ai-research-survey

scan.json (28685B)

---

 {
   "paper": {
     "title": "Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?",
     "authors": [
       "Rishika Bhagwatkar",
       "Kevin Kasa",
       "Abhay Puri",
       "Gabriel Huang",
       "Irina Rish",
       "Graham W. Taylor",
       "Krishnamurthy Dj Dvijotham",
       "Alexandre Lacoste"
     ],
     "year": 2025,
     "venue": "arXiv preprint (under review)",
     "arxiv_id": "2510.05244",
     "doi": "10.48550/arXiv.2510.05244"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "Section 10 states 'We will release all code required to reproduce our results upon acceptance.' This is a promise of future release, not an actual release."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses four public benchmarks (AgentDojo, ASB, InjecAgent, τ-Bench) which are publicly available. They mention releasing corrected versions of AgentDojo and ASB but these are also future promises."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, conda environment, or detailed environment specifications are provided anywhere in the paper or appendices."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. Algorithm 1 describes the pipeline conceptually but does not provide runnable commands or scripts."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "All results tables (Tables 1-4, 7-20) report ± values alongside point estimates, e.g., '83.02 ±5.33' in Table 1."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes comparative claims (e.g., 'Sanitizer achieves the best ASR-BU and ASR-UA Tradeoff') but relies solely on comparing point estimates with ± ranges. No statistical significance tests (t-tests, bootstrap tests, etc.) are reported."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are provided with baseline context, e.g., 'the ASR drops sharply from 70% to 9.25%, an almost 8× reduction' (Section 6.2) and '4× lower ASR' (Section 5, ASB discussion)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for benchmark sizes or number of experimental runs. The benchmarks are used as-is without discussing whether the evaluation sample sizes are adequate for the claimed conclusions."
       },
       "variance_reported": {
         "applies": true,
         "answer": true,
         "justification": "All results tables report ± values, indicating variance across runs, e.g., Table 1 shows '67.68 ±3.56' for Sanitizer BU."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Extensive baselines are compared: PI Detector, Repeat prompt, Spotlighting, Toolfilter, Melon, Melon-Aug, CaMeL, Instructional Prevention, Delimiters defense, Sandwich defense (Tables 1-4, Appendix A)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include recent work: CaMeL (Debenedetti et al., 2025), Melon (Zhu et al., 2025), DoomArena framework (Boisvert et al., 2025). These are contemporary and competitive."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper evaluates Minimizer alone, Sanitizer alone, and Combined (both) across benchmarks, constituting an ablation of the two firewall components (Table 1)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three metrics are used: Benign Utility (BU), Utility under Attack (UA), and Attack Success Rate (ASR), as defined in Section 4.2."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is performed. All evaluation is automated through benchmark metrics. Human assessment of whether sanitized outputs preserve semantic meaning would strengthen the utility claims."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The defense prompts were not tuned per-benchmark, but it is unclear whether the prompts were iterated using any of these benchmark results. No explicit held-out vs. development set separation is documented."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by benchmark suite (Banking, Slack, Travel, Workspace for AgentDojo in Tables 7-12), by DH/DS for InjecAgent (Table 19), and by attack type for ASB (Tables 14-15, 17-18)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 and Appendix E present a specific failure case where Braille-encoded injection bypasses the GPT-4o Sanitizer. The Minimizer's utility degradation is also discussed as a failure mode."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that the Minimizer degrades utility due to aggressive redaction (Section 5), the Combined defense has lower utility than Sanitizer alone, and the Sanitizer can be bypassed by Braille encoding (Section 7)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims 'perfect security (0% or the lowest possible attack success rate)' but on ASB the Sanitizer achieves 16.33% ASR (Table 2). While the paper explains this as partly a scoring artifact, 'perfect security' language is overstated for a 16.33% attack success rate."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims (e.g., 'the Sanitizer prevents attacks') are supported by controlled experiments comparing agent performance with and without the defense across multiple benchmarks. The ablation of Minimizer vs Sanitizer vs Combined provides adequate causal evidence."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title 'Are Firewalls All You Need' and abstract claim of 'model-agnostic' defense imply broad applicability. While tested on four models and four benchmarks, the paper acknowledges the Sanitizer can be bypassed but the title and framing extend beyond what was tested. Section 8 notes benchmarks use weak attacks."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 extensively discusses alternative explanations for benchmark results (inflated ASR from forced tool injection, brittle utility metrics, missing task-critical content). Section 7 discusses why the Sanitizer might fail (rare token encoding bypasses alignment)."