ai-research-survey

scan.json (30590B)

---

 {
   "paper": {
     "title": "Jatmo: Prompt Injection Defense by Task-Specific Finetuning",
     "authors": [
       "Julien Piet",
       "Maha Alrashed",
       "Chawin Sitawarin",
       "Sizhe Chen",
       "Zeming Wei",
       "Elizabeth Sun",
       "Basel Alomair",
       "David Wagner"
     ],
     "year": 2023,
     "venue": "European Symposium on Research in Computer Security",
     "arxiv_id": "2312.17673",
     "doi": "10.48550/arXiv.2312.17673"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Jatmo fine-tunes non-instruction-tuned base models on task-specific datasets to defend against prompt injection attacks. Across 7 tasks, Jatmo models match GPT-3.5-Turbo quality (within 2%) while reducing prompt injection attack success from 87% to under 0.5%. Synthetic dataset generation with as few as one real example produces models achieving 96% of teacher model quality. The defense exploits the fact that base models have never been instruction-tuned and thus do not follow injected instructions.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "Code released at https://github.com/wagner-group/prompt-injection-defense, referenced in both the abstract and footnote 4."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "All evaluation datasets are publicly available standard benchmarks: The Stack, IMDB, Amazon Reviews, Gutenberg, CNN/DM, Jigsaw, and STS (Table 1). The paper uses these unmodified."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or detailed environment specification is provided in the paper. The paper mentions using OpenAI APIs but does not document the full software environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "While code is released and the methodology is described, the paper does not include step-by-step reproduction instructions or a README-style guide for replicating experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Table 2 and all figures report point estimates only. No confidence intervals or error bars are provided for any results."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used. Comparisons between Jatmo and GPT-3.5-Turbo are made by directly comparing percentages without any formal testing."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Results are reported with baseline context enabling effect size interpretation: e.g., attack success drops from 87% (GPT-3.5-Turbo) to 0.5% (Jatmo), and quality is reported relative to the teacher model (e.g., '2% lower', 'Same')."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is given for why 400 training examples were chosen beyond empirical convergence shown in Fig. 4. No power analysis or principled sample size determination is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported across experimental runs. All results appear to be single-run numbers."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "GPT-3.5-Turbo serves as the primary baseline for both quality and security comparisons throughout the paper (Table 2)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "GPT-3.5-Turbo was a current, competitive model at the time of publication (late 2023). The paper also uses GPT-4 for synthetic data generation."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Fig. 4 shows quality at different training set sizes (10, 50, 100, 200, 400). Section 5.4 compares zero-shot vs one-shot synthetic dataset generation. Fig. 5 compares temperature settings (T=0.7 vs T=1.0). These collectively show which components and settings matter."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Two distinct evaluation dimensions are used: quality metrics (accuracy for classification tasks, GPT-3.5 rating for generative tasks) and security metrics (prompt injection attack success rate)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation of model outputs is performed. Quality assessment relies entirely on automated metrics: ground-truth accuracy for classification and GPT-3.5-Turbo ratings for generative tasks. The authors manually inspect one task's results for attack analysis but do not systematically evaluate output quality with humans."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 4 states 'we reserve part of the dataset for quality and prompt injection evaluations.' Section 5.4 explicitly separates 800 training, 100 evaluation, and 100 test examples for synthetic experiments."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 provides per-task breakdowns across all 7 tasks for both quality and attack success rates. Attack results are further broken down by injection position (start, middle, end)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses the 2% attack success on review summarization (the longest injections succeeding) and manually inspects news summarization, finding 'four partially successful attacks among the total 3900 tested injections.' Zero-shot synthetic data struggles are also discussed."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that zero-shot synthetic datasets underperform one-shot for news summarization, that temperature T=1.0 produces unstable results for translation, and that some tasks require more training data than others."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims '<0.5% attack success vs 87% for GPT-3.5-Turbo' and 'similar quality' — both are directly supported by Table 2 showing 0-2% attack success rates and quality within 2% of GPT-3.5-Turbo."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims the defense works 'because F is fine-tuned from a non-instruction-tuned LLM, it has never been trained to search for and follow instructions.' This causal mechanism is not isolated — the paper does not test fine-tuning an instruction-tuned model to verify that instruction tuning is the causal factor. Confounds include model size, architecture, and capability differences between davinci-002 and GPT-3.5-Turbo."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims a general 'Prompt Injection Defense' and the paper calls Jatmo 'the first effective defense against prompt injection attacks,' but experiments use only one base model (davinci-002), 7 tasks, and 13 attack templates. The generalization to other models, tasks, and more sophisticated attacks is not bounded."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not consider alternative explanations for why the defense works. For instance, it does not discuss whether the defense might simply be due to the base model being less capable, whether fine-tuning on a narrow distribution creates a form of out-of-distribution rejection, or whether the same effect could be achieved with a simpler approach."