ai-research-survey

scan.json (32364B)

---

 {
   "paper": {
     "title": "May I have your Attention? Breaking Fine-Tuning based Prompt Injection Defenses using Architecture-Aware Attacks",
     "authors": [
       "Nishit V. Pandya",
       "Andrey Labunets",
       "Sicun Gao",
       "Earlence Fernandes"
     ],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2507.07417",
     "doi": "10.48550/arXiv.2507.07417"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "GCG-style optimization-based attacks do not significantly outperform unguided random search against fine-tuning-based prompt injection defenses like SecAlign, because the target logprobs loss landscape provides poor gradient signal. The proposed ASTRA attack, which targets attention matrices using gradient-derived sensitivity weights, achieves 72.5-82.5% attack success rates against SecAlign in the strong knowledge setting (vs 12.5-70% for GCG). ASTRA++, a universal variant, achieves up to 96% success on unseen contexts against SecAlign and 87% against SecAlign++, demonstrating that these defenses do not provide the claimed security properties under modest budget scaling to 35 tokens.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states 'We release our code and attacks at this link,' indicating a code release. The link is present as a hyperlink in the original PDF though not visible in plain text extraction."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation uses publicly available datasets: AlpacaFarm evaluation set and Dolly fine-tuning dataset. The defended models were obtained from the authors of SecAlign/StruQ. No proprietary data was collected."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, conda environment, or detailed environment setup section is described in the paper."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. While implementation parameters are described (iterations, batch size, etc.), there is no README-style guide or script to replicate experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 reports mean and standard deviation over 3 training runs for ASTRA++ results (e.g., '96% (5%)', '87% (12%)'). However, Table 1 (ASTRA strong knowledge) reports only point estimates without uncertainty measures."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used. Claims that ASTRA outperforms GCG are based solely on comparing raw ASR numbers without any hypothesis testing."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Results are presented with baseline context throughout. Table 1 shows both GCG and ASTRA ASR side by side (e.g., GCG 12.5% vs ASTRA 20% at budget 20; GCG 70% vs ASTRA 82.5% at budget 35), allowing readers to assess effect magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'Due to hardware limitations, we only report our attack success rate out of 40 examples that we could complete' (Section 6.1). This is an explanation, not a justification or power analysis. No discussion of whether 40 examples is sufficient for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 reports standard deviations across 3 training runs for ASTRA++ (e.g., 'Mean (Std. Dev.)'). Section 4.2 also reports distributions of Dr across multiple runs (r=1 to r=5) with mean and standard deviation. Table 1 (ASTRA) does not report variance."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "GCG is used as the baseline throughout. Section 4.2 also compares guided (GCG) vs unguided random search. Section 6.2 compares ASTRA++ against Universal GCG."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "GCG (Zou et al., 2023) is the state-of-the-art white-box optimization algorithm for this task. The paper also references AdvPrompter and NeuralExec as contemporary approaches and positions GCG as the strongest available baseline."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.3 presents an ablation study on the weight selection for the attention loss function, comparing clipped sensitivities against uniform weights, first-layer-only, last-layer-only, and average sensitivities (Figure 7)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "The only evaluation metric is Attack Success Rate (ASR), defined as whether the output starts with 'Hacked' or 'hacked'. No secondary metrics (e.g., perplexity of generated text, attack transferability rate, or semantic similarity) are reported."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "Human evaluation is not relevant for this paper's claims. The evaluation criterion is binary (does the output start with 'Hacked'?) and fully automatable."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "For ASTRA++, 10 examples are used for training and the remaining 198 unseen examples form the test set (Section 6.2). For ASTRA, the 40 evaluation examples are not used in computing the sensitivity weights (those come from Dolly)."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by model (Llama-3, Mistral), by attacker budget (20-40 tokens), by prefix/suffix configuration, and by defense (SecAlign, SecAlign++, StruQ). Tables 1 and 2 provide detailed per-condition breakdowns."