ai-research-survey

scan.json (31793B)

---

 {
   "paper": {
     "title": "Manipulating Multimodal Agents via Cross-Modal Prompt Injection",
     "authors": [
       "Le Wang",
       "Zonghao Ying",
       "Tianyuan Zhang",
       "Siyuan Liang",
       "Shengshan Hu",
       "Mingchuan Zhang",
       "Aishan Liu",
       "Xianglong Liu"
     ],
     "year": 2025,
     "venue": "ACM Multimedia",
     "arxiv_id": "2504.14348",
     "doi": "10.1145/3746027.3755211"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval", "case-study"],
   "key_findings": "CrossInject demonstrates that coordinated cross-modal prompt injection (simultaneous visual and textual manipulation) significantly outperforms unimodal attacks against multimodal agents, with visual-only attacks (JIP) achieving 0% ASR while CrossInject achieves up to 97%. Ablation studies show both Visual Latent Alignment and Textual Guidance Enhancement contribute substantially, with average drops of 18.7% and 24.8% respectively when removed. The attack transfers to a physical autonomous driving robot (9/10 success rate), and tested defenses (sandwich prompting, Gaussian blur) reduce ASR by at most ~7% on average.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'All code is implemented in PyTorch' (Sec. 5.1) but provides no repository URL, GitHub link, or code archive. No code release is mentioned anywhere in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation uses publicly available standard datasets: CoEDIT (text editing) and SST2 (sentiment classification), both referenced with citations. However, the specific 100-sample subsets and constructed injection datasets are not released separately."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'NVIDIA A800-SXM4-80GB GPU cluster' and PyTorch, and names specific models (Stable-Diffusion-3.5-Large, Llama-3.1-8B-Instruct), but provides no requirements.txt, Dockerfile, or detailed dependency/version listing sufficient to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No reproduction instructions, README, or step-by-step guide are provided. The methodology section describes the approach conceptually but does not provide runnable instructions."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Despite stating 'each experiment was repeated three times, and the average results are reported' (Sec. 5.1), no confidence intervals, error bars, or ± notation appear in any table or figure."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims CrossInject 'outperforms' baselines based solely on comparing point estimates. No statistical significance tests (t-tests, bootstrap, etc.) are reported for any comparison."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports specific percentage-point improvements with baseline context, e.g., 'average performance gain up to 32.7% over all baseline approaches, with maximum ASR improvement reaching 71.7%' (Sec. 5.2). Absolute ASR values are provided for all methods in Tab. 1."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "100 entries were randomly sampled from each dataset (Sec. 5.1) with no justification for this sample size, no power analysis, and no discussion of whether 100 is sufficient for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Experiments were repeated 3 times and averaged, but no standard deviation, IQR, or any spread measure is reported. The reader cannot assess result stability across runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Three baselines are compared: Naive (direct instruction), JIP (visual-only prompt injection), and FB (textual delimiter-based injection). All are described in Sec. 5.1."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "JIP [21] is from ICLR 2024 and FB [58] is from USENIX Security 2024. Both are recent and representative of the state of the art in their respective modalities."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Extensive ablations in Sec. 5.3 cover visual alignment (Tab. 2), textual enhancement (Tab. 3), perturbation budget (Fig. 4a), optimization iterations (Fig. 4b), and surrogate LLM choice (Tab. 4)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Two metrics are used: Attack Success Rate (ASR) measuring attack effectiveness, and Performance under No Attack (PNA) measuring agent capability without attacks (Sec. 5.1)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation uses the automated LLM-as-a-Judge approach (Qwen-Max). No human evaluation of attack success, output quality, or adversarial image imperceptibility is conducted."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The 100 samples per dataset are used directly for evaluation. There is no explicit separation of development and test splits for the evaluation data. While attack optimization uses surrogate models (not victim models), the data itself is not split."