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly acknowledges the proxy gap in their security metric: 'Our prompt-injection metric has a tendency to underestimate attack effectiveness: outputs containing anything else than HACKED are marked as unsuccessful.' They also justify using LLM ratings as a proxy for output quality."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The base model 'davinci-002' is a specific model identifier, but 'GPT-3.5-Turbo' and 'GPT-4' are used without version snapshots or API version dates. Model behavior changes across versions of these APIs."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.1 provides the exact task prompts and best injection prompts for all 7 tasks. Appendix A.2 provides the full synthetic dataset generation prompts including system prompt, seed generation, and formatting prompts."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "Inference temperature is discussed (T=0.7 vs T=1.0) but fine-tuning hyperparameters (learning rate, epochs, batch size, etc.) are not reported. The OpenAI fine-tuning API settings are not specified."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. Jatmo is a fine-tuning pipeline, not an agentic system."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 and Fig. 3 document the full synthetic data pipeline: seed generation, input generation, input formatting. Section 5.1 describes how HackAPrompt attacks were filtered ('kept the most generic ones, level 1, ranked by success rate, kept top 10') and how test cases were constructed (13 attacks × 3 positions = 39 variants per test sample)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 'Discussion' contains a 'Limitations' subsection discussing single-task constraint, scope limited to prompt injection (not jailbreak), and acknowledging potential for more sophisticated attacks."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations section identifies specific threats: 'Single-task models sacrifice versatility,' 'Jatmo only defends against prompt-injection attacks and is not designed to prevent jailbreak attacks,' and 'it is possible that there might be more sophisticated attacks we didn't think of, and we welcome further security evaluation.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 1 explicitly states: 'We focus on defending against prompt injection attacks on LLM-integrated applications. Defending against prompt injection in web chat is beyond the scope of this paper.' Section 6 adds: 'Jatmo only defends against prompt-injection attacks and is not designed to prevent jailbreak attacks on alignment or adversarial examples.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "While input datasets are public benchmarks, the generated fine-tuning outputs from GPT-3.5, the fine-tuned models themselves, and raw experimental results (per-sample attack outcomes) are not explicitly made available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4 describes the three-stage pipeline: dataset collection from standard benchmarks, output generation using the teacher model, and fine-tuning. Section 4.1 details synthetic dataset generation. Section 5.1 details test set construction."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from standard public benchmarks."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full pipeline is documented: input collection (from standard datasets or synthetic generation) → output generation via teacher model (Ri = M(P+Di)) → train/eval/test split → fine-tuning → evaluation with injected test sets (39 variants per sample). Section 5.4 specifies 1000 synthetic inputs split into 800 training, 100 evaluation, 100 testing."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgements section lists: KACST-UCB Joint Center on Cybersecurity, OpenAI, NSF (grants 2229876 and CNS-2154873), DHS, IBM, C3.ai Digital Transformation Institute, Open Philanthropy, and Google."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: UC Berkeley, King Abdulaziz City for Science and Technology, and Peking University."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "OpenAI is listed as a funder, and the entire evaluation uses OpenAI models (GPT-3.5-Turbo as teacher, GPT-4 for synthetic generation, davinci-002 as base). OpenAI has a financial interest in demonstrating that their models can be used securely."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests a defense mechanism against prompt injection, not model knowledge on benchmarks. Quality evaluation is secondary and uses the teacher model's own labels, making contamination less relevant to the claims."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defenses rather than model knowledge. The fine-tuned models are trained on task-specific data generated by the teacher model, not evaluated on pre-training knowledge."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defenses rather than model knowledge. Contamination of benchmarks in pre-training data is not relevant to the prompt injection defense claims."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims 'no extra runtime overhead' and suggests cost savings from smaller models, but does not quantify actual inference costs, API costs, or latency for any experiments."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No GPU hours, fine-tuning time, API costs, or total computational budget is reported despite fine-tuning multiple models across 7 tasks."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No results across multiple random seeds are reported. All results appear to be from single experimental runs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is not stated. It is unclear whether results are from single or multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. Fine-tuning hyperparameters are not even listed, let alone search procedures."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "The choice of 400 training examples is justified by the convergence analysis in Fig. 4 showing quality plateaus. Temperature selection (T=0.7) is justified by comparison with T=1.0 in Fig. 5."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No formal statistical tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 explicitly addresses evaluation bias: 'we fine-tune Jatmo models on GPT-3.5-Turbo-generated labels instead of the ground truth' to avoid unfairly inflating Jatmo's apparent quality. They note 'This would unfairly inflate the apparent quality of our task-specific models.'"
