ai-research-survey

scan.json (31604B)

---

 {
   "paper": {
     "title": "MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents",
     "authors": [
       "Kaijie Zhu",
       "Xianjun Yang",
       "Jindong Wang",
       "Wenbo Guo",
       "William Wang"
     ],
     "year": 2025,
     "venue": "International Conference on Machine Learning",
     "arxiv_id": "2502.05174"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "MELON detects indirect prompt injection attacks by comparing agent tool calls between an original execution and a masked re-execution where the user prompt is replaced with a task-neutral prompt. On the AgentDojo benchmark across GPT-4o, o3-mini, and Llama-3.3-70B, MELON-Aug achieves 0.32% attack success rate while maintaining 68.72% utility on GPT-4o, outperforming five baseline defenses. Ablation studies confirm each design component (customized masking function, tool call cache, focused tool call comparison) contributes to performance, and the method shows insensitivity to hyperparameter choices.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states 'Code is available at https://github.com/kaijiezhu11/MELON' and provides a working URL."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation uses the publicly available AgentDojo benchmark (Debenedetti et al., 2024), which is an open framework. No proprietary data was collected."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, conda environment file, or detailed dependency specifications are mentioned in the paper."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. The GitHub link is given but the paper itself contains no commands or reproduction guide."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1-4 and Figures 1, 3 report only point estimates (e.g., '0.32% ASR', '68.72% UA') with no confidence intervals, error bars, or uncertainty measures."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "Claims like 'MELON outperforms SOTA defenses' and 'significantly outperforms five SOTA defenses' are based solely on comparing point estimates in Table 1. No statistical significance tests (p-values, t-tests, etc.) are reported."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Absolute performance numbers are reported for all methods with baseline context. For example, 'MELON-Aug achieves 68.72% UA with 0.32% ASR, compared to the no defense baseline (69.08% UA, 16.06% ASR)' (Section 4.2). Tables provide full breakdowns enabling comparison."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The evaluation uses 629 attack cases and 97 benign tasks from AgentDojo, but no justification is given for why this sample size is sufficient for the claims being made, nor is a power analysis discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Temperature is set to 0 for all models to 'avoid randomness' (Section 4.1), but the paper reports single-run numbers with no variance, standard deviation, or spread measures across multiple runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Five baseline defenses are compared: DeBERTa Detector, LLM Detector, Delimiting, Repeat Prompt, and Tool Filter (Section 4.1, Table 1)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include recent works: AgentDojo tool filter (2024), ProtectAI DeBERTa detector (2024), spotlighting/delimiting (Hines et al., 2024), and repeat prompt (2023). These represent the current state of the art."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 conducts a systematic ablation study removing each of the three key designs: the masking function (Basic), tool call cache (No Cache), and focused comparison (Full Comp.). Results in Table 2 show each component's contribution."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three evaluation metrics are used: Utility under Attack (UA), Attack Success Rate (ASR), and Benign Utility (BU), as defined in Section 4.1."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "Evaluation is entirely automated through the AgentDojo benchmark. No human evaluation of the defense's outputs or decisions is conducted."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "All evaluations, including hyperparameter sensitivity analysis for θ (Table 4) and masking prompt variations (Table 3), are conducted on the same AgentDojo dataset. No separate validation set is used for tuning vs. testing."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 provides breakdowns by attack type (Direct, Ignore Previous, System Message, Important Messages), by model (GPT-4o, o3-mini, Llama-3.3-70B), and by agent type for false positive analysis (banking, slack, travel, workspace in Appendix E)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.5 analyzes 66 attack success cases identifying four failure patterns: Response-Based Attacks (72.73%), Tool Call Redundancy (15.15%), State Hallucination (6.06%), and Function Hallucination (6.06%)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.4 reports MELON's 9.28% false positive rate. Section 4.2 acknowledges BU decreases for MELON in some cases. Table 2 shows the basic masking approach (without their improvements) has higher ASR. Section 4.5 reports 66 failure cases."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims MELON 'outperforms SOTA defenses in both attack prevention and utility preservation' which is supported by Table 1 and Figure 1 showing lowest average ASR (0.24% for MELON, 0.32% for MELON-Aug on GPT-4o) with competitive UA."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims about component contributions ('each component is essential for effective detection') are justified through the ablation study in Table 2, which uses controlled single-variable removal of each design component."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Provable Defense Against Indirect Prompt Injection Attacks in AI Agents' — an unbounded generalization. Results are limited to one benchmark (AgentDojo), 3 models, and 4 general attack types. The paper does not bound claims to these settings. The theoretical 'provable' guarantee (Section 3.4) relies on assumptions (µB < θ < µV) not empirically verified."