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Tab. 1 provides full breakdowns by agent role (RM/PG), VLM planner (Qwen2-VL/Phi-3.5-vision), injected task (Text Editing/Sentiment Analysis), and attack surface (local document/online webpage)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses: visual-only attacks (JIP) achieving 0% ASR, perturbation budget=32 causing regression due to overfitting surrogate encoders (Sec. 5.3), and online webpages being harder to exploit (10.8% lower ASR, Sec. 5.2)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Negative results include: JIP's 0% ASR showing visual-only attacks fail, budget=32 regression on RM/Qwen2-VL (Sec. 5.3), random noise yielding no improvement, and random textual commands degrading performance in 3 cases (Tab. 3)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims 'at least a +30.1% increase in attack success rates across diverse tasks,' but Sec. 5.2 reports +32.7% average for local documents and +27.5% for online webpages. The 27.5% figure is below the claimed 30.1% minimum. The conclusion further contradicts this, stating '+26.4% increase.' The headline claim is inconsistent across sections."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims (e.g., 'removing visual adversarial alignment results in a substantial degradation') are supported by controlled ablation studies that manipulate one variable at a time (Tab. 2, Tab. 3). The single-variable manipulation design is adequate for these claims."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims broad applicability to 'Multimodal Agents' but evaluation uses only 2 custom chatbot agents with 2 small VLMs (Qwen2-VL 2B, Phi-3.5-vision) and 1 toy physical robot. No evaluation on production-grade models (GPT-4V, Gemini) or real-world deployed agents. Generalization claims are not bounded to the tested setting."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for attack success, such as whether the small model size (2B parameters) makes agents more susceptible, whether the custom toy agents have unusually weak safety guardrails, or whether LLM-as-a-Judge introduces systematic bias in ASR measurement."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "ASR is measured via LLM-as-a-Judge (Qwen-Max) as a proxy for actual attack success, but the paper does not discuss the validity of this proxy, potential biases of the judge model, or how well automated judgment aligns with human assessment of successful attacks."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model versions are provided: 'Qwen2-VL with 2B parameters,' 'Phi-3.5-vision,' 'Llama-3.1-8B-Instruct,' 'Stable-Diffusion-3.5-Large,' vision encoders 'ViT-H-14, ViT-L-14, ViT-B-16, ViT-SO400M-14-SigLIP-384,' and 'Qwen-Max' for judging (Sec. 5.1). These are specific enough to identify unique model checkpoints."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The agent system prompts are described functionally ('RecipeMaster generates recipes...') but not provided as actual text. The meta-prompting template T(·,·), constructed defensive prompts, and optimized malicious commands (C') are described conceptually but their actual text is not shown."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Extensive hyperparameters reported in Sec. 5.1: visual perturbation budget ε=16, visual iterations=200, GCG top-k=256, batch_size=512, textual iterations=100, max_new_tokens=1024. Ablation studies systematically vary these."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": false,
         "justification": "The agents are described as having 'multiple steps, including multimodal data processing, API calls, logical reasoning, and response generation' (Sec. 5.1) but the actual scaffolding details — how external data is retrieved, how multi-step workflows are orchestrated, what APIs are called — are not provided."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Data preparation is documented: 100 entries randomly sampled per dataset (Sec. 5.1), malicious instructions embedded in local documents or webpage HTML with HTML5 tags and whitespace characters (Sec. 5.1), and the visual perturbation pipeline is described in Sec. 4.1."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A 'Limitations' subsection appears at the end of Section 8 (Conclusion and Future Work), identifying two areas: designing more effective defenses for multimodal settings and extending attack applicability to more complex architectures."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The limitations are future work directions rather than specific threats to validity of the current study. No mention of threats such as the small model sizes tested, the simplicity of the custom agents, the reliability of LLM-as-a-Judge, or the limited number of trials in the physical experiment."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. It does not bound claims to the specific models, agent types, or scale tested. The mention of 'extending to real-world agents with more complex architecture' implicitly acknowledges scope limits but does not state specific exclusions."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (individual trial results, generated adversarial images, optimized commands) is made available. Only aggregated ASR percentages are reported in tables."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Data sources are clearly identified: CoEDIT for text editing and SST2 for sentiment classification, with 100 entries randomly sampled from each (Sec. 5.1). The physical world setup with LIMO vehicle and manually constructed track is described in Sec. 6."