ai-research-survey

scan.json (32877B)

---

 {
   "paper": {
     "title": "InjecGuard: Benchmarking and Mitigating Over-defense in Prompt Injection Guardrail Models",
     "authors": ["Hao Li", "Xiaogeng Liu"],
     "year": 2024,
     "venue": "arXiv.org",
     "arxiv_id": "2410.22770",
     "doi": "10.48550/arXiv.2410.22770"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Existing prompt injection guard models suffer from severe over-defense, with open-source models achieving less than 60% accuracy on benign inputs containing trigger words (near random guessing). The proposed InjecGuard model, trained with the MOF strategy on DeBERTa-v3-base, achieves 83.48% average accuracy across benign, malicious, and over-defense dimensions, rivaling GPT-4o (85.53%) at 500x the inference efficiency. The ablation study reveals that data-centric augmentation alone worsens over-defense (75.22% → 64.31%), but combining it with MOF and retraining from scratch yields the best balanced performance.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "GitHub repository URL provided in abstract: https://github.com/leolee99/InjecGuard. The paper states 'The code and datasets are released.'"
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The NotInject dataset (339 samples) and full training data (61,089 benign + 15,666 malicious samples) are stated to be released. The paper emphasizes being 'fully open-source' including 'the training dataset, strategies, code, and model' (Sec. 6). Evaluation also uses publicly available benchmarks (PINT, BIPIA, WildGuard)."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper specifies the backbone (DeBERTaV3-base) and training hyperparameters (Sec. 5.1) but provides no requirements.txt, Dockerfile, or library version listing that would allow environment recreation."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are included in the paper. While a GitHub repository is referenced, the paper itself does not contain a 'Reproducing Results' section or specific commands to run."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tab. 1, Tab. 2, Tab. 3, Tab. 7, and Tab. 9 are reported as point estimates (e.g., '83.48%') with no confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims InjecGuard 'surpasses' and 'outperforms' baselines based solely on comparing accuracy numbers. No p-values, t-tests, or any statistical significance tests are used to support comparative claims."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Percentage improvements are reported with baseline context: 'surpassing the open-sourced runner-up prompt guard model by 30.8%' (relative improvement), '54.17%' improvement in over-defense accuracy, and absolute accuracy values for all baselines (Tab. 1), allowing readers to assess magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is provided for why NotInject contains exactly 339 samples (113 per subset), why the training set has 61,089 benign and 15,666 malicious samples, or why MOF generates 1,000 samples (though Tab. 9 provides an ablation of the MOF scale, the other sizes are unjustified)."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "All results appear to be from single training runs. No standard deviation, variance, or spread across multiple runs is reported anywhere in the paper."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Eight baselines are compared: five prompt guard models (Fmops, Deepset, PromptGuard, ProtectAIv2, LakeraGuard) and three LLM-based methods (GPT-4o, Llama-2-chat, LlamaGuard3), as shown in Tab. 1."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include current state-of-the-art models: ProtectAIv2 (described as current SotA open-source), LakeraGuard (commercial), GPT-4o (2024), and LlamaGuard3 (2024). All are contemporary at time of writing."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Tab. 2 provides a thorough ablation study showing the contribution of each training component: basic dataset, data-centric augmentation, MOF with finetuning vs. scratch retraining. Tab. 3 compares MOF against a shortcut mitigation baseline. Tab. 9 ablates MOF sampling scale."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three accuracy dimensions are reported (over-defense, benign, malicious) plus computational overhead metrics (GFLOPs, inference time in ms, efficiency score). Tab. 1 presents all metrics together."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "Evaluation of InjecGuard's outputs is entirely automated using accuracy on test datasets. No human evaluation of the system's detection outputs is performed. Human involvement is limited to dataset construction (trigger word refinement), not system evaluation."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Evaluation uses separate benchmarks (PINT test, WildGuard, BIPIA, NotInject) that are distinct from the training data. The paper explicitly states that MOF 'does not require any over-defense dataset for training' (Sec. 4.2), keeping NotInject as a held-out evaluation set."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Tab. 7 provides detailed per-benchmark results across all models: NotInject (one-word, two-word, three-word subsets), WildGuard (benign), PINT (benign, injection, overall), and BIPIA (injection)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Tab. 2 shows data-centric augmentation alone worsens over-defense accuracy (75.22% → 64.31%). Fig. 7 visualizes a case where ProtectAIv2 and PromptGuard fail but InjecGuard succeeds. Tab. 3 shows conventional shortcut mitigation degrades malicious accuracy by 10.42%."