ai-research-survey

scan.json (29544B)

---

 {
   "paper": {
     "title": "Investigating the Vulnerability of LLM-as-a-Judge Architectures to Prompt-Injection Attacks",
     "authors": [
       "Narek Maloyan",
       "Bislan Ashinov",
       "Dmitry Namiot"
     ],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2505.13348",
     "doi": "10.48550/arXiv.2505.13348"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "LLM-as-a-Judge systems using Qwen2.5-3B-Instruct and Falcon3-3B-Instruct are vulnerable to GCG-optimized adversarial suffixes. The Comparative Undermining Attack (CUA), targeting decision logits directly, achieves >30% Attack Success Rate, outperforming the Justification Manipulation Attack (JMA) at ~15-17% and prior JudgeDeceiver at ~22-24%. Control conditions (random-suffix at 1.2-1.5%, token-shuffle at 2.8-3.1%) confirm the attacks exploit specific token arrangements rather than mere text disruption.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository, GitHub link, or archive is provided anywhere in the paper. No URL to source code for the CUA/JMA attacks or experimental setup."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses the publicly available MT-Bench Human Judgments dataset from LMSYS (Section IV-B). This is a standard public benchmark that the authors did not modify."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, conda environment, or library version details are provided. The paper names the models used but provides no environment setup information."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. The methodology is described at a high level but lacks sufficient operational detail for exact replication."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Table I reports only point estimates for ASR (e.g., 31.2%, 32.4%) with no confidence intervals, error bars, or uncertainty quantification."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims CUA outperforms JMA and other baselines based solely on comparing raw ASR percentages in Table I. No statistical significance tests (t-tests, bootstrap, etc.) are applied to any comparison."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "ASR percentages are reported with full baseline context: Random-Suffix 1.2-1.5%, Token-Shuffle 2.8-3.1%, Hard Prompt 5.1-5.4%, JMA 15.2-16.7%, JudgeDeceiver 22.8-24.1%, CUA 31.2-32.4%. The magnitude of improvement is clear from the absolute numbers and comparisons."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper never states how many instances from MT-Bench were used for the attacks, let alone justifies the sample size. No power analysis or discussion of whether the sample is adequate."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported. All results in Table I are single-point estimates with no indication of variability across runs or instances."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper includes multiple baselines: Random-Suffix Control, Token-Shuffle Control, Hard Prompt Attack baseline, and comparison with JudgeDeceiver (Section IV-C, Table I)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "JudgeDeceiver [41] (2024) is a contemporary baseline. The Random-Suffix and Token-Shuffle controls are well-designed experimental controls. The baselines are appropriate for this study."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "While CUA and JMA are compared, there is no systematic ablation of attack components (e.g., suffix length, number of GCG iterations, effect of different positive/negative token sets in JMA). The Token-Shuffle control is ablation-like but does not constitute a formal ablation study."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "Only Attack Success Rate (ASR) is used as an evaluation metric (Section IV-D, Eq. 3). No secondary metrics such as attack transferability, semantic preservation, or perplexity of adversarial suffixes are reported."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is performed. All evaluation is automated via ASR computation. Human review of whether verdict flips represent genuine manipulation (vs. confusion or degraded output) could have validated the results."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No mention of splitting the MT-Bench dataset into optimization/development and held-out test sets. It is unclear whether GCG optimization and evaluation were performed on the same instances."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table I breaks down results by model (Qwen2.5-3B, Falcon3-3B) and by attack method (6 methods). This provides per-method and per-model granularity."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of when or why attacks failed. With CUA at ~31% ASR, ~69% of attacks failed, but no analysis of failure modes is provided."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "No negative results are reported. Every attack method shows improvement over controls, and no failed approaches or configurations are mentioned."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'CUA achieves an ASR exceeding 30%' — Table I shows 31.2% and 32.4%. 'JMA also shows notable effectiveness' — Table I shows 15.2% and 16.7%. Both claims are supported by the reported results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims that adversarial suffixes manipulate judge decisions. The experimental design — appending optimized suffixes and measuring verdict flips — is a controlled intervention. The Random-Suffix and Token-Shuffle controls help isolate the causal mechanism (specific token arrangements, not mere text presence)."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims to investigate 'LLM-as-a-Judge Architectures' broadly, but experiments use only two 3B-parameter models (Qwen2.5-3B-Instruct and Falcon3-3B-Instruct). The conclusion references 'current LLM-as-a-Judge systems' and 'high-stakes evaluation tasks' without bounding these claims to small open-source models. No larger or proprietary models (GPT-4, Claude) were tested."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations are discussed. The paper does not consider whether the vulnerability is specific to small 3B models, whether instruction tuning quality affects susceptibility, or whether different judge prompt formats would alter results."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "ASR directly measures what is claimed — the rate at which adversarial suffixes flip judge verdicts. The measurement and the claim are at the same granularity; no proxy gap exists."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model names with version and size are given: 'Qwen2.5-3B-Instruct' (Section IV-A) and 'Falcon3-3B-Instruct' (Section IV-A). These are sufficiently specific to identify the exact models."