ai-research-survey

scan.json (32732B)

---

 {
   "paper": {
     "title": "ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction",
     "authors": [
       "Che Wang",
       "Fuyao Zhang",
       "Jiaming Zhang",
       "Ziqi Zhang",
       "Yinghui Wang",
       "Longtao Huang",
       "Jianbo Gao",
       "Zhong Chen",
       "Wei Yang Bryan Lim"
     ],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2602.20708"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "ICON achieves 0.4% average attack success rate across three LLM backbones while maintaining substantially higher task utility than existing defenses (10% average UA improvement over baselines). The framework trains in under 2 minutes on 255 samples and generalizes to out-of-distribution benchmarks with >80% detection rate. The approach also extends to multimodal LLMs, achieving 2.9% average ASR with 47.2% utility under attack.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No source code repository URL is provided anywhere in the paper. No GitHub, GitLab, or archive link is mentioned."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation uses publicly available benchmarks: InjectAgent (Zhan et al., 2024), AgentDojo (Debenedetti et al., 2024), TrojanTools (Anonymous, 2025), and Visual Prompt Injection Benchmarks (Wan et al., 2024). However, the 255 synthesized training samples generated by their LLM-as-Optimizer pipeline are not released."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications are provided — no requirements.txt, Dockerfile, conda environment, hardware details, or library versions are mentioned."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts for replicating experiments are provided."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Table 3 (OOD results) includes ± standard deviations over 5 cross-validation runs, but Table 2 (the main results table with ASR and UA across all models and attacks) reports only point estimates with no uncertainty measures."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used anywhere. Claims like 'ICON achieves an average 10% improvement in UA' are based solely on comparing point estimates without any tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports absolute differences with baseline context throughout — e.g., 'ICON provides an average 10% improvement in UA compared to other defense baselines' and 'our method maintains a UA of 53.8%, whereas the next best defense drops below 49%' (Section 5.2). Table 2 provides full baseline numbers for context."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is provided for the sample sizes. The training set of 255 samples is stated in Table 4 without explanation. The number of evaluation examples from each benchmark is not stated or justified."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Table 3 reports standard deviations over 5 cross-validation runs for OOD evaluation, but Table 2 (the main results) reports single values with no variance, standard deviation, or spread measure. The main claims rest on Table 2."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 compares ICON against five baselines: No Defense, Repeat Prompt, Delimiting, MELON, and LLM-Detector (Qwen3Guard). Table 5 adds Gemini as a baseline for multimodal experiments."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include MELON (Zhu et al., 2025), Qwen3Guard (Zhao et al., 2025), and AgentDojo's Repeat Prompt defense (Debenedetti et al., 2024). These are recent and represent state-of-the-art approaches across template, filter, and fine-tuning defense categories."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "ICON has two core modules (LSTP for detection and MR for rectification), but no formal ablation study tests each component independently. Table 3 separates ADR (detection) from URR (utility recovery), but there is no experiment showing LSTP-only or MR-only performance to isolate each module's contribution."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses ASR (Attack Success Rate), UA (Utility under Attack), ADR (Attack Detection Rate), and URR (Utility Recovery Rate) across different evaluation settings."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is performed. All evaluation is automated using ASR and UA metrics. Human evaluation could help verify that 'utility recovery' genuinely produces correct and useful agent outputs rather than just non-malicious ones."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The prober is trained exclusively on TrojanTools and tested on unseen InjectAgent and AgentDojo benchmarks (Section 5.3, Table 3), providing a clear held-out OOD evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 breaks results down by attack type (Ignore Instruction, Combined Attacks, TrojanTools) and by backbone model (QWEN, LLAMA, MISTRAL). Table 5 provides per-model breakdowns for multimodal experiments."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No failure cases are shown or discussed. The paper does not analyze where ICON fails, what types of attacks evade it, or when utility recovery is incomplete."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "Every experimental result shows ICON performing well or comparably to the best baseline. No experiments where ICON underperforms, no configurations that failed, and no approaches that were tried and abandoned are reported."