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures ASR, BU, and UA directly. These are the actual quantities of interest — no proxy gap exists between what is measured (attack success rates, task completion rates) and what is claimed."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model versions are given: 'gpt-4o-2024-08-06' (Tables 7-12), 'GPT-4o-2024-05-13' (Appendix E), 'Llama 3.3 70b', 'Qwen3 32b', 'Qwen3 8b'. The GPT-4o versions include snapshot dates."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompts for both the Tool-Input Firewall (Minimizer) and Tool-Output Firewall (Sanitizer) are provided verbatim in Appendix B, including system messages and user message templates."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No temperature, top-p, max tokens, or other API/sampling hyperparameters are reported for any of the LLM calls (agent, Minimizer, or Sanitizer)."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "Algorithm 1 describes the full pipeline: user task → agent generates tool call → Minimizer filters inputs → tool executes → Sanitizer filters output → return to agent. Figure 1 provides a visual diagram."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 documents specific modifications to AgentDojo and ASB benchmarks with before/after examples (Appendix D). The τ-Bench augmentation with DoomArena attacks is described in Section 4.1."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 (Discussion) contains substantive discussion of defense limitations, including how stronger attacks can bypass the Sanitizer. Section 9 (Ethics Statement) discusses risks of overreliance on defenses and additional API call privacy risks."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 provides a specific threat: Braille-encoded injections bypass the GPT-4o Sanitizer because rare tokens may be less well-aligned. Section 6 identifies specific benchmark validity threats (forced tool injection, content overwriting, brittle metrics)."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 9 states 'the firewalls we have presented here assume that the user task is fully trusted, and that the tools themselves are secure.' Section 7 states 'it is still possible to bypass them in practice' and calls for 'stronger and more diverse attack strategies.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (individual trial results, logs, model outputs) is available. Only aggregated results in tables are provided."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes each of the four benchmarks used, their structure (number of evaluations, attack types, suite compositions), and how they were set up for experiments."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from existing public benchmarks."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Algorithm 1 documents the full pipeline from user task through tool calls with firewall processing. Section 6 documents the benchmark modification pipeline with specific before/after examples in Appendix D."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "The acknowledgments thank ServiceNow colleagues for discussions and compute resources, but no explicit funding source (grants, corporate funding) is disclosed."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: ServiceNow Research, Mila - Quebec AI Institute, Université de Montréal, Vector Institute, University of Guelph."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "ServiceNow Research (primary affiliation for 4 of 8 authors) is an enterprise AI company that could commercially benefit from demonstrating effective AI agent security solutions. This potential conflict is not discussed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is included in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defense mechanisms (firewalls) rather than evaluating model knowledge on benchmarks. The defense effectiveness depends on the LLM following sanitization instructions, not on whether the model has seen benchmark solutions."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defenses against prompt injection attacks, not model capability on knowledge benchmarks. Train/test overlap is not the relevant concern for this paper type."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates defense mechanisms, not model knowledge. However, the authors do recommend future benchmarks 'add a canary string to detect data contamination' (Section 8), showing awareness of the issue for model evaluation."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The firewalls add extra LLM calls per tool invocation (2 calls: one for Minimizer, one for Sanitizer). Section 9 acknowledges 'the firewall steps may require additional API calls' but no actual cost, latency, or token usage figures are reported."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. The paper does not report GPU hours, API costs, or total compute used for the experiments across four benchmarks and multiple models."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "The ± values in tables suggest multiple runs but no explicit mention of random seeds or seed sensitivity analysis. It is unclear whether variance comes from seeds, stochastic sampling, or benchmark subsets."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper never explicitly states how many runs produced the reported ± values. No 'averaged over K runs' or equivalent statement found."