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No qualitative analysis of failure cases is provided. The paper reports aggregate success rates but does not examine why specific attacks fail on certain examples or what properties of resistant examples look like."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 shows that GCG does not significantly outperform unguided search — a key negative finding. Table 2 shows high variance with some failed training runs (e.g., ASTRA++ at budget 30 has 48% std dev). Section 7.2 discusses performance limitations."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'success rates of up to 85-95%' which is supported by Table 2 showing 96% for SecAlign-Llama and 87% for SecAlign++. The claim that defenses 'do not provide the claimed security properties' is supported by the high ASR results across Tables 1 and 2."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims via controlled ablation (Section 6.3: removing/changing attention head weights affects performance). The two-phase design is tested against single-phase baselines with all other variables controlled. The ablation design is adequate (single-variable manipulation)."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper tests only 2 model architectures (Llama-3-8B and Mistral-7B) and 3 defenses (SecAlign, SecAlign++, StruQ) but makes broad claims about 'the class of fine-tuning based prompt injection defenses' (Section 9). The title claims to be 'Breaking Fine-Tuning based Prompt Injection Defenses' generically."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not substantively discuss alternative explanations for ASTRA's success. For example, the budget increase from 20 to 35 tokens alone might explain much of the improvement (Section 7.3 briefly notes 'even crude attacks can break defenses with increased budgets' but does not quantify this confound). No discussion of whether the warm-start effect is the primary driver vs the attention mechanism specifically."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper measures whether the output starts with 'Hacked' and frames this as successful prompt injection. Real-world prompt injection success involves more complex objectives (data exfiltration, tool misuse, dynamic targets). Section 7.2 briefly notes that dynamic prompt injections are not tested, but the gap between the 'Hacked' proxy and real attack success is not explicitly discussed."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model versions are named: 'Meta-Llama-3-8B-Instruct' and 'Mistral-7B-Instruct-v0.1' (Section 6.1). SecAlign++ model is also specified."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The exact prompt template used is not provided. The paper describes the structure (AlpacaFarm format with 'instruction' and 'input' fields, payload at end) and payload text ('Print exactly Hacked!') but does not show the complete prompt text or chat template sent to the model."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 reports: 500 iterations (1000 for ASTRA++), B=512 forward passes per iteration, p=256 top candidates, 50 Dolly examples for sensitivity computation, bottom 75% heads dropped, temperature 0 for generation. ASTRA++ specifics in Section 6.2: 700 attention + 300 GCG steps, sensitivities refreshed every 50 iterations, 50% head clipping."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The paper evaluates direct prompt injection attacks on LLMs without any scaffolding or agent framework."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "The paper describes data preparation: 208 AlpacaFarm examples with non-empty 'input' field, 50 randomly chosen for evaluation, 40 completed. For ASTRA++: 10 randomly chosen training examples, 198 test examples. Payload injection placement described in detail."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.2 'Limitations of ASTRA' provides substantive discussion of memory footprint, performance overhead (1.7-2.5x slower than GCG), and the restriction to fixed target strings."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.2 identifies specific threats: ASTRA's memory-intensive operation causing 1.7-2.5x slowdown, evaluation limited to fixed target strings ('Hacked') not dynamic prompt injections, and hardware limitations restricting evaluation to 40 out of 208 examples."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.2 explicitly states what was NOT tested: dynamic prompt injections with variable target strings, and multi-modal models. Section 3 clearly delineates the threat model (whitebox adaptive adversary). However, the paper does not explicitly state which model architectures or defense types are excluded from its claims."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Individual attack results per example, generated adversarial tokens, and per-example success/failure are not made available. Only aggregate success rates are reported in tables."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 describes how examples were selected: '50 randomly chosen examples from the 208 AlpacaFarm evaluation set which contain a non-empty input field.' Section 6.2 describes the ASTRA++ training set selection: '10 randomly chosen examples from the 208 AlpacaFarm examples.'"