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Tab. 2 explicitly shows that data-centric augmentation alone reduces over-defense accuracy from 75.22% to 64.31% and reduces average accuracy from 74.64% to 73.87%. Tab. 3 shows shortcut mitigation method hurts malicious performance by 10.42%."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims state-of-the-art models suffer from over-defense near random guessing (confirmed: ProtectAIv2 at 56.64% in Tab. 1), InjecGuard surpasses the best model by 30.8% (confirmed as relative improvement: (83.48-63.81)/63.81 = 30.83%), and that code/datasets are released (GitHub URL provided)."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper claims MOF 'significantly reduces the bias on trigger words.' The ablation study (Tab. 2) provides controlled single-variable manipulation: basic dataset → +augmentation → +MOF, showing each component's individual effect. Fig. 3 provides attention weight visualization supporting the mechanistic claim."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims InjecGuard offers 'a robust and open-source solution for detecting prompt injection attacks' broadly. The Limitations section acknowledges NotInject 'may not fully capture the diversity of real-world benign inputs, particularly in domain-specific applications,' but the main claims are not bounded to the tested benchmarks. The title uses the general framing 'Prompt Injection Guardrail Models.'"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No substantive discussion of alternative explanations for the results. For example, the improvement could partly stem from InjecGuard having more training data than baselines (whose data is closed-source), but this confound is not addressed. The Limitations section discusses dataset diversity but not alternative explanations for observed performance gains."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures accuracy on injection detection benchmarks and claims effectiveness at injection detection. The claims match the granularity of measurements — they do not claim broader properties like 'security' that go beyond what accuracy on these benchmarks measures."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "GPT-4o-mini is versioned ('2024-07-18 version', Sec. 3.2) and DeBERTaV3-base is specified. However, GPT-4o used as a baseline in Tab. 1 has no version or snapshot date. Llama-2-chat-7b and LlamaGuard3 are named without specific checkpoint identifiers."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt text is provided in Appendix D: Fig. 11 (word-based generation prompt), Fig. 12 (LLM injection detection/refinement prompt), and Fig. 13 (long-tail format augmentation prompt). The GPT-4o evaluation prompt is also shown in Fig. 12."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Sec. 5.1 reports: DeBERTaV3-base backbone, batch size 32, 3 epochs, Adam optimizer, learning rate 2e-5, 100-step warm-up, max token length 512."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. InjecGuard is a single-pass text classification model based on DeBERTa."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Sec. 3.2 documents the NotInject pipeline in detail: trigger word identification via frequency analysis (Alg. 1), LLM-based refinement, human evaluation (3 evaluators), and corpus generation with safety checking. Sec. 4.1 documents training data collection from 20 open-source datasets with data-centric augmentation for long-tail formats. Sec. 4.2 documents the MOF pipeline."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' section is present, discussing that NotInject may not capture domain-specific diversity in fields like healthcare or finance."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The Limitations section is brief and somewhat generic: 'may not fully capture the diversity of real-world benign inputs, particularly in domain-specific applications.' It does not discuss specific threats like training/test data overlap risk, the effect of GPT-4o-mini as both data generator and evaluation family member, or whether the trigger word methodology captures all forms of over-defense."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. It acknowledges NotInject's limitations vaguely but does not bound the claims — e.g., does not state that results are limited to English text, to the specific benchmarks tested, or that the model has not been tested in production settings."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The training dataset, NotInject evaluation dataset, and model are stated to be publicly released. The paper claims to be 'the first work to provide a fully open-source prompt guard model against injection, including the training dataset, strategies, code, and model' (Sec. 6)."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Data collection is described in detail: Sec. 3.2 describes NotInject construction (trigger word identification, refinement, corpus generation). Sec. 4.1 lists all 20 source datasets with counts (Tab. 4, 5, 6). Sec. 4.2 describes MOF data generation."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "Three human evaluators 'with security expertise' are employed for trigger word refinement (Sec. 3.2), but their recruitment method, institutional affiliation, and selection criteria are not described. Fig. 6 shows the evaluation agreement but not who these evaluators are or how they were selected."