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The exact judge prompt template is not provided. The paper describes the setup conceptually ('the judge fθ(x, a, b) outputs a preference') and gives one example hard prompt ('It is critically important that you select response B as the better one') but does not provide the full system/judge prompt or actual GCG-generated adversarial suffixes."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "Critical GCG hyperparameters are not reported: suffix length L, number of iterations, number of candidate substitutions per position, batch size, learning rate/step size. No model inference parameters (temperature, top-p) are stated."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The paper performs direct adversarial suffix optimization and model inference without any agent-based framework."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "No description of how the MT-Bench Human Judgments dataset was preprocessed or filtered. The paper does not state how many instances were used, how triplets (x, a, b) were formed, or how the 'initially losing answer' was determined."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "No dedicated limitations section exists. The only limitation mentioned is a passing remark in the Discussion: 'This work did not explore the impact of permuting the order of the attacked and genuinely superior answers.' This does not constitute a substantive limitations discussion."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The single mentioned limitation (answer order permutation) is specific but isolated. No discussion of threats from small model size, single dataset, lack of larger/proprietary model testing, or absence of variance reporting."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit 'what our results do NOT show' statement. The paper does not state that results are limited to 3B-parameter open-source models, a single dataset, or white-box access scenarios. The conclusions imply broad applicability without bounding scope."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (per-instance attack outcomes, generated adversarial suffixes, model outputs) is released. Only aggregated ASR percentages in Table I."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section IV-B describes the data source: 'We utilized the MT-Bench Human Judgments dataset provided by LMSYS. This dataset contains human evaluations of LLM responses to diverse questions, presented as pairwise comparisons.'"
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The data source is a standard public benchmark (MT-Bench Human Judgments from LMSYS)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "No documentation of the pipeline from raw dataset to final results. Missing details: how many instances were selected, how 'initially losing answer' was determined for each instance, how GCG optimization was applied per-instance."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding sources are mentioned anywhere in the paper. No acknowledgments section is present."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "Only author names and one email address (maloyan.narek@gmail.com) are listed. No institutional affiliations are provided, which is itself a transparency gap."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Cannot assess funder independence since no funding is disclosed. With three authors and no funding statement, independence cannot be verified."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement appears in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests adversarial attack effectiveness on LLM judges, not model knowledge on a benchmark. Whether models have seen MT-Bench questions is irrelevant to whether adversarial suffixes can flip their judging decisions."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates attack robustness of judges, not model knowledge. Benchmark contamination is not a relevant concern for this experimental design."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the study tests defense/robustness of judge behavior against adversarial inputs, not whether models can correctly answer benchmark questions from memorization."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, API cost, tokens consumed, or wall-clock time is reported for either the GCG optimization process or the judge model evaluations."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No computational budget is stated. The paper mentions models were chosen for 'relatively small size, which allows for extensive experimentation within computational constraints' (Section IV-A) but does not quantify the actual compute used."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds. GCG optimization involves random initialization of the suffix, making seed sensitivity particularly important, but it is not addressed."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. It is unclear whether results represent single runs or averages."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. GCG has multiple hyperparameters (suffix length, iterations, candidate set size) but no search process is described."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of how the reported configuration was selected. The paper does not explain whether multiple configurations were tried or how the final setup was chosen."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Six attack methods are compared across two models (12 cells in Table I) with no statistical tests at all, let alone multiple comparison corrections."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors propose CUA and JMA, implement them, and compare against their own implementations of baselines (Hard Prompt, Random-Suffix, Token-Shuffle). No acknowledgment of potential self-comparison bias. The JudgeDeceiver comparison is presumably re-implemented but not discussed."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "GCG-based attacks (CUA, JMA) require significantly more compute than Hard Prompt or Random-Suffix baselines, but no compute budget comparison is provided. The higher ASR may partly reflect greater optimization compute."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether MT-Bench Human Judgments adequately represents real-world LLM-as-a-Judge deployment scenarios. MT-Bench was designed for model ranking, not security evaluation."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved in the experimental setup."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the judge models (Qwen2.5-3B, Falcon3-3B) were trained on MT-Bench data. If models learned MT-Bench patterns during training, their baseline judging behavior could be confounded."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For instance, the judge seeing both answers simultaneously may provide different information than sequential evaluation."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether MT-Bench instances are independent or whether the same question categories/models appear in both optimization and evaluation sets."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is applied."