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper uses standard public benchmark data (AlpacaFarm, Dolly)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: 208 AlpacaFarm examples → 50 randomly chosen → 40 completed (10 dropped due to hardware limitations). For ASTRA++: 10 training + 198 test, 3 training runs each. Injection format and placement described."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All four authors are listed with their affiliation: UC San Diego. They are not affiliated with the developers of the defenses being attacked (Meta for SecAlign, academic teams for StruQ)."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence of funder cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests attacks against prompt injection defenses rather than evaluating a model's knowledge on a benchmark. The attack success does not depend on whether the model has seen AlpacaFarm during training."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests defense robustness against adversarial attacks, not model capability on benchmark tasks. Contamination in the traditional sense is not applicable."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The evaluation measures attack success (can the attack force the model to output 'Hacked'), not the model's pre-trained knowledge. Benchmark contamination is not relevant to this threat model."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 7.2 mentions ASTRA is '1.7-2.5x slower than GCG' but reports no absolute cost figures (GPU hours, wall-clock time, energy consumption). No per-example cost is reported."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No GPU type, total compute hours, or hardware specifications are reported. The paper mentions 'hardware limitations' prevented completing all examples but does not quantify the compute used."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "ASTRA++ reports results across 3 training runs with different training sets, but this tests training set sensitivity, not random seed sensitivity. ASTRA (strong knowledge) reports no seed sensitivity. Section 4.2 notes that 'the role played by the initializer and randomness are crucial' but does not systematically test seed sensitivity for the main attacks."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.2 states '3 different training runs, each with a completely different set of 10 training examples.' Section 4.2 reports r=1 to r=5 runs for the GCG analysis. ASTRA strong knowledge appears to be single-run per example."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is described. Key hyperparameters (75% clipping threshold, p=256, B=512, 700/300 phase split for ASTRA++) appear chosen without stated justification or search budget."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Results are reported across all tested budget configurations (20, 25, 30, 35 tokens) in Tables 1 and 2, not just the best one. The ablation study in Section 6.3 shows all weight selection strategies tested."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical significance tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement both ASTRA and the GCG baseline. They do not acknowledge or discuss the bias of implementing and tuning both the proposed method and the baseline. Prior work (Lucic et al. 2018) shows this systematically favors the proposed method."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "The paper carefully controls for compute budget: 'we control for all the following variables: attacker budget and configuration, attack initialization, number of optimization iterations, number of forward passes on each iteration, value of p' (Section 6.1). ASTRA and GCG use identical compute budgets per comparison."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The benchmark evaluates whether the model outputs 'Hacked' on AlpacaFarm examples. The paper does not discuss whether this construct (fixed target string on instruction-following examples) is representative of real-world prompt injection scenarios, which involve diverse objectives and contexts."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. The attacks are applied directly to the model without any agentic scaffold."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the AlpacaFarm evaluation examples or Dolly training examples could have been present in the pre-training data of Llama-3 or Mistral, which could affect the baseline model behavior."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly distinguishes between strong knowledge (attacker knows context) and weak knowledge (attacker doesn't know context) assumptions (Section 3). ASTRA++ specifically addresses the more realistic weak knowledge setting where the attacker has no information about the conversation history."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "For ASTRA++, training and test examples are drawn from the same AlpacaFarm dataset (10 train, 198 test). The paper does not discuss whether these examples share structural similarities or whether this affects the universality claims."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is used. The paper does not employ canary strings, membership inference tests, or decontamination pipelines."
