ai-research-survey

scan.json (28225B)

---

 {
   "paper": {
     "title": "IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents",
     "authors": [
       "Hengyu An",
       "Jinghuai Zhang",
       "Tianyu Du",
       "Chunyi Zhou",
       "Qingming Li",
       "Tao Lin",
       "Shouling Ji"
     ],
     "year": 2025,
     "venue": "Conference on Empirical Methods in Natural Language Processing",
     "arxiv_id": "2508.15310",
     "doi": "10.48550/arXiv.2508.15310"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "IPIGUARD introduces a Tool Dependency Graph (TDG) paradigm that decouples action planning from external data interaction to defend LLM agents against Indirect Prompt Injection attacks. On the AgentDojo benchmark across six LLMs and four attack types, IPIGUARD achieves the lowest average attack success rate (0.69%) while maintaining the highest utility under attack (58.77%), outperforming four baseline defenses. The ablation study confirms that both Fake Tool Invocation and Node Expansion mechanisms contribute complementary benefits, and using a stronger LLM for planning with a weaker one for execution offers a cost-effective configuration.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "GitHub repository URL provided: https://github.com/Greysahy/ipiguard (footnote 1 in abstract)."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "Uses the publicly available AgentDojo benchmark (https://agentdojo.spylab.ai), referenced in Section 4.1."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or detailed environment setup section found. Appendix C lists model versions and temperature but not software dependencies."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions in the paper. A code repository is provided but the paper itself does not include a 'Reproducing Results' section or commands to run."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1-3 and Figures 4-5 are point estimates with no confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "Multiple claims that IPIGUARD outperforms baselines (e.g., 'consistently achieves the lowest ASR') are based on comparing raw numbers without any statistical significance test."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Results provide percentage improvements with baseline context throughout, e.g., IPIGUARD average ASR 0.69% vs no-defense 13.16%, and UA 58.77% vs no-defense 54.30% (Table 1). Enough context for readers to assess magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for why 97 tasks with 629 test cases from AgentDojo is sufficient for the claims being made. No power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Temperature is fixed to 0 (Appendix C) to reduce variance, but no variance or standard deviation is reported across runs. Single-run results only."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Four baseline defenses compared: Detector, Tool Filter, Spotlight, and Sandwich, plus a no-defense baseline (Section 4.1, Table 1)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include recent methods: Spotlight (Hines et al., 2024), Detector (ProtectAI.com, 2024), Sandwich (Prompting, 2024), and Tool Filter (Willison, 2023b). All are from 2023-2024, contemporary with this 2025 paper."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 presents an ablation study removing Fake Tool Invocation (FTI) and Node Expansion (NE) individually and in combination, measuring BU, UA, and ASR."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three evaluation metrics used: Benign Utility (BU), Utility under Attack (UA), and Targeted Attack Success Rate (ASR), as defined in Section 4.1."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "Evaluation is entirely automated through the AgentDojo benchmark. No human evaluation of defense quality, task completion adequacy, or user experience."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "AgentDojo provides a standardized benchmark with 629 defined test cases across 97 tasks. The evaluation uses the benchmark's predefined test suite."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results broken down by all four AgentDojo scenarios (Workspace, Slack, Travel, Banking) in Table 1 and Figures 4-5."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2.1 discusses lower Workspace utility due to conservative handling. Section 4.2.2 acknowledges 'ASR is not exactly zero because the fake tool invocation may fail in rare corner cases.' Case studies in Appendix H illustrate both successes and the mechanism's behavior."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Lower Workspace utility acknowledged (Section 4.2.1). Ablation shows NE alone increases ASR (Table 3). Limitations section identifies three specific shortcomings of the approach."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims 'superior balance between effectiveness and robustness' are supported by Table 1 showing lowest average ASR (0.69%) with highest UA (58.77%). Claim of working across 'four attack scenarios and six different LLMs' is supported by Table 1 and Figure 4."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims like 'IPIGUARD significantly reduces unintended tool invocations' are supported by the ablation study (Table 3) which shows controlled single-variable manipulation of FTI and NE components. The ablation design is adequate for causal inference about component contributions."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "Abstract claims 'paving the way for the development of safer agentic systems in dynamic environments' and the broad title extend well beyond the tested setting (one benchmark, four attack types). Results are limited to AgentDojo's four domains and specific attack patterns, but framing suggests general applicability to all IPI defense scenarios."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No substantive discussion of alternative explanations for the results. For example, no discussion of whether AgentDojo's specific task structure favors pre-planning approaches, or whether the improvements come primarily from restricting the action space rather than the TDG mechanism specifically."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "Claims match the granularity of measurements. The paper measures ASR, BU, and UA on AgentDojo and makes claims about defense effectiveness on that benchmark. No broader proxy gap — they don't claim to measure 'security' in general, but specific attack success rates."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C specifies exact versions: 'GPT-4o (gpt-4o-2024-05-13), GPT-4o-mini (gpt-4o-mini-2024-07-18), Claude 3.5 Sonnet (claude-3-5-sonnet-20241022) and o4-mini (o4-mini-2025-04-16).' Qwen model versions are specified by name (Qwen2.5-7B-Instruct, Qwen3-32B)."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt templates provided in Appendix A for TDG Construction, Argument Estimation, and Node Expansion, including the actual instruction text and output format specifications."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C states: 'we fix the decoding temperature to 0 for all models. Unless otherwise specified, we set the reasoning effort level to medium.'"