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Performance is shown as a function of training set size (Fig. 4) but not as a function of compute budget. The compute cost of fine-tuning Jatmo models vs. prompting GPT-3.5-Turbo is not compared."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses the validity of its security metric: 'Our prompt-injection metric has a tendency to underestimate attack effectiveness: outputs containing anything else than HACKED are marked as unsuccessful.' They also manually inspect outputs to validate this concern."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. Jatmo is a direct model fine-tuning approach without agentic components."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether davinci-002's pre-training data included examples from the evaluation datasets (IMDB, CNN/DM, etc.), which were all published well before the model's training cutoff."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For example, the format of injected prompts might provide distributional cues that help the fine-tuned model reject them for reasons unrelated to instruction-following immunity."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether training and test data share structural similarities beyond the explicit train/test split. The fine-tuning data and test data come from the same datasets."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is applied beyond the basic train/test split."
       }
     }
   },
   "claims": [
     {
       "claim": "Jatmo models provide similar quality outputs as GPT-3.5-Turbo while being resilient to prompt injection attacks",
       "evidence": "Table 2 shows all Jatmo models within 2% of GPT-3.5-Turbo quality. Attack success rate drops from 87% average against GPT-3.5-Turbo to under 0.5% against Jatmo models (only 2 successful injections out of 23,400 tested).",
       "supported": "strong"
     },
     {
       "claim": "Only two prompt-injected inputs out of 23,400 succeeded against a Jatmo model",
       "evidence": "Table 2 and Section 5.2 report that the only successful attack was 2% of cases against review summarization with end-position injection. Manual inspection of news summarization found only 4 partially successful attacks in 3,900 tests.",
       "supported": "strong"
     },
     {
       "claim": "Jatmo achieves 96% of teacher model quality using one real example and 800 synthetic examples",
       "evidence": "Fig. 5 shows one-shot synthetic models achieving scores within 4% of GPT-3.5-Turbo at T=0.7 for tested tasks (Section 5.4).",
       "supported": "moderate"
     },
     {
       "claim": "A single real example is sufficient for synthetic dataset generation to match real data quality",
       "evidence": "Section 5.4 and Fig. 5 compare zero-shot vs one-shot synthetic models. One-shot matches GPT-3.5 quality for review summarization and approaches it for news summarization, while zero-shot struggles on tasks with specific formatting (Section 5.4).",
       "supported": "moderate"
     },
     {
       "claim": "Jatmo is the first effective defense against prompt injection attacks",
       "evidence": "Section 1 states 'we present what is (as far as we are aware) the first effective defense against prompt injection attacks.' The related work section (Section 2) surveys existing approaches and finds no effective prior defenses.",
       "supported": "weak"
     },
     {
       "claim": "The defense works because base models have not undergone instruction tuning and thus cannot follow injected instructions",
       "evidence": "The theoretical argument is presented in Sections 1 and 4, but the causal mechanism is not experimentally isolated. No experiment tests whether fine-tuning an instruction-tuned model would also resist injection, which would be needed to confirm that instruction-tuning absence is the causal factor.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "OpenAI funding while evaluating OpenAI models",
       "detail": "OpenAI is listed as a funder in acknowledgements, and the entire evaluation relies on OpenAI models (GPT-3.5-Turbo, GPT-4, davinci-002). This creates a conflict of interest where the funder benefits from showing their models can be used securely."
     },
     {
       "flag": "No statistical significance testing",
       "detail": "All comparisons between Jatmo and GPT-3.5-Turbo are made by directly comparing percentages without any formal statistical tests, confidence intervals, or multiple-run variance estimates."
     },
     {
       "flag": "Limited attack diversity",
       "detail": "Only 13 attack templates (10 from HackAPrompt level 1 + 3 hand-crafted) are used. These are relatively simple template-based attacks. More sophisticated adaptive attacks (e.g., gradient-based, model-aware) are not tested."
     },
     {
       "flag": "Single base model tested",
       "detail": "Only davinci-002 is used as the base model. The claim that non-instruction-tuned models are immune to prompt injection is not tested on other base models (e.g., Llama base, Falcon base), limiting the generalizability of the defense."
