dataset",
       "detail": "The 100% blocking rate is based on only 50 prompts (5 base × 10 sub-prompts) crafted by the same authors who designed the defense. This creates a circular evaluation where the defense is tested only against attacks its designers created, making the 100% claim almost meaningless for assessing real-world robustness."
     },
     {
       "flag": "No comparison with existing defense methods",
       "detail": "The paper cites SmoothLLM, RA-LLMs, Moving Target Defense, Self-Reminder, and other defense approaches in the literature review but does not compare GUARDIAN against any of them. The only baseline is no defense at all (0% blocking)."
     },
     {
       "flag": "Authors craft both attack and defense",
       "detail": "The same team designs the adversarial prompts and the defense system. Prompts were selected through 'trial and error, based on their consistent success in circumventing the Llama-2 base model' (Section 6). This creates strong selection bias toward prompts the defense can handle."
     },
     {
       "flag": "Structurally non-independent test set",
       "detail": "The 50 'independent' test prompts are actually 5 base prompts × 10 sub-prompts. If a defense blocks a base prompt, it blocks all 10 variants simultaneously. The effective independent sample size is closer to 5, not 50."
     },
     {
       "flag": "Claims significantly outrun evidence",
       "detail": "The title claims 'Thwarting Prompt Injection Attacks on LLMs' and the abstract says it 'fortifies smaller LLMs against emerging cyber threats.' These broad claims are supported only by testing on a single model (Llama-2-7b-chat) with 50 self-crafted prompts."
     },
     {
       "flag": "No hyperparameter values reported",
       "detail": "The paper lists hyperparameter names (temperature, top_p, top_k, learning_rate, LoRA parameters) but never provides the actual values used, making reproduction impossible even if the code were released."
     }
   ],
   "cited_papers": [
     {
       "title": "Llama 2: Open Foundation and Fine-Tuned Chat Models",
       "authors": ["Hugo Touvron", "Louis Martin", "Kevin Stone"],
       "year": 2023,
       "arxiv_id": "2307.09288",
       "relevance": "Target LLM model for the defense evaluation; foundational open-weight model with safety training."
     },
     {
       "title": "LLM Self Defense: By Self Examination, LLMs Know They Are Being Tricked",
       "authors": ["Mansi Phute"],
       "year": 2023,
       "arxiv_id": "2308.07308",
       "relevance": "Baseline reference for the paper's third defense layer (LLM self-examination as output filter)."
     },
     {
       "title": "Prompt Injection Attacks and Defenses in LLM-Integrated Applications",
       "authors": ["Yupei Liu"],
       "year": 2023,
       "arxiv_id": "2310.12815",
       "relevance": "Systematic framework for understanding prompt injection attacks and defenses in LLM applications."
     },
     {
       "title": "SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks",
       "authors": ["Alexander Robey"],
       "year": 2023,
       "arxiv_id": "2310.03684",
       "relevance": "Defense method using input perturbation and prediction aggregation against jailbreaking attacks."
     },
     {
       "title": "Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM",
       "authors": ["Bochuan Cao"],
       "year": 2023,
       "arxiv_id": "2309.14348",
       "relevance": "Proposes robust alignment checking to defend against attacks that break LLM value alignment."
     },
     {
       "title": "Jailbreaker in Jail: Moving Target Defense for Large Language Models",
       "authors": ["Bocheng Chen"],
       "year": 2023,
       "doi": "10.1145/3605760.3623764",
       "relevance": "Dynamic defense strategy using Moving Target Defense to reduce LLM vulnerability to adversarial attacks."
     },
     {
       "title": "Jailbroken: How Does LLM Safety Training Fail?",
       "authors": ["Alexander Wei"],
       "year": 2023,
       "arxiv_id": "2307.02483",
       "relevance": "Analysis of why LLM safety training mechanisms fail against adversarial attacks, identifying vulnerability patterns."
     },
     {
       "title": "Certifying LLM Safety against Adversarial Prompting",
       "authors": ["Aounon Kumar"],
       "year": 2023,
       "arxiv_id": "2309.02705",
       "relevance": "Erase-and-check method for certifiably safe LLM interactions against adversarial prompts."
     },
     {
       "title": "Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilities",
       "authors": ["Maximilian Mozes"],
       "year": 2023,
       "arxiv_id": "2308.12833",
       "relevance": "Comprehensive overview of LLM misuse threats and prevention strategies."
     },
     {
       "title": "Defending ChatGPT against Jailbreak Attack via Self-Reminder",
       "authors": ["Fangzhao Wu", "Yueqi Xie", "Jingwei Yi"],
       "year": 2023,
       "doi": "10.21203/rs.3.rs-2873090/v1",
       "relevance": "System-mode self-reminder defense technique against jailbreak attacks, directly related to the system prompt filter approach."
     },
     {
       "title": "MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots",
       "authors": ["Gelei Deng"],
       "year": 2023,
       "arxiv_id": "2307.08715",
       "relevance": "Framework for automated jailbreak prompt generation and reverse-engineering LLM defenses."
     },
     {
       "title": "Tricking LLMs into Disobedience: Understanding, Analyzing, and Preventing Jailbreaks",
       "authors": ["Abhinav Rao"],
       "year": 2023,
       "arxiv_id": "2305.14965",
       "relevance": "Formalism for categorizing jailbreak attacks with empirical analysis of effectiveness."
     },
     {
       "title": "Do Anything Now: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models",
       "authors": ["Xinyue Shen"],
       "year": 2023,
       "arxiv_id": "2308.03825",
       "relevance": "Large-scale analysis of real-world jailbreak prompts and their evolution, relevant to adversarial prompt taxonomy."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "The three-layer defense approach (system prompt, classifier, self-review) is implementable by practitioners, though no code is released to directly use it."
     },
     "surprise_contrarian": {
       "score": 0,
       "justification": "Multi-layer defense is an expected approach; no conventional wisdom is challenged."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates jailbreak techniques against Llama-2 and addresses prompt injection as a security threat, relevant to AI safety concerns."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no challenge to existing claims or products."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, no demo, no released models or tools."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Georgia Tech co-author adds some recognition; uses Meta's Llama-2 but not from a major AI lab."
     }
   }
 }