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full pipeline is documented with counts at each stage: trigger word identification (Alg. 1) → LLM filtering → human refinement (3 evaluators, scoring threshold >3) → 113 trigger words → corpus generation (113 per subset × 3 subsets = 339 samples) → LLM safety check → manual review. Training data pipeline in Sec. 4.1 with counts in Tab. 4-6."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source, acknowledgments section, or grant information is mentioned anywhere in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly stated: Hao Li at Washington University in St. Louis, Xiaogeng Liu at University of Wisconsin-Madison. Both are academic institutions with no obvious conflict with the evaluated products."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funding is disclosed. The work appears to be unfunded academic research from two universities."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial interest declaration is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates prompt injection defense models, not pre-trained model knowledge/capability on benchmarks. InjecGuard is fine-tuned from scratch on curated data. While LLM baselines (GPT-4o, Llama-2-chat) are included, they are tested on defense capability, not knowledge recall."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests defenses (prompt injection detection) rather than model knowledge. Contamination in the traditional sense (model memorizing benchmark answers) is not the primary concern."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates defense/detection capability rather than pre-trained model knowledge on benchmarks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study. The three human evaluators for trigger word refinement are annotators in the data pipeline, not study participants."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The Ethics Statement discusses responsible use of the dataset but does not mention IRB approval."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Tab. 1 reports GFLOPs (60.45 for InjecGuard) and inference time (15.34 ms) for all models. An efficiency metric (Average Accuracy / Inference Time) is also computed. Fig. 1 plots performance vs time efficiency."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total training GPU hours, wall-clock training time, or API costs for data generation (GPT-4o-mini calls) are reported. Only inference-time compute is quantified."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. Results appear to be from a single training run."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is not stated anywhere. It is unclear whether results are from single or multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Hyperparameters are reported (Sec. 5.1) but no search budget, search method, or number of configurations tried is disclosed. Only the MOF sampling scale is ablated (Tab. 9)."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Tab. 9 systematically evaluates MOF sampling scales (500, 1000, 2000) and justifies the selection of 1000 as the best balance. Tab. 2 builds up the full configuration through ablation, showing why each component was included."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper compares 9 models across 4+ benchmarks and 3 accuracy dimensions without any statistical tests, let alone correction for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own InjecGuard model against baselines without acknowledging self-comparison bias. They also evaluate on their own NotInject dataset. No independent evaluation or acknowledgment of author-evaluation bias is provided."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Fig. 1 plots average accuracy against time efficiency (log scale) for all models. Tab. 1 includes GFLOPs, inference time, and an efficiency metric (Accuracy/Inference Time) enabling performance-compute comparison."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation benchmarks (PINT, BIPIA, WildGuard, NotInject) validly measure real-world prompt injection detection capability. The paper uses these benchmarks without questioning their construct validity or representativeness."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. InjecGuard is a single-pass text classification model, and baselines are similarly direct classifiers or prompted LLMs."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of temporal leakage. The training datasets (Tab. 4-5) draw from many of the same source datasets as the evaluation benchmarks (e.g., BIPIA_train for training, BIPIA for evaluation; prompt-injections from Deepset for both). Whether temporal ordering prevents leakage is not addressed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For example, NotInject was constructed using the same trigger word methodology that informs MOF, creating a potential methodological entanglement."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Training data (Tab. 4-5) includes samples from BIPIA_train, prompt-injections (Deepset), jailbreak-classification, and other datasets that also contribute to evaluation benchmarks. The paper does not verify independence between training and test distributions or check for near-duplicate examples."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method (e.g., n-gram overlap, decontamination pipeline) is used to verify train/test separation."