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "The defense prompts are presented as fixed without documenting how they were developed. Section 7 mentions 'experimenting with a wide range of prompting strategies' for the attack but no search budget for the defense design."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The Minimizer and Sanitizer prompts (Appendix B) are presented as the final configuration without explaining how these specific prompts were selected or what alternatives were tried."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Many pairwise comparisons are made across defenses, benchmarks, and models without any correction for multiple comparisons (Bonferroni, etc.)."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own proposed defense against baselines but do not acknowledge the bias of evaluating their own system. CaMeL and Melon results are taken from published papers ('non-replicable baselines'), not independently reproduced."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "The firewall defense adds 1-2 extra LLM calls per tool invocation, significantly increasing compute cost vs. zero-overhead defenses like Spotlighting or Repeat Prompt. This compute disparity is not discussed or controlled for."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 extensively analyzes construct validity of AgentDojo, ASB, and InjecAgent. The paper identifies forced tool injection inflating ASR, brittle metrics, content overwriting, and missing utility metrics as validity threats. This is a core contribution."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The defense (firewall) IS the scaffold being tested. The paper compares multiple defenses applied to the same models, so the scaffold confound does not apply in the traditional sense."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether GPT-4o, Llama 3.3, or Qwen3 may have seen AgentDojo, ASB, or InjecAgent tasks during training. These benchmarks were published before the models' training cutoffs."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For example, whether the Sanitizer's system prompt gives it unfair advantage by revealing the expected attack format."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of independence between benchmark tasks or whether results on related tasks within the same suite are independent observations."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection methods applied. The paper recommends future benchmarks 'add a canary string to detect data contamination' (Section 8) but does not implement any detection for the current evaluation."
       }
     }
   },
   "claims": [
     {
       "claim": "The Sanitizer firewall achieves 0% or near-0% ASR across four benchmarks while maintaining high task utility.",
       "evidence": "Table 1 (AgentDojo): Sanitizer ASR 0.02%; Table 2 (ASB): 16.33%; Table 3 (InjecAgent): 0.3% base, 0.0% enhanced; Table 4 (τ-Bench): 0.0%. Utility maintained comparably to baselines.",
       "supported": "moderate"
     },
     {
       "claim": "Forced attack-tool injection in ASB inflates ASR by approximately 8×.",
       "evidence": "Table 6 shows ASR drops from 73.58% to 9.25% when forced attack-tool injection is disabled. Specific example in Appendix D.2.1.",
       "supported": "strong"
     },
     {
       "claim": "AgentDojo injection vectors overwrite task-critical content, confounding utility evaluation.",
       "evidence": "Section 6.1 with specific example in Appendix D.1.1 where bill content is replaced by injection. Table 5 shows 18%+ utility improvement with fix (60.87% → 72.19%).",
       "supported": "strong"
     },
     {
       "claim": "The Sanitizer can be bypassed using Braille-encoded injections.",
       "evidence": "Appendix E provides a specific example where a Braille-encoded 'important instructions' attack bypasses GPT-4o-2024-05-13 Sanitizer on the AgentDojo Travel suite (UserTask0, InjectionTask0).",
       "supported": "moderate"
     },
     {
       "claim": "The firewall defense outperforms CaMeL and Melon on ASR while maintaining higher utility.",
       "evidence": "Table 1: Sanitizer achieves 0.02% ASR with 67.68% BU vs CaMeL's 0% ASR with 53.6% BU. Melon achieves 0.95% ASR with 68.04% BU.",
       "supported": "moderate"
     },
     {
       "claim": "PI Detector defenses reduce ASR but cause severe utility degradation.",
       "evidence": "Table 1: PI Detector reduces ASR to 7.95% but drops BU to 41.49%. Table 4: PI Detector achieves 0% ASR but drops BU to 6.90%.",
       "supported": "strong"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "A simple firewall defense consisting of a Tool-Input Minimizer and Tool-Output Sanitizer achieves near-zero attack success rates across four IPI benchmarks (AgentDojo, ASB, InjecAgent, τ-Bench) while maintaining competitive task utility, outperforming more complex defenses like CaMeL and Melon. The paper identifies critical flaws in existing benchmarks: forced tool injection inflating ASR by 8× in ASB, injection vectors overwriting task-critical content in AgentDojo, and missing utility metrics in InjecAgent. Despite strong benchmark results, the Sanitizer can be bypassed using Braille-encoded attacks, demonstrating that existing benchmarks use overly weak attacks and do not adequately stress-test defenses.",
   "red_flags": [
     {
       "flag": "Non-replicable baselines",
       "detail": "CaMeL and Melon results are 'directly reported' from published papers (marked with * in Table 1) because authors were 'unable to successfully reproduce their results.' This makes direct comparison unreliable — different hardware, software versions, or evaluation conditions could explain differences."