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims 'a competitive 0.4% ASR' which matches Table 2 averages. However, 'over 50% task utility gain' is misleading — this appears to conflate utility recovery rate (URR from Table 3, which is a percentage of recovered utility, not a 50-point improvement in UA). Actual UA improvements in Table 2 are around 10 percentage points over the next best baseline."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper's main causal claim is that ICON improves defense (lower ASR) while preserving utility (higher UA). The experimental design — comparing multiple defenses on the same attacks, datasets, and models — is a controlled comparison adequate for this causal inference. Section 5.4 provides mechanistic evidence through attention visualization."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims a general 'Indirect Prompt Injection Defense for Agents' but all experiments use only 8B-parameter open-weight models. No experiments with larger models (70B+) or commercial APIs are shown. The paper does not discuss whether the attention-based detection mechanism would work on models with different architectures or scales."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations for the results are discussed. For example, the paper does not consider whether the attention collapse pattern might be an artifact of specific attack strategies rather than a general IPI signature, or whether the utility gains come from the softmax redistribution simply reducing confidence in all tool calls."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper directly measures what it claims: ASR measures whether attacks succeed (binary tool-call matching), and UA measures task completion under attack. These are not proxies — they are the actual outcomes of interest for evaluating a defense mechanism."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are listed as 'QWEN-3-8B', 'LLAMA-3.1-8B', and 'MISTRAL-8B' in Table 2. While Qwen3-8B and Llama-3.1-8B identify model families and sizes, no exact checkpoint identifiers or snapshot dates are provided. 'MISTRAL-8B' is particularly ambiguous — no version number is given, and the citation points only to the Mistral docs page."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "No actual prompts are provided. The paper describes using the ReAct framework and mentions an 'LLM-as-Optimizer' for attack synthesis, but the actual prompt text used for agent execution, attack generation, or defense calibration is not shown."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper introduces hyperparameters τ (steering scope) and γ (steering intensity) as core design parameters but does not report their specific values used in experiments. LLM inference parameters (temperature, top-p, max tokens) are also not reported."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The ReAct framework is described and cited (Yao et al., 2022). The agent formalization is given in Section 3 (Eq. 3) including trajectory state, tool set, and iterative reasoning-acting loop. The ICON framework itself is described in detail in Section 4 with architecture diagrams (Figure 2)."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "Section 4.3 describes the adaptive attack data synthesis at a conceptual level (contextual tool alignment, iterative stealthiness optimization) but does not provide concrete preprocessing details. The number of evaluation examples per benchmark, filtering criteria, or how benchmark tasks were prepared for the ReAct framework are not documented."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no limitations section in the paper. The paper goes directly from Section 5 (Experiments) to Section 6 (Conclusion) with an Impact Statement. The Impact Statement says 'none of which we feel must be specifically highlighted here' — actively declining to discuss limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed anywhere in the paper. There is no consideration of internal or external validity threats specific to this study."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper does not discuss what the results do NOT show — e.g., whether ICON works on larger models, closed-source APIs, or more sophisticated adaptive attacks beyond those tested."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data is available. Per-example predictions, attention maps, or individual trial outcomes are not released. Only aggregate results in tables are provided."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Evaluation datasets are established benchmarks with citations: InjectAgent (Zhan et al., 2024), AgentDojo (Debenedetti et al., 2024), TrojanTools (Anonymous, 2025), and Visual Prompt Injection Benchmarks (Wan et al., 2024). The training data synthesis process is described in Section 4.3 with two specific dimensions (contextual tool alignment, iterative stealthiness optimization)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All data comes from automated benchmark evaluation."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The full pipeline from raw benchmark data to final results is not documented. Key missing details include: how many examples from each benchmark were used, how the ReAct agent was initialized for each task, and how ASR and UA were computed from raw agent outputs."