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. Data comes from standard NLP benchmarks (CoEDIT, SST2)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from data collection to results is documented: sample 100 entries → embed malicious instructions in local documents or webpages → apply visual perturbation and textual optimization → feed to victim agent → evaluate via LLM-as-a-Judge → repeat 3 times and average."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding sources, grants, or sponsorships are mentioned anywhere in the paper. There is no acknowledgments section disclosing funding."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All author affiliations are clearly listed: Beihang University, National University of Singapore, Huazhong University of Science and Technology, and Henan University of Science and Technology. Authors are academic researchers not evaluating their own commercial products."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funding is disclosed, making independence assessment impossible. Appears to be unfunded academic research."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement appears in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a prompt injection attack method against multimodal agents, not model capability on benchmarks. Whether the models saw SST2 or CoEDIT during training does not affect whether the attack can hijack the agent. This is a red-teaming study testing attacks rather than model knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable — the study tests an attack framework's ability to hijack agent behavior, not model knowledge on benchmark tasks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable — this is an adversarial attack study where the success metric is whether the agent follows injected instructions, not whether it has memorized benchmark answers."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All experiments involve automated attacks against AI agents."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study involves adversarial attacks on AI systems only."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, wall-clock time per attack, or token consumption is reported. The attack involves 200 iterations of visual optimization and 100 iterations of GCG textual optimization per example, but the computational cost of this is not quantified."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'NVIDIA A800-SXM4-80GB GPU cluster' but provides no total GPU hours, training time, or compute budget for the experiments."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Experiments are repeated 3 times and averaged, but no across-run variation (std dev, range) is reported. The reader cannot assess seed sensitivity."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Sec. 5.1 explicitly states: 'each experiment was repeated three times, and the average results are reported.'"
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "While ablation studies test specific hyperparameter values (ε from 2 to 32, iterations from 50 to 150), no formal hyperparameter search budget or total configurations tried is reported. The selection of default values appears ad hoc."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Default configurations (ε=16, 100 iterations) are justified via ablation studies: ε=16 offers 'balance effectiveness and stealthiness' with diminishing returns beyond (Sec. 5.3), and 100 iterations reaches 'near-optimal performance' before convergence (Sec. 5.3)."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Numerous comparisons are made across 4 agent configurations, 2 attack surfaces, 2 tasks, and multiple ablation conditions without any correction for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement all baselines and their own method but do not acknowledge self-comparison bias. Baseline implementations are not validated against original authors' results."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "CrossInject requires 200 visual optimization iterations + 100 GCG textual iterations per attack, while baselines like Naive require no optimization. This compute disparity is not discussed or controlled for."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "ASR is measured by LLM-as-a-Judge (Qwen-Max) without discussing whether this judge reliably measures true attack success. No validation of judge accuracy against human annotations, and no discussion of potential judge biases."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "All attacks (CrossInject, Naive, JIP, FB) are tested on the same agent configurations with identical scaffolding, controlling for the scaffold confound. Differences are attributed to the attack method, not the scaffold."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the VLMs' training data includes CoEDIT or SST2 examples, or whether the models' ability to perform injected tasks is influenced by having seen these datasets during training."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For example, the malicious instruction format itself may signal task identity to the model."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 100 samples per dataset are randomly drawn but independence is not verified. No discussion of whether samples share structural properties that could inflate results."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are employed."