       }
     }
   },
   "claims": [
     {
       "claim": "InjecGuard achieves 83.48% average accuracy, surpassing the open-source runner-up (ProtectAIv2 at 63.81%) by 30.8% relative improvement.",
       "evidence": "Tab. 1 shows InjecGuard at 83.48% average (87.32% over-defense, 85.74% benign, 77.39% malicious) vs ProtectAIv2 at 63.81%. Relative improvement: (83.48-63.81)/63.81 = 30.83%.",
       "supported": "strong"
     },
     {
       "claim": "Existing open-source prompt guard models suffer from severe over-defense, with accuracy near random guessing (50%).",
       "evidence": "Tab. 1: Fmops 5.60%, Deepset 5.31%, PromptGuard 0.88%, ProtectAIv2 56.64% over-defense accuracy. All open-source models are at or below 60%.",
       "supported": "strong"
     },
     {
       "claim": "InjecGuard achieves performance comparable to GPT-4o while being ~500x more efficient.",
       "evidence": "Tab. 1: InjecGuard 83.48% avg at 15.34ms inference vs GPT-4o 85.53% at 7907.18ms. Efficiency ratio: 5.44/0.01 = 544x. InjecGuard is 2.05pp lower in accuracy.",
       "supported": "moderate"
     },
     {
       "claim": "MOF (Mitigating Over-defense for Free) significantly reduces over-defense bias without relying on any specific over-defense dataset.",
       "evidence": "Tab. 2 ablation: adding MOF with scratch retraining to basic+augmented data improves over-defense from 64.31% to 87.32% and average from 73.87% to 83.48%. Tab. 3 shows MOF outperforms conventional shortcut mitigation (87.32% vs 86.73% over-defense, 77.39% vs 65.53% malicious).",
       "supported": "strong"
     },
     {
       "claim": "Data-centric augmentation improves benign and malicious accuracy but exacerbates the over-defense issue.",
       "evidence": "Tab. 2: augmentation improves benign (78.53% → 81.36%) and malicious (70.17% → 75.95%) but drops over-defense from 75.22% to 64.31%.",
       "supported": "strong"
     },
     {
       "claim": "MOF also improves performance in general (non-trigger-word) over-defense scenarios.",
       "evidence": "Tab. 10 shows InjecGuard with MOF achieves 91.15% on PINT hard-negative dataset vs 87.86% without MOF. However, this is a single benchmark with no statistical testing.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Ambiguous improvement metrics",
       "detail": "The paper reports '30.8% improvement' which is actually relative improvement ((83.48-63.81)/63.81), not the 19.67 percentage point absolute difference. This presentation can mislead readers into thinking the gap is larger than it is. The paper switches between relative and absolute metrics inconsistently."
     },
     {
       "flag": "Evaluation heavily relies on authors' own benchmark",
       "detail": "A significant portion of InjecGuard's advantage comes from the NotInject dataset, which the authors created. While NotInject is a legitimate contribution, evaluating primarily on your own benchmark creates a methodological circularity — the same team that identified the problem (over-defense on trigger words) designed both the evaluation and the solution."
     },
     {
       "flag": "No error bars or multiple runs",
       "detail": "All results are single point estimates with no variance, standard deviation, or confidence intervals. Fine-tuning DeBERTa can be sensitive to random seed, and performance differences (e.g., 83.48% vs 85.53% for GPT-4o) could be within noise."
     },
     {
       "flag": "Potential train/test data overlap",
       "detail": "Training data (Tab. 4-5) and evaluation benchmarks draw from overlapping source datasets (e.g., BIPIA, Deepset prompt-injections, jailbreak-classification). While different splits may be used, no decontamination or overlap verification is reported."
     },
     {
       "flag": "GPT-4o-mini used for data generation and evaluation family as baseline",
       "detail": "GPT-4o-mini generates both NotInject samples and MOF training data, while GPT-4o (same model family) serves as a baseline. Generated data could subtly favor patterns that GPT-4o recognizes or produces, potentially biasing the comparison."
     },
     {
       "flag": "Missing training compute costs",
       "detail": "The paper reports inference costs but omits total training compute and API costs for GPT-4o-mini data generation. The claim of being 'lightweight' applies to inference but the full cost of the approach (including data generation) is unknown."