     },
     {
       "flag": "Abstract overclaims",
       "detail": "The abstract claims 'perfect security (0% or the lowest possible attack success rate)' but ASB Sanitizer ASR is 16.33% (Table 2). The paper attributes this to 'scoring artifacts' but the claim of 'perfect security' in the abstract is misleading without this qualification."
     },
     {
       "flag": "Missing cost analysis for proposed defense",
       "detail": "The firewall defense adds 1-2 additional LLM API calls per tool invocation — a significant overhead acknowledged in Section 9 ('may require additional API calls') but never quantified. Baselines like Spotlighting and Repeat Prompt add zero LLM calls, making the comparison unfair on cost."
     },
     {
       "flag": "Number of runs and seed sensitivity not reported",
       "detail": "All tables show ± values but the paper never states how many runs produced these numbers, what random seeds were used, or whether variance comes from sampling stochasticity, benchmark subsets, or multiple trials."
     },
     {
       "flag": "Defense prompt engineering not documented",
       "detail": "The Minimizer and Sanitizer prompts are presented as final versions without documenting how they were designed, what alternatives were tried, or whether they were iterated based on benchmark results. The claim of 'zero tuning' is not verifiable."
     }
   ],
   "cited_papers": [
     {
       "title": "Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "Primary benchmark used for evaluating IPI defenses for tool-calling agents."
     },
     {
       "title": "Agent security bench (ASB): Formalizing and benchmarking attacks and defenses in LLM-based agents",
       "authors": ["Hanrong Zhang", "Jingyuan Huang", "Kai Mei"],
       "year": 2025,
       "relevance": "Benchmark for evaluating agent robustness against prompt injection in multi-step tool-use settings."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "doi": "10.18653/v1/2024.findings-acl.624",
       "relevance": "Benchmark for IPI attacks from malicious tools, including direct harm and data stealing attack categories."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": ["Edoardo Debenedetti", "Ilia Shumailov", "Tianqi Fan"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "CaMeL system-level defense using a custom Python interpreter for policy-based agent constraints — a key comparison baseline."
     },
     {
       "title": "MELON: Provable defense against indirect prompt injection attacks in AI agents",
       "authors": ["Kaijie Zhu", "Xianjun Yang", "Jindong Wang"],
       "year": 2025,
       "relevance": "Context-minimization defense for conversational LLMs, a key baseline compared against in the paper."
     },
     {
       "title": "Firewalls to secure dynamic LLM agentic networks",
       "authors": ["Sahar Abdelnabi", "Amr Gomaa", "Eugene Bagdasarian"],
       "year": 2025,
       "arxiv_id": "2502.01822",
       "relevance": "Introduces firewalled agent architecture with input/data/trajectory firewalls for multi-turn agent conversations."
     },
     {
       "title": "Airgapagent: Protecting privacy-conscious conversational agents",
       "authors": ["Eugene Bagdasarian", "Ren Yi", "Sahra Ghalebikesabi"],
       "year": 2024,
       "doi": "10.1145/3658644.3690350",
       "relevance": "Pioneering work on isolated LLM for context minimization to protect conversational agents from data exfiltration."
     },
     {
       "title": "The instruction hierarchy: Training llms to prioritize privileged instructions",
       "authors": ["Eric Wallace", "Kai Xiao", "Reimar Leike"],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "LLM retraining approach for prompt injection defense by establishing instruction priority hierarchies."
     },
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2025,
       "relevance": "Defense approach using structured queries to separate trusted and untrusted content in LLM inputs."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra"],
       "year": 2023,
       "relevance": "Foundational work defining indirect prompt injection attacks in LLM-integrated applications."
     },
     {
       "title": "Doomarena: A framework for testing AI agents against evolving security threats",
       "authors": ["Léo Boisvert", "Abhay Puri", "Gabriel Huang"],
       "year": 2025,
       "relevance": "Framework used to augment τ-bench with data stealing attacks for security evaluation."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar"],
       "year": 2025,
       "relevance": "Preference optimization approach for training LLMs to be robust against prompt injection attacks."
     }
   ]
 }