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information is disclosed. There is no acknowledgments section listing grants or sponsors."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: Peking University, Nanyang Technological University, Ant Group, and Alibaba. These are clearly stated on the first page."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, but authors from Ant Group and Alibaba — companies that deploy LLM-based agents — have a potential financial interest in demonstrating effective, lightweight defenses. This potential conflict is not acknowledged."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense mechanism against prompt injection attacks, not model knowledge on benchmarks. The evaluation measures whether the defense detects and mitigates attacks, which does not depend on whether the model has seen the benchmark tasks in training."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates a defense tool rather than a pre-trained model's capability on benchmarks. Train/test overlap of the underlying LLM is not the relevant concern."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates a defense mechanism, not model knowledge. Benchmark contamination of the underlying LLM would affect both defense and no-defense conditions equally."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "Training cost is reported (< 2 minutes, Table 4), but inference cost — the runtime overhead of ICON during agent execution — is not reported. No latency, tokens consumed, or cost-per-example figures are provided for the defense at inference time."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Table 4 states training takes 'less than 2 mins' on 255 samples with ~31k parameters, but does not specify hardware (GPU type), nor the total compute budget for running evaluations across 3 models × 3 attack types × 3+ benchmarks."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Table 3 reports standard deviations over 5 cross-validation runs for OOD evaluation, but the main results in Table 2 (which supports the core claims) do not report multi-seed results."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "Table 3 notes '5 cross validation' but Table 2 does not state how many runs produced its results. The main claims rest on Table 2."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. The paper introduces τ and γ as key hyperparameters but does not describe how their values were selected or how many configurations were tried."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No description of how the final configuration (values of τ, γ, number of selected layers K) was chosen. Only final results are shown."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper compares ICON against 5 baselines across 3 models, 3 attack types, and multiple metrics without any correction for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implemented and evaluated their own system (ICON) against baselines, likely using their own implementations of at least some baselines (template-based methods). The self-comparison bias is not acknowledged."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Table 4 compares training costs but does not analyze performance as a function of compute budget. The comparison between ICON (~31k params, 2 min training) and Qwen3Guard (8B params, 10+ hours) does not normalize performance by compute."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the benchmarks (InjectAgent, AgentDojo, TrojanTools) actually measure real-world defense effectiveness. The paper does not question whether ASR and UA metrics in these controlled settings translate to production security."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "All experiments use the same ReAct framework (Section 5.1), ensuring the scaffold is held constant across defense comparisons. The independent variable is the defense method, not the scaffold."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the LLMs were trained on data that includes the benchmark attack patterns or tasks. The TrojanTools dataset (used for training the prober) is 'under review' and may overlap with the models' training data."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information — e.g., whether the attack payloads in the test benchmarks are structurally similar to the training data synthesis patterns."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "While the OOD evaluation (train on TrojanTools, test on InjectAgent/AgentDojo) addresses distribution shift, the paper does not discuss potential structural similarities or shared attack templates between the training and test benchmarks."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is used. The OOD evaluation design partially mitigates leakage concerns but is not framed or analyzed as a leakage prevention measure."
       }
     }
   },
   "claims": [
     {
       "claim": "ICON achieves a competitive 0.4% average attack success rate, matching commercial-grade detectors.",
       "evidence": "Table 2 shows average ASR across 3 attack types and 3 LLM backbones: 0.4% for QWEN, 0.3% for LLAMA, 0.3% for MISTRAL, averaging ~0.3%. The LLM-Detector (Qwen3Guard) achieves 0.2% average. The 0.4% figure cited in the abstract appears to be an upper bound rather than an exact average.",