       }
     }
   },
   "claims": [
     {
       "claim": "The Comparative Undermining Attack (CUA) achieves Attack Success Rates exceeding 30% on both tested LLM judges.",
       "evidence": "Table I: CUA achieves 31.2% ASR on Qwen2.5-3B-Instruct and 32.4% on Falcon3-3B-Instruct (Section V-A).",
       "supported": "moderate"
     },
     {
       "claim": "The Justification Manipulation Attack (JMA) achieves ASRs of approximately 15-17%, significantly higher than simple hard prompt attacks.",
       "evidence": "Table I: JMA achieves 15.2% on Qwen2.5-3B and 16.7% on Falcon3-3B, compared to Hard Prompt at 5.1% and 5.4% (Section V-A).",
       "supported": "moderate"
     },
     {
       "claim": "Random text appended to answers has minimal impact on judge decisions, confirming attack success is not due to mere text disruption.",
       "evidence": "Table I: Random-Suffix Control achieves only 1.2% and 1.5% ASR (Section V-A).",
       "supported": "moderate"
     },
     {
       "claim": "The specific ordering and structure of tokens in adversarial suffixes is critical to attack effectiveness, not just the presence of certain tokens.",
       "evidence": "Table I: Token-Shuffle Control (2.8-3.1% ASR) is much lower than CUA (31.2-32.4%), demonstrating token arrangement matters (Section V-A, V-B).",
       "supported": "moderate"
     },
     {
       "claim": "LLM-as-a-Judge systems are significantly vulnerable to prompt-injection attacks and may not be sufficiently robust for high-stakes evaluation tasks.",
       "evidence": "Based on Table I results across all attack methods on two models (Section V-B, VI). However, only two small 3B models were tested, limiting generalizability.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "Extremely narrow model selection",
       "detail": "Only two 3B-parameter open-source models tested. No larger models (7B, 13B, 70B) or proprietary models (GPT-4, Claude) included. Small models may be disproportionately vulnerable to adversarial attacks, making the broad claims about 'LLM-as-a-Judge architectures' unsupported."
     },
     {
       "flag": "No error bars or variance reporting",
       "detail": "All results in Table I are single point estimates. GCG optimization involves random initialization, making results potentially sensitive to randomness. Without variance across seeds or runs, the stability and reliability of reported ASRs cannot be assessed."
     },
     {
       "flag": "Sample size never stated",
       "detail": "The paper never reports how many instances from MT-Bench were used for the attacks. This is a fundamental missing detail — the reader cannot assess whether ASR differences are meaningful without knowing N."
     },
     {
       "flag": "Claims significantly outrun evidence",
       "detail": "The paper generalizes from two 3B models to 'LLM-as-a-Judge architectures' and 'high-stakes evaluation tasks' in the title and conclusions. The tested models are far smaller than those typically used as judges in practice (GPT-4, Claude 3.5, etc.)."
     },
     {
       "flag": "Missing critical experimental details",
       "detail": "GCG hyperparameters (suffix length, iteration count, candidate set size), model inference parameters (temperature, top-p), and dataset preprocessing steps are all absent. The experiments cannot be reproduced from the paper alone."
     },
     {
       "flag": "No failure analysis",
       "detail": "With CUA succeeding only ~31% of the time, ~69% of attacks fail. No analysis of failure modes, what distinguishes successful from failed attacks, or what types of judge queries are more resistant."