       }
     }
   },
   "claims": [
     {
       "claim": "CrossInject achieves at least +30.1% increase in attack success rates over state-of-the-art attacks across diverse tasks.",
       "evidence": "Tab. 1 shows +32.7% average ASR improvement for local document attacks and +27.5% for online webpage attacks (Sec. 5.2). However, the conclusion states '+26.4% increase,' contradicting the abstract's '+30.1% minimum.'",
       "supported": "weak"
     },
     {
       "claim": "Visual-only prompt injection (JIP) achieves 0% ASR against state-of-the-art multimodal agents.",
       "evidence": "Tab. 1 shows JIP achieves exactly 0.0% ASR across all 16 tested scenarios (2 agents × 2 VLMs × 2 tasks × 2 attack surfaces).",
       "supported": "strong"
     },
     {
       "claim": "Visual Latent Alignment contributes an average 18.7% improvement to attack performance.",
       "evidence": "Tab. 2 ablation study comparing full method vs. without visual alignment shows ASR drops of 28.0%, 16.7%, 6.0%, and 22.7% across four agent configurations (Sec. 5.3).",
       "supported": "moderate"
     },
     {
       "claim": "Textual Guidance Enhancement contributes an average 24.8% improvement to attack performance.",
       "evidence": "Tab. 3 ablation study shows ASR drops of 47.0%, 9.0%, 6.0%, and 14.0% when removing the textual enhancement component.",
       "supported": "moderate"
     },
     {
       "claim": "CrossInject is effective against real-world autonomous driving agents, achieving 9/10 attack success rate.",
       "evidence": "Sec. 6 describes a physical experiment with LIMO robot, where CrossInject caused the vehicle to collide with a stop sign in 9 out of 10 trials, compared to 4/10 for Naive attack.",
       "supported": "weak"
     },
     {
       "claim": "Existing defenses (sandwich prompting, Gaussian blur) are ineffective against CrossInject.",
       "evidence": "Tab. 5 shows textual defense reduces ASR by 6.7% on average, visual defense by 2.8%, and combined defense is not additive.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Inconsistent headline claim across sections",
       "detail": "The abstract claims 'at least +30.1% increase in ASR' but the conclusion states '+26.4% increase.' The online webpage results show only +27.5% average, below the claimed 30.1% minimum. This inconsistency suggests selective reporting of the headline number."
     },
     {
       "flag": "No variance reported despite repeated runs",
       "detail": "Experiments are repeated 3 times and averaged, but no standard deviation, error bars, or any spread measure is reported. This conceals result stability — the reader cannot assess whether the reported averages are reliable or driven by high-variance outlier runs."
     },
     {
       "flag": "Tiny physical experiment sample",
       "detail": "The real-world autonomous driving demonstration (Sec. 6) consists of only 10 trials on a single setup with a toy robot (LIMO) on a manually constructed track. This is insufficient to support claims about 'effectiveness in real-world multimodal autonomous agents.'"
     },
     {
       "flag": "Unvalidated LLM-as-a-Judge evaluation",
       "detail": "All ASR measurements rely on Qwen-Max as an automated judge, but no calibration study validates this judge's accuracy against human assessments. The judge model itself could be susceptible to the adversarial patterns being tested, introducing systematic measurement bias."
     },
     {
       "flag": "Only small-scale models tested",
       "detail": "Both victim VLMs are small (Qwen2-VL-2B, Phi-3.5-vision ~4B). No evaluation on larger, more capable models (GPT-4V, Gemini, Claude) that likely have stronger safety guardrails. The title's broad framing ('Multimodal Agents') overstates the tested scope."
     },
     {
       "flag": "Custom toy agents may not represent real deployments",
       "detail": "RecipeMaster and PoetryGenius are custom chatbot agents built for this study with unspecified system prompts and scaffolding. Their security posture may not reflect production-grade agent systems with hardened prompt architectures."
     }
   ],
   "cited_papers": [
     {
       "title": "Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection",
       "authors": ["S. Abdelnabi", "K. Greshake", "S. Mishra", "C. Endres", "T. Holz", "M. Fritz"],
       "year": 2023,
       "relevance": "Foundational work on indirect prompt injection against LLM-integrated applications via external data sources."
     },
     {
       "title": "Formalizing and Benchmarking Prompt Injection Attacks and Defenses",
       "authors": ["Y. Liu", "Y. Jia", "R. Geng", "J. Jia", "N.Z. Gong"],
       "year": 2024,
       "relevance": "Formal framework for prompt injection attacks and defenses; used as the FB baseline in this paper."