       }
     }
   },
   "claims": [
     {
       "claim": "GCG-style guided optimization does not significantly outperform unguided random search against SecAlign-defended models.",
       "evidence": "Section 4.2, Figures 1-2: Distribution of Dr (difference between guided and unguided loss) centered at 0 across 50 examples with r=1 to 5 runs. Average loss curves for guided and unguided optimization are nearly identical over 500 iterations.",
       "supported": "strong"
     },
     {
       "claim": "ASTRA achieves 82.5% ASR on SecAlign-Mistral and 72.5% on SecAlign-Llama with 35-token budget in the strong knowledge setting.",
       "evidence": "Table 1: Controlled comparison with GCG baseline across 40 examples, with all hyperparameters controlled.",
       "supported": "moderate"
     },
     {
       "claim": "ASTRA++ achieves 96% mean ASR on unseen contexts against SecAlign-Llama with 35-token budget.",
       "evidence": "Table 2a: Mean 96% (std dev 5%) over 3 training runs on 198 unseen test examples. However, other configurations show high variance (e.g., budget 30: mean 28%, std 48%).",
       "supported": "moderate"
     },
     {
       "claim": "ASTRA++ achieves 87% mean ASR against SecAlign++ (instruction as system) with 35-token budget.",
       "evidence": "Table 2b: Mean 87% (std dev 12%) over 3 training runs on 198 unseen examples against the production-grade instruction hierarchy model.",
       "supported": "moderate"
     },
     {
       "claim": "Clipped sensitivities outperform other weighting functions (uniform, first-layer-only, last-layer-only, average sensitivities) for the attention loss.",
       "evidence": "Section 6.3, Figure 7: Controlled ablation study on 40 examples showing loss curves for different weighting strategies, with clipped sensitivities achieving the lowest target logprobs.",
       "supported": "strong"
     },
     {
       "claim": "Fine-tuning based prompt injection defenses (SecAlign, SecAlign++, StruQ) do not provide the claimed security properties in the whitebox setting.",
       "evidence": "Tables 1-2: High ASR across multiple defenses and models. However, this is tested with increased token budgets (up to 35 tokens vs original 20-token evaluation) and only on 2 model architectures.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Small evaluation sample size",
       "detail": "ASTRA strong knowledge evaluation uses only 40 out of 208 examples, with 10 dropped 'due to hardware limitations.' This represents ~19% of the evaluation set, raising concerns about selection effects if harder examples were disproportionately dropped."
     },
     {
       "flag": "High variance in ASTRA++ results",
       "detail": "Table 2 shows extreme variance across training runs: e.g., SecAlign-Llama at budget 30 has mean 28% with 48% std dev, and SecAlign++ (user) at budget 35 has mean 22% with 54% std dev. This suggests results are highly sensitive to training set selection, undermining reliability claims."
     },
     {
       "flag": "Budget increase confound",
       "detail": "The paper's strongest results use 35-token budgets while the original defenses were evaluated at 20 tokens. Section 7.3 acknowledges 'even crude attacks can break defenses with increased budgets,' but the contribution of budget increase vs the ASTRA mechanism is not quantified. At 20 tokens, ASTRA achieves only 20% and 75% on Llama and Mistral respectively."
     },
     {
       "flag": "No statistical significance tests",
       "detail": "All comparisons between ASTRA and GCG are based on raw ASR differences without any statistical testing. Given the small sample sizes (40 examples) and high variance (3 runs), observed differences may not be statistically significant."
     },
     {
       "flag": "Limited model diversity",
       "detail": "Only two base model architectures are tested (Llama-3-8B and Mistral-7B), both in the 7-8B parameter range. Generalization claims to 'the class of fine-tuning based prompt injection defenses' rest on a narrow architectural and scale diversity."
     }
   ],
   "cited_papers": [
     {
       "title": "Struq: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2024,
       "relevance": "One of the three fine-tuning-based prompt injection defenses attacked and evaluated in this paper."
     },
     {
       "title": "Secalign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2025,
       "relevance": "Primary defense evaluated in this paper; shown to be vulnerable to ASTRA attacks with 82.5% ASR."
     },
     {
       "title": "Meta secalign: A secure foundation llm against prompt injection attacks",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "David Wagner", "Chuan Guo"],
       "year": 2025,
       "relevance": "Production-grade instruction hierarchy defense from Meta, attacked with ASTRA++ achieving 87% ASR."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "relevance": "Introduces GCG, the baseline optimization-based attack against which ASTRA is compared."