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The TDG framework is described in extensive detail in Section 3: node types (Deterministic, Pending, Query Expanded, Resolved), traversal mechanism, Argument Estimation, Node Expansion, and Fake Tool Invocation are all fully specified with workflow diagrams (Figures 1-3)."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "AgentDojo benchmark is used as-is with its predefined tasks and attack injections. Section 4.1 describes the benchmark setup (97 tasks, 629 test cases, four domains) and how attacks are configured."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Dedicated 'Limitations' section after the conclusion with three specific limitations discussed."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Limitations are specific to this study: (1) focus on tool-based IPI only, not textual output manipulation, (2) cost constraints limiting the number of models tested (cannot evaluate o3), (3) requires models with strong planning capabilities, limiting applicability to weaker models."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Limitations section explicitly states what the results do NOT show: 'We focus on defending LLM agents against IPI attacks that interfere with tool usage, rather than those that solely manipulate textual outputs.' Also: 'our method requires access to models with reasonably strong planning capabilities.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (individual test case results, model outputs, TDG plans) are released. Only aggregated metrics in tables and figures."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Uses AgentDojo benchmark with 97 tasks across four domains, 629 test cases combining user goals with adversarial injections (Section 4.1). Benchmark is well-documented."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Uses standard benchmark (AgentDojo) and LLM APIs."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Pipeline is clear: user instruction → TDG construction → TDG traversal with argument estimation/node expansion/fake tool invocation → evaluation via AgentDojo metrics. Section 3 details each stage."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgements section lists multiple funding sources: National Key R&D Program of China, NSFC-Yeqisun Science Foundation, NSFC, Key R&D Program of Ningbo, China Postdoctoral Science Foundation, and Zhejiang Provincial Postdoctoral Research Project."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations clearly listed: Zhejiang University, University of California Los Angeles, and Westlake University. No affiliation with any LLM provider being evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "All funding sources are government/academic grants (NSFC, national R&D programs, postdoctoral foundations) with no financial interest in the outcome of LLM defense research."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement found in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates stated for any of the six models used (GPT-4o, GPT-4o-mini, Claude 3.5 Sonnet, Qwen2.5-7B, Qwen3-32B, o4-mini). Task completion utility could be affected by training contamination."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether any models may have been trained on AgentDojo tasks or similar tool-use scenarios that overlap with the benchmark."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "AgentDojo was published in 2024. Models trained after that date could have seen it. No discussion of this contamination risk, particularly relevant for utility metrics."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 reports average token usage (input/output) and task completion time for all defense methods. Table 5 reports estimated dollar costs (EC) for different planner-executor configurations."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": true,
         "justification": "Table 5 reports estimated costs for completing all tasks under different configurations (e.g., $6.73 for GPT-4o-mini as both planner and executor). Table 2 provides token usage breakdown."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Temperature is fixed to 0 (Appendix C) to reduce variance, but no multi-seed or multi-run sensitivity analysis is reported. API models can still produce non-deterministic outputs at temperature 0."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never explicitly stated. Results appear to be from single runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No mention of hyperparameter search budget. Prompt templates and configuration choices appear fixed without describing how they were selected."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The final IPIGUARD configuration (with both FTI and NE) is presented as the default without explaining how this specific combination of prompt templates and mechanisms was arrived at."