     },
     {
       "title": "Prompt Injection attack against LLM-integrated Applications",
       "authors": ["Y. Liu", "G. Deng", "Y. Li", "K. Wang", "T. Zhang", "Y. Liu", "H. Wang", "Y. Zheng", "Y. Liu"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Early work demonstrating delimiter-based prompt injection attacks against LLM-integrated applications."
     },
     {
       "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
       "authors": ["A. Zou", "Z. Wang", "N. Carlini", "M. Nasr", "J.Z. Kolter", "M. Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "GCG algorithm for adversarial suffix optimization, used as the core textual attack optimization method in CrossInject."
     },
     {
       "title": "Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models",
       "authors": ["E. Shayegani", "Y. Dong", "N.B. Abu-Ghazaleh"],
       "year": 2024,
       "relevance": "Visual modality-based jailbreak attacks on multimodal LLMs; used as the JIP baseline in this paper."
     },
     {
       "title": "Dissecting Adversarial Robustness of Multimodal LM Agents",
       "authors": ["C.H. Wu", "R. Shah", "J.Y. Koh", "R. Salakhutdinov", "D. Fried", "A. Raghunathan"],
       "year": 2024,
       "arxiv_id": "2406.12814",
       "relevance": "Analysis of adversarial robustness of multimodal LLM agents, directly related to security of multimodal agent systems."
     },
     {
       "title": "Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models",
       "authors": ["J. Yi", "Y. Xie", "B. Zhu", "E. Kiciman", "G. Sun", "X. Xie", "F. Wu"],
       "year": 2025,
       "arxiv_id": "2312.14197",
       "relevance": "Benchmark for indirect prompt injection defense evaluation on LLMs."
     },
     {
       "title": "Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Q. Zhan", "Z. Liang", "Z. Ying", "D. Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Benchmark for indirect prompt injection in tool-integrated LLM agents."
     },
     {
       "title": "Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs",
       "authors": ["E. Bagdasaryan", "T.-Y. Hsieh", "B. Nassi", "V. Shmatikov"],
       "year": 2023,
       "arxiv_id": "2307.10490",
       "relevance": "Demonstrates indirect instruction injection via visual and audio modalities in multimodal LLMs under white-box settings."
     },
     {
       "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions",
       "authors": ["E. Wallace", "K. Xiao", "R. Leike", "L. Weng", "J. Heidecke", "A. Beutel"],
       "year": 2024,
       "arxiv_id": "2406.09246",
       "relevance": "Proposes instruction hierarchy as a defense mechanism for LLMs against prompt injection."
     },
     {
       "title": "Automatic and Universal Prompt Injection Attacks against Large Language Modals",
       "authors": ["X. Liu", "Z. Yu", "Y. Zhang", "N. Zhang", "C. Xiao"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "GCG-based automatic prompt injection attacks against LLMs using adversarial suffixes."
     },
     {
       "title": "Optimization-based Prompt Injection Attack to LLM-as-a-Judge",
       "authors": ["J. Shi", "Z. Yuan", "Y. Liu", "Y. Huang", "P. Zhou", "L. Sun", "N.Z. Gong"],
       "year": 2024,
       "relevance": "Optimization-based attacks specifically targeting LLM-as-a-Judge systems, relevant to evaluation reliability."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Demonstrates a concrete attack vector against multimodal agents that security teams should be aware of, though the attack requires significant compute and surrogate model access."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The finding that visual-only injection achieves 0% ASR is somewhat surprising; the general cross-modal vulnerability is largely expected given known prompt injection risks."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates hijacking of an autonomous driving agent to ignore stop signs and collide with obstacles, directly raising safety concerns for physical-world AI deployments."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "No major controversy or direct challenge to specific companies or products; standard adversarial ML research framing."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code repository, demo, or tool is released; the attack cannot be tried without reimplementation."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "Authors are from Chinese academic institutions (Beihang, HUST, NUS) without major brand recognition in the AI safety space."
     }
   }
 }