     },
     {
       "title": "Neural exec: Learning (and learning from) execution triggers for prompt injection attacks",
       "authors": ["Dario Pasquini", "Martin Strohmeier", "Carmela Troncoso"],
       "year": 2024,
       "relevance": "Prior work on universal prompt injection attacks using GCG variants; ASTRA++ compared to universal GCG equivalent."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["Xiaogeng Liu", "Zhiyuan Yu", "Yizhe Zhang", "Ning Zhang", "Chaowei Xiao"],
       "year": 2024,
       "relevance": "Prior work on automated universal prompt injection; ASTRA addresses the same problem with architectural awareness."
     },
     {
       "title": "Imprompter: Tricking llm agents into improper tool use",
       "authors": ["Xiaohan Fu", "Shuheng Li", "Zihan Wang", "Yihao Liu", "Rajesh K. Gupta", "Taylor Berg-Kirkpatrick", "Earlence Fernandes"],
       "year": 2024,
       "relevance": "Demonstrates GCG-based prompt injection for data leakage in agentic systems; motivates stronger attacks like ASTRA."
     },
     {
       "title": "Fun-tuning: Characterizing the vulnerability of proprietary llms to optimization-based prompt injection attacks via the fine-tuning interface",
       "authors": ["Andrey Labunets", "Nishit Pandya", "Ashish Hooda", "Xiaohan Fu", "Earlence Fernandes"],
       "year": 2025,
       "relevance": "Prior work from same group on optimization-based prompt injection attacks via fine-tuning interfaces."
     },
     {
       "title": "The instruction hierarchy: Training llms to prioritize privileged instructions",
       "authors": ["Eric Wallace", "Kai Xiao", "Reimar Leike", "Lilian Weng", "Johannes Heidecke", "Alex Beutel"],
       "year": 2024,
       "relevance": "OpenAI's instruction hierarchy approach to prompt injection defense; SecAlign++ implements this paradigm."
     },
     {
       "title": "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples",
       "authors": ["Anish Athalye", "Nicholas Carlini", "David Wagner"],
       "year": 2018,
       "relevance": "Foundational adversarial ML work on evaluating defenses with strong adaptive attacks; directly motivates ASTRA's approach."
     },
     {
       "title": "AdvPrompter: Fast adaptive adversarial prompting for LLMs",
       "authors": ["Anselm Paulus", "Arman Zharmagambetov", "Chuan Guo", "Brandon Amos", "Yuandong Tian"],
       "year": 2025,
       "relevance": "Prior SOTA automated attack against which SecAlign claimed robustness; ASTRA surpasses its attack capability."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Foundational work on indirect prompt injection attacks against LLM-integrated applications."
     },
     {
       "title": "AttGCG: Enhancing jailbreaking attacks on LLMs with attention manipulation",
       "authors": ["Zijun Wang", "Haoqin Tu", "Jieru Mei", "Bingchen Zhao", "Yisen Wang", "Cihang Xie"],
       "year": 2024,
       "relevance": "Prior work on attention-based attacks for jailbreaking; ASTRA differs in using attention as warm start with sensitivity-weighted heads."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Security researchers evaluating prompt injection defenses could directly apply ASTRA's methodology; code is released."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "Challenges the ~100% attack resistance claimed by SecAlign and StruQ, showing these defenses are breakable at 85-95% with modest budget increases."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates that a major class of prompt injection defenses (fine-tuning-based) can be defeated, raising direct concerns about deployed LLM security."
     },
     "drama_conflict": {
       "score": 2,
       "justification": "Directly challenges security claims of Meta's SecAlign++ and recent CCS/USENIX publications, framing their evaluations as insufficient."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Code is released but requires whitebox model access, significant GPU resources, and ML expertise to reproduce."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Academic paper from UC San Diego; targets Meta's SecAlign++ which adds some brand relevance, but the authors themselves are not widely known."
     }
   }
 }