     },
     {
       "flag": "Causal mechanism not isolated",
       "detail": "The paper attributes the defense to the base model's lack of instruction tuning, but does not test the obvious control: fine-tuning an instruction-tuned model with the same process. Without this comparison, it's unclear whether the defense comes from the base model property or from task-specific fine-tuning itself."
     }
   ],
   "cited_papers": [
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "arxiv_id": "2302.12173",
       "relevance": "Foundational work on indirect prompt injection attacks against LLM-integrated applications, directly motivating Jatmo's defense approach."
     },
     {
       "title": "Ignore previous prompt: Attack techniques for language models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "relevance": "Early work categorizing prompt injection attacks (goal hijacking and prompt leaking), providing the attack taxonomy used in this paper."
     },
     {
       "title": "Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition",
       "authors": ["Sander Schulhoff"],
       "year": 2023,
       "arxiv_id": "2311.16119",
       "relevance": "Source of the HackAPrompt dataset used as one of the two attack sets for evaluating Jatmo's security."
     },
     {
       "title": "Tensor Trust: Interpretable Prompt Injection Attacks from an Online Game",
       "authors": ["Sam Toyer"],
       "year": 2023,
       "arxiv_id": "2311.01011",
       "relevance": "Gamified approach to collecting prompt injection attacks and defenses, relevant to evaluation methodology."
     },
     {
       "title": "SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks",
       "authors": ["Alexander Robey", "Eric Wong", "Hamed Hassani", "George J. Pappas"],
       "year": 2023,
       "arxiv_id": "2310.03684",
       "relevance": "Alternative defense using randomized smoothing, providing contrast to Jatmo's fine-tuning approach."
     },
     {
       "title": "Prompt Injection Attacks and Defenses in LLM-Integrated Applications",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2023,
       "arxiv_id": "2310.12815",
       "relevance": "Comprehensive survey of prompt injection attacks and defenses, providing context for the threat landscape Jatmo addresses."
     },
     {
       "title": "Prompt Injection Attack against LLM-integrated Applications",
       "authors": ["Yi Liu", "Gelei Deng", "Yuekang Li", "Kailong Wang"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Demonstrates prompt injection attacks against real-world LLM-integrated applications."
     },
     {
       "title": "Baseline Defenses for Adversarial Attacks Against Aligned Language Models",
       "authors": ["Neel Jain", "Avi Schwarzschild", "Yuxin Wen"],
       "year": 2023,
       "arxiv_id": "2309.00614",
       "relevance": "Proposes baseline defenses including paraphrasing and perplexity detection, which Jatmo aims to improve upon."
     },
     {
       "title": "Jailbroken: How Does LLM Safety Training Fail?",
       "authors": ["Alexander Wei", "Nika Haghtalab", "Jacob Steinhardt"],
       "year": 2023,
       "arxiv_id": "2307.02483",
       "relevance": "Analyzes failure modes of LLM safety training including string obfuscation techniques that could bypass input sanitization defenses."
     },
     {
       "title": "Training language models to follow instructions with human feedback",
       "authors": ["Long Ouyang", "Jeff Wu", "Xu Jiang"],
       "year": 2022,
       "arxiv_id": "2203.02155",
       "relevance": "InstructGPT paper describing the instruction tuning process that Jatmo's defense specifically targets by avoiding."
     },
     {
       "title": "Certifying LLM Safety against Adversarial Prompting",
       "authors": ["Aounon Kumar", "Chirag Agarwal", "Suraj Srinivas", "Soheil Feizi", "Himabindu Lakkaraju"],
       "year": 2023,
       "arxiv_id": "2309.02705",
       "relevance": "Proposes certified defenses against adversarial prompts using LLM-based detection, complementary to Jatmo's fine-tuning approach."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 3,
       "justification": "Released open-source tool with code that serves as a drop-in replacement for LLM API calls in applications, directly applicable to production systems."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The approach is intuitive — using non-instruction-tuned models to avoid instruction-following vulnerabilities — rather than counterintuitive."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that 87% of prompt injection attacks succeed against GPT-3.5-Turbo, highlighting a major security concern for deployed LLM applications."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy or conflict angle; straightforward defense paper."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code released on GitHub but requires OpenAI API access and fine-tuning setup, not a simple pip-install-and-run experience."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "UC Berkeley is well-known in AI research but not a major industry AI lab. Uses OpenAI models which adds some brand recognition."
     }
   }
 }