       "supported": "strong"
     },
     {
       "claim": "ICON yields over 50% task utility gain compared to baselines.",
       "evidence": "The abstract claims 'over 50% task utility gain.' Table 3 shows Utility Recovery Rate (URR) of 62.3-69.6% for QWEN and 47.6-55.9% for LLAMA. However, the actual UA improvements in Table 2 are ~10 percentage points over the next-best defense. The '50%' figure conflates utility recovery rate with utility improvement.",
       "supported": "weak"
     },
     {
       "claim": "ICON generalizes out-of-distribution, maintaining >97% detection on AgentDojo when trained on TrojanTools.",
       "evidence": "Table 3 shows ADR of 98.0% ± 1.2 for QWEN and 97.3% ± 1.8 for LLAMA on AgentDojo, trained exclusively on TrojanTools. InjectAgent detection is lower at 80.1-85.4%.",
       "supported": "strong"
     },
     {
       "claim": "ICON trains in less than two minutes on only 255 samples with ~31k parameters.",
       "evidence": "Table 4 states training cost is 'Less than 2 mins' on dataset size 255 with 31,553 parameters. No hardware specification is provided, making the timing claim unverifiable across different setups.",
       "supported": "moderate"
     },
     {
       "claim": "ICON extends effectively to multimodal agents, achieving 42% average utility recovery.",
       "evidence": "Table 5 shows ICON on three MLLMs: QWEN3VL (ASR 3.8%, UA 44.9%), INTERNVL (ASR 2.6%, UA 47.8%), MINICPM (ASR 2.4%, UA 48.8%). Average UA is 47.2% vs 28.8% for the LLM-Detector (Gemini).",
       "supported": "moderate"
     },
     {
       "claim": "IPI attacks manifest as intrinsic 'attention collapse' patterns detectable in latent space.",
       "evidence": "Section 4.5 introduces Focus Intensity Score to quantify attention anomalies. Figure 3 visualizes attention maps showing concentrated focus on malicious payload positions under attack versus dispersed attention after mitigation. The mechanism is demonstrated on Head 21 of Layers 22-25 in QWEN-3-8B.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No code released",
       "detail": "The paper provides no source code, making it impossible to verify the LSTP and MR implementations, reproduce the attention analysis, or confirm the reported efficiency claims."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper has no limitations or threats-to-validity section. The Impact Statement actively dismisses the need for specific concerns: 'none of which we feel must be specifically highlighted here.' This is unusual for a security paper."
     },
     {
       "flag": "No variance on main results",
       "detail": "Table 2, which supports the core claims, reports only point estimates with no error bars, standard deviations, or number of runs. Only the secondary OOD evaluation (Table 3) includes uncertainty."
     },
     {
       "flag": "Misleading utility gain claim",
       "detail": "The abstract claims 'over 50% task utility gain' but this conflates Utility Recovery Rate (a ratio of recovered utility) with actual utility improvement. The actual UA improvements in Table 2 are approximately 10 percentage points, not 50%."
     },
     {
       "flag": "All results positive — no negative findings",
       "detail": "Every experiment shows ICON outperforming or matching baselines. No failure modes, attack types that evade detection, or scenarios where utility recovery fails are reported."
     },
     {
       "flag": "Undisclosed industry conflicts",
       "detail": "Authors from Ant Group and Alibaba — companies that deploy LLM agents and would benefit from lightweight defense mechanisms — contribute to this paper. No funding source or competing interests are disclosed."
     },
     {
       "flag": "Only 8B parameter models tested",
       "detail": "All experiments use 8B-parameter open-weight models. Whether the attention collapse signature generalizes to larger models (70B+) or models with different architectures (e.g., Mixture of Experts) is unknown."
     },
     {
       "flag": "Missing key hyperparameter values",
       "detail": "The steering hyperparameters τ (scope) and γ (intensity) are central to the method but their specific values used in experiments are not reported, making reproduction impossible even with the code."
     }
   ],
   "cited_papers": [
     {
       "title": "Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents",
       "authors": ["E. Debenedetti", "J. Zhang", "M. Balunovic", "L. Beurer-Kellner", "M. Fischer", "F. Tramèr"],
       "year": 2024,
       "relevance": "Primary evaluation benchmark for LLM agent prompt injection defense, directly relevant to agent security evaluation methodology."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Q. Zhan", "Z. Liang", "Z. Ying", "D. Kang"],
       "year": 2024,
       "relevance": "Key benchmark for evaluating indirect prompt injection attacks in LLM agents with tool integration."
     },
     {
       "title": "Adaptive attacks break defenses against indirect prompt injection attacks on LLM agents",
       "authors": ["Q. Zhan", "R. Fang", "H. S. Panchal", "D. Kang"],
       "year": 2025,
       "relevance": "Demonstrates that adaptive attacks can bypass existing defenses, motivating the need for latent-space approaches like ICON."