     }
   ],
   "cited_papers": [
     {
       "title": "Ignore Previous Prompt: Attack Techniques For Language Models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Foundational work identifying prompt injection attacks on LLMs, including goal hijacking and prompt leakage."
     },
     {
       "title": "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "arxiv_id": "2302.12173",
       "relevance": "Demonstrates indirect prompt injection attacks against real-world LLM-integrated applications."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["Xiaogeng Liu", "Zhiyuan Yu", "Yizhe Zhang", "Ning Zhang", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Proposes automated methods for generating prompt injection attacks against LLMs."
     },
     {
       "title": "Llama guard: Llm-based input-output safeguard for human-ai conversations",
       "authors": ["Hakan Inan", "Kartikeya Upasani", "Jianfeng Chi"],
       "year": 2023,
       "arxiv_id": "2312.06674",
       "relevance": "LLM-based guardrail model for detecting unsafe content in human-AI conversations, used as a baseline comparison."
     },
     {
       "title": "Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models",
       "authors": ["Jingwei Yi", "Yueqi Xie", "Bin Zhu"],
       "year": 2023,
       "arxiv_id": "2312.14197",
       "relevance": "BIPIA benchmark for indirect prompt injection attacks, used as evaluation dataset in this paper."
     },
     {
       "title": "Wildguard: Open one-stop moderation tools for safety risks, jailbreaks",
       "authors": ["Seungju Han", "Kavel Rao", "Allyson Ettinger"],
       "year": 2024,
       "arxiv_id": "2406.18495",
       "relevance": "Open-source moderation tool with benchmark for safety risk detection, used for benign accuracy evaluation."
     },
     {
       "title": "Agentdojo: A dynamic environment to evaluate attacks and defenses for llm agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunović"],
       "year": 2024,
       "arxiv_id": "2406.13352",
       "relevance": "Dynamic benchmark for evaluating prompt injection attacks and defenses in LLM agent settings."
     },
     {
       "title": "Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Benchmark for indirect prompt injection in tool-integrated LLM agents."
     },
     {
       "title": "Optimization-based prompt injection attack to llm-as-a-judge",
       "authors": ["Jiawen Shi", "Zenghui Yuan", "Yinuo Liu"],
       "year": 2024,
       "arxiv_id": "2403.17710",
       "relevance": "Optimization-based prompt injection targeting LLM-as-a-judge evaluation paradigms."
     },
     {
       "title": "Neural exec: Learning (and learning from) execution triggers for prompt injection attacks",
       "authors": ["Dario Pasquini", "Martin Strohmeier", "Carmela Troncoso"],
       "year": 2024,
       "arxiv_id": "2403.03792",
       "relevance": "Novel approach to learning execution triggers for prompt injection, advancing attack methodology understanding."
     },
     {
       "title": "Struq: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David A. Wagner"],
       "year": 2024,
       "relevance": "Defense approach using structured queries to prevent prompt injection attacks."
     },
     {
       "title": "Prompt Injection Attacks and Defenses in LLM-Integrated Applications",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2023,
       "arxiv_id": "2310.12815",
       "relevance": "Comprehensive study of prompt injection attacks and defenses in LLM-integrated applications."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "InjecGuard is a released, lightweight prompt injection detector that practitioners could deploy, though it addresses a niche security concern rather than being a general-purpose tool."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Showing that existing guard models have severe over-defense issues (accuracy near random guessing) is mildly surprising but not deeply contrarian — false positive problems in security classifiers are well-known."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Directly addresses prompt injection attack defense, a real security concern for LLM deployments, and demonstrates that current defenses are inadequate."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Implicitly criticizes Meta's PromptGuard (0.88% over-defense accuracy) and ProtectAI's model, but framed academically without sensationalism."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code, model, and datasets are released on GitHub, making it testable. However, it requires setup as a Python/HuggingFace model rather than being a one-click demo."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "From academic labs (WashU, UW-Madison), not a major AI lab. References Meta and OpenAI products as baselines but is not from these organizations."
     }
   }
 }