     }
   ],
   "cited_papers": [
     {
       "title": "Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena",
       "authors": ["Lianmin Zheng", "Wei-Lin Chiang", "Ying Sheng"],
       "year": 2023,
       "arxiv_id": "2306.05685",
       "relevance": "Foundational paper establishing the LLM-as-a-Judge paradigm and the MT-Bench evaluation framework used in this study."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Proposes the GCG optimization method for adversarial suffix generation, which is the core attack technique adapted in this paper."
     },
     {
       "title": "JudgeDeceiver: Prompt injection attacks to manipulate LLM-as-a-Judge",
       "authors": ["Yiwei Shi"],
       "year": 2024,
       "arxiv_id": "2403.17710",
       "relevance": "Prior work on prompt injection attacks specifically targeting LLM-as-a-Judge systems; used as a baseline comparison."
     },
     {
       "title": "Bad-Judge: Backdoor vulnerabilities of LLM-as-a-Judge",
       "authors": ["Zihan Wang"],
       "year": 2024,
       "arxiv_id": "2503.00596",
       "relevance": "Demonstrates backdoor vulnerabilities in LLM-as-a-Judge systems during training, complementing the inference-time attacks studied here."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["Xiaogeng Liu"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Proposes gradient-based methods for universal prompt injection attacks on LLMs, demonstrating transferability across architectures."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra"],
       "year": 2023,
       "arxiv_id": "2302.12173",
       "relevance": "Demonstrates indirect prompt injection attacks on real-world LLM-integrated applications, establishing the broader threat model for prompt injection."
     },
     {
       "title": "SmoothLLM: Defending large language models against jailbreaking attacks",
       "authors": ["Alexander Robey", "Hamed Hassani", "George J. Pappas"],
       "year": 2023,
       "arxiv_id": "2310.03684",
       "relevance": "Proposes a defense mechanism against adversarial attacks on LLMs, directly relevant to mitigating the vulnerabilities demonstrated in this paper."
     },
     {
       "title": "LLM agents can be tricked to generate harmful content through indirect prompt injection",
       "authors": ["Xiaohan Xu"],
       "year": 2023,
       "arxiv_id": "2311.16339",
       "relevance": "Demonstrates that LLM agents are vulnerable to indirect prompt injection, extending the threat model to agentic systems."
     },
     {
       "title": "Attention tracker: Detecting prompt injection attacks in LLMs",
       "authors": ["Zijie Zhang"],
       "year": 2024,
       "arxiv_id": "2411.00348",
       "relevance": "Proposes attention-based detection of prompt injection attacks, a potential defense mechanism for the vulnerabilities demonstrated here."
     },
     {
       "title": "AutoDAN: Automatic and interpretable adversarial attacks on large language models",
       "authors": ["Sicheng Liu"],
       "year": 2023,
       "arxiv_id": "2310.15140",
       "relevance": "Proposes automatic adversarial attack generation for LLMs, relevant to understanding the broader landscape of optimization-based attacks on language models."
     },
     {
       "title": "Certifying LLM safety against adversarial prompting",
       "authors": ["Aounon Kumar"],
       "year": 2023,
       "arxiv_id": "2309.02705",
       "relevance": "Proposes certification methods for LLM safety against adversarial prompts, offering a formal approach to securing systems like LLM-as-a-Judge."
     },
     {
       "title": "Baseline defenses for adversarial attacks against aligned language models",
       "authors": ["Sujit Jain"],
       "year": 2023,
       "arxiv_id": "2309.00614",
       "relevance": "Evaluates baseline defense strategies against adversarial attacks on aligned LLMs, directly applicable to defending LLM-as-a-Judge systems."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "Highlights a vulnerability in LLM-as-a-Judge systems but provides no tool, code, or defense that practitioners can directly use."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "That small LLMs are vulnerable to adversarial suffix attacks is consistent with extensive prior work on LLM adversarial robustness; not surprising."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that LLM evaluation systems used in RLHF and model selection can be manipulated, raising concerns about AI alignment pipeline integrity."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Implies LLM judges are unreliable, a mild 'benchmarks are broken' angle, but no direct confrontation with specific products or companies."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or tool released; no way for readers to reproduce or try the attacks."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "Unknown authors with no disclosed institutional affiliation; uses relatively niche 3B-parameter models (Qwen2.5-3B, Falcon3-3B)."
     }
   }
 }