     },
     {
       "title": "MELON: Provable defense against indirect prompt injection attacks in AI agents",
       "authors": ["K. Zhu", "X. Yang", "J. Wang", "W. Guo", "W. Y. Wang"],
       "year": 2025,
       "arxiv_id": "2502.05174",
       "relevance": "State-of-the-art tool-filtering defense baseline, directly compared against ICON."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["S. Chen", "A. Zharmagambetov", "S. Mahloujifar", "K. Chaudhuri", "D. Wagner", "C. Guo"],
       "year": 2025,
       "relevance": "Fine-tuning-based defense approach that represents the safety fine-tuning paradigm ICON aims to improve upon."
     },
     {
       "title": "AutoHijacker: Automatic indirect prompt injection against black-box LLM agents",
       "authors": ["X. Liu", "S. Jha", "P. McDaniel", "B. Li", "C. Xiao"],
       "year": 2025,
       "relevance": "Optimization-based attack generation technique relevant to understanding adaptive prompt injection threats."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["K. Greshake", "S. Abdelnabi", "S. Mishra", "C. Endres", "T. Holz", "M. Fritz"],
       "year": 2023,
       "relevance": "Foundational work on indirect prompt injection attacks against real-world LLM applications."
     },
     {
       "title": "Refusal in language models is mediated by a single direction",
       "authors": ["A. Arditi", "O. Obeso", "A. Syed", "D. Paleka", "N. Panickssery", "W. Gurnee", "N. Nanda"],
       "year": 2024,
       "relevance": "Demonstrates that refusal behavior in LLMs can be manipulated via single directions in activation space — the approach ICON's rectifier extends beyond."
     },
     {
       "title": "Attention Tracker: Detecting prompt injection attacks in LLMs",
       "authors": ["K.-H. Hung", "C.-Y. Ko", "A. Rawat", "I.-H. Chung", "W. H. Hsu", "P.-Y. Chen"],
       "year": 2025,
       "relevance": "Closely related attention-based detection method for prompt injection that ICON builds upon and extends."
     },
     {
       "title": "ReAct: Synergizing reasoning and acting in language models",
       "authors": ["S. Yao", "J. Zhao", "D. Yu", "N. Du", "I. Shafran", "K. R. Narasimhan", "Y. Cao"],
       "year": 2022,
       "relevance": "Core agentic framework used for all ICON experiments; foundational work on LLM agent architecture."
     },
     {
       "title": "Qwen3Guard technical report",
       "authors": ["H. Zhao", "C. Yuan", "F. Huang", "X. Hu", "Y. Zhang"],
       "year": 2025,
       "arxiv_id": "2510.14276",
       "relevance": "Fine-tuned safety guardrail model used as the LLM-Detector baseline in ICON's evaluation."
     },
     {
       "title": "CyberSecEval 3: Advancing the evaluation of cybersecurity risks and capabilities in large language models",
       "authors": ["S. Wan", "C. Nikolaidis", "D. Song", "D. Molnar"],
       "year": 2024,
       "arxiv_id": "2408.01605",
       "relevance": "Source of the Visual Prompt Injection Benchmarks used for multimodal evaluation."
     },
     {
       "title": "Dissecting adversarial robustness of multimodal LM agents",
       "authors": ["C. H. Wu", "R. R. Shah", "J. Y. Koh", "R. Salakhutdinov", "D. Fried", "A. Raghunathan"],
       "year": 2025,
       "relevance": "Analyzes adversarial robustness of multimodal LLM agents, directly relevant to ICON's multimodal evaluation."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "The defense mechanism could be applied to LLM agents in production, but requires white-box access to model internals (attention weights), limiting applicability to self-hosted models."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The attention collapse insight is novel but builds incrementally on known work in model interpretability and attention analysis for safety."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Addresses the real and growing threat of indirect prompt injection attacks on LLM agents, with concrete attack demonstrations."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversial claims or direct challenges to specific companies or products."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or tool is released — the method cannot be tried."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Peking University and NTU are well-regarded; Ant Group and Alibaba are recognizable but not the primary AI research labs driving public attention."
     }
   }
 }