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed at all, so multiple comparison correction is moot."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Authors implement all baseline defenses through the AgentDojo framework but do not acknowledge the bias of evaluating their own system against their own implementations of baselines."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 explicitly compares compute overhead (token usage, time) against defense performance. Section 4.2.3 discusses the trade-off: 'approximately a twofold increase in token usage' for 'substantial gains in robustness.' Table 5 further explores cost-performance via planner/executor splits."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AgentDojo adequately represents real-world IPI attack scenarios. The paper uses the benchmark without questioning whether its four domains and attack types capture the breadth of IPI threats in practice."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "IPIGUARD fundamentally changes the agent's execution scaffold (adding TDG planning and constrained execution), but comparisons with baselines that use different scaffolding approaches do not discuss this confound. The performance differences may partly reflect scaffolding differences rather than the TDG mechanism specifically."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of temporal leakage. AgentDojo tasks may have been seen during model training for newer models like o4-mini."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. The TDG planning phase receives full task descriptions and tool descriptions, but whether this provides unrealistic advantages compared to real deployment is not discussed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the 629 test cases are independent or share structural similarities (e.g., same domains, similar tool chains)."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method used."
       }
     }
   },
   "claims": [
     {
       "claim": "IPIGUARD achieves the lowest average Attack Success Rate (0.69%) across all four attacks while maintaining the highest Utility under Attack (58.77%) among all defense methods.",
       "evidence": "Table 1 shows averaged results across four attacks on GPT-4o-mini: IPIGUARD ASR 0.69% vs next-best Tool Filter 2.06%, and UA 58.77% vs next-best Spotlight 55.09%.",
       "supported": "strong"
     },
     {
       "claim": "IPIGUARD maintains benign utility (67.01%) close to the no-defense upper bound (68.04%).",
       "evidence": "Figure 5 and Section 4.2.1 report BU scores across defense methods on GPT-4o-mini.",
       "supported": "strong"
     },
     {
       "claim": "IPIGUARD generalizes across six different LLMs including both reasoning and non-reasoning models.",
       "evidence": "Figure 4 shows results under Important Instruction attack for GPT-4o, GPT-4o-mini, Claude 3.5 Sonnet, Qwen2.5-7B, Qwen3-32B, and o4-mini. ASR stays low across all models.",
       "supported": "moderate"
     },
     {
       "claim": "Both Fake Tool Invocation and Node Expansion are necessary and complementary components.",
       "evidence": "Table 3 ablation on GPT-4o-mini with Important Instruction: without both BU=52.58%/ASR=3.18%; NE alone raises BU to 64.95% but ASR to 4.77%; FTI alone reduces ASR to 0.32% but BU=51.55%; both together achieve BU=69.07%/ASR=0.64%.",
       "supported": "strong"
     },
     {
       "claim": "Using a stronger LLM for planning significantly improves performance with only marginal cost increases.",
       "evidence": "Table 5 shows replacing Qwen2.5-7B planner with o4-mini raises BU from 35.05% to 51.55% and UA from 33.55% to 49.28%. GPT-4o-mini executor with o4-mini planner costs $7.99 vs $6.73 with GPT-4o-mini planner, but UA jumps from 57.07% to 64.39%.",
       "supported": "strong"
     },
     {
       "claim": "IPIGUARD incurs approximately a twofold increase in token usage compared to no defense.",
       "evidence": "Table 2: IPIGUARD uses 14,605 input tokens vs 6,165 for no defense, and 560 output tokens vs 179. Time is 13.88s vs 7.13s.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No statistical tests for any comparative claims",
       "detail": "All claims of superiority ('consistently achieves the lowest ASR', 'highest overall performance') are based on comparing point estimates without any significance test. With a single run and no variance reported, it is impossible to know whether observed differences are reliable."
     },
     {
       "flag": "Single benchmark evaluation",
       "detail": "All results are on AgentDojo alone. The paper claims general defense effectiveness against IPI attacks but evaluates on only one benchmark with four predefined domains and four attack types. Generalization to real-world IPI scenarios is untested."
     },
     {
       "flag": "Single-run results with no variance",
       "detail": "Despite temperature 0, API models can produce non-deterministic outputs. No multiple runs or variance measures are reported, making result stability unknown."
     },
     {
       "flag": "No contamination analysis",
       "detail": "Several evaluated models (especially o4-mini from 2025) may have seen AgentDojo tasks in training data. Utility metrics could be inflated by contamination, but this is never discussed."
     }
   ],
   "cited_papers": [
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "Primary evaluation benchmark for IPI defense; defines attack-defense evaluation framework for tool-augmented LLM agents."
     },
     {
       "title": "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Foundational paper on indirect prompt injection attacks in LLM applications."
     },
     {
       "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Benchmark and attack method for indirect prompt injection in tool-augmented agents; one of the four attacks evaluated."
     },
     {
       "title": "Defending Against Indirect Prompt Injection Attacks with Spotlighting",
       "authors": ["Keegan Hines", "Gary Lopez", "Matthew Hall", "Federico Zarfati", "Yonatan Zunger", "Emre Kiciman"],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Delimiter-based defense baseline for IPI attacks; compared as one of four baseline defenses."
     },
     {
       "title": "Melon: Indirect Prompt Injection Defense via Masked Re-Execution and Tool Comparison",
       "authors": ["Kaijie Zhu", "Xianjun Yang", "Jindong Wang", "Wenbo Guo", "William Yang Wang"],
       "year": 2025,
       "arxiv_id": "2502.05174",
       "relevance": "Recent IPI defense method using masked re-execution and tool comparison for detection."
     },
     {
       "title": "The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents",
       "authors": ["Feiran Jia", "Tong Wu", "Xin Qin", "Anna Squicciarini"],
       "year": 2024,
       "arxiv_id": "2412.16682",
       "relevance": "LLM-as-a-judge defense paradigm for IPI attacks, monitoring intermediate steps for alignment with user intent."
     },
     {
       "title": "Can Indirect Prompt Injection Attacks Be Detected and Removed?",
       "authors": ["Yulin Chen", "Haoran Li", "Yuan Sui", "Yufei He", "Yue Liu", "Yangqiu Song", "Bryan Hooi"],
       "year": 2025,
       "arxiv_id": "2502.16580",
       "relevance": "Detection-based defense against IPI attacks using auxiliary models."
     },
     {
       "title": "Aligning LLMs to Be Robust Against Prompt Injection",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "Chuan Guo"],
       "year": 2024,
       "arxiv_id": "2410.05451",
       "relevance": "Training-based approach (RLHF/fine-tuning) to make LLMs robust against prompt injection."
     },
     {
       "title": "ReAct: Synergizing Reasoning and Acting in Language Models",
       "authors": ["Shunyu Yao", "Jeffrey Zhao", "Dian Yu", "Nan Du", "Izhak Shafran", "Karthik R. Narasimhan", "Yuan Cao"],
       "year": 2023,
       "relevance": "Foundational agent framework for reasoning and acting with tools; represents the standard execution paradigm that IPIGUARD modifies."
     },
     {
       "title": "Toolformer: Language Models Can Teach Themselves to Use Tools",
       "authors": ["Timo Schick", "Jane Dwivedi-Yu", "Roberto Dessì", "Roberta Raileanu", "Maria Lomeli", "Eric Hambro", "Luke Zettlemoyer", "Nicola Cancedda", "Thomas Scialom"],
       "year": 2023,
       "relevance": "Key work on LLM tool-use capabilities; relevant to understanding tool-augmented agent vulnerabilities."
     },
     {
       "title": "Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models",
       "authors": ["Jingwei Yi", "Yueqi Xie", "Bin Zhu", "Emre Kiciman", "Guangzhong Sun", "Xing Xie", "Fangzhao Wu"],
       "year": 2023,
       "arxiv_id": "2312.14197",
       "relevance": "Early benchmark and defense methods for indirect prompt injection in LLMs."
     },
     {
       "title": "Ignore Previous Prompt: Attack Techniques for Language Models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Foundational prompt injection attack technique; one of the four attack types evaluated in this paper."
     }
   ]
 }