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not consider alternative explanations for MELON's success, such as whether AgentDojo's attack patterns are inherently amenable to masking-based detection, or whether the results would hold under more sophisticated adaptive attacks beyond the four general attack types tested."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The metrics (UA, ASR, BU) directly measure what is claimed: attack prevention (ASR), utility maintenance under attack (UA), and normal utility (BU). No proxy gap exists between measurements and claims."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses 'GPT-4o', 'o3-mini', and 'Llama-3.3-70B' without specifying API snapshot dates, version identifiers, or model release dates. Per the schema, marketing names like 'GPT-4o' without a snapshot date do not count."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.1 provides the complete task-neutral prompt Tf. Appendix A.2 provides full few-shot examples. Appendix C shows complete attack prompts and defense prompts. The LLM Detector prompt is given in Appendix C.2.2."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Temperature set to 0 for all models (Section 4.1). Similarity threshold θ=0.8 (Section 3.3.1). OpenAI text-embedding-v3 model specified for embeddings. Sensitivity tests on θ from 0.5 to 0.9 (Table 4)."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.1 formally defines the agent architecture (states, actions, tool calls). Section 3.2-3.3 detail the MELON detection pipeline with Algorithm 1 providing pseudocode. Figure 2 shows the detection pipeline architecture."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 documents AgentDojo's structure: 4 agent types with 16, 21, 20, 40 user tasks respectively, 629 attack cases formed by pairing user tasks with attack tasks. The tool call transformation for comparison is detailed in Appendix A.3."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.5 ('Analysis of Attack Success Cases') provides substantive discussion of where MELON fails, identifying four specific failure patterns with percentages. Section 5 discusses future work addressing current limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.5 identifies four specific failure patterns: Response-Based Attacks (72.73% of failures), Tool Call Redundancy (15.15%), State Hallucination (6.06%), Function Hallucination (6.06%). These are specific to this defense mechanism."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do not show. It doesn't acknowledge that results are limited to AgentDojo's specific task domains, that only four general attack types were tested, or that adaptive attacks designed specifically against MELON were not evaluated. The 'Provable' claim in the title suggests broader applicability than demonstrated."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Only aggregate metrics (ASR, UA, BU percentages) are reported in tables. Individual per-task or per-case results are not available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes the AgentDojo benchmark composition: 97 user tasks across 4 agent types, 629 attack cases, 4 attack methods, and 3 LLMs. The benchmark's construction is cited from Debenedetti et al. (2024)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The evaluation uses a standard benchmark (AgentDojo)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation pipeline is clearly documented: AgentDojo provides user tasks and attack tasks → attacks inject malicious content into tool outputs → defense methods are applied → metrics (UA, ASR, BU) are computed per AgentDojo's definitions. Algorithm 1 details the detection procedure."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgements section states: 'This research was funded in part by ARL Grant W911NF-23-2-0137 and the Microsoft Accelerating Foundation Models Research (AFMR) grant program. We thank FAR AI, OpenAI, and Berkeley RDI for their support.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: University of California, Santa Barbara (Zhu, Yang, Guo, Wang) and William & Mary (Wang)."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "The paper thanks OpenAI for support and heavily evaluates OpenAI models (GPT-4o, o3-mini) and uses OpenAI's embedding API. Microsoft (funder) is OpenAI's primary investor. Both have financial interest in demonstrating that LLM agents can be effectively defended against attacks."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial interests declaration is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates a defense mechanism (MELON) rather than model knowledge. The benchmark (AgentDojo) tests defense effectiveness, not model capability. Per schema guidance, studies that test defenses/tools rather than model knowledge are NA."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense method, not model knowledge on a benchmark. The primary evaluation compares defense strategies while holding the model constant."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense method, not model knowledge on a benchmark. Contamination of model training data does not affect the relative comparison of defense methods."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. Evaluation is entirely automated on the AgentDojo benchmark."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.3.1 states 'the introduction of the masking run effectively doubles the number of required model calls. This results in a ≈2× increase in API costs compared to the undefended baseline system.' The latency overhead from embedding computation is also discussed."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. The paper does not report total API spend, number of tokens consumed, GPU hours, or total cost for running the experiments across 3 models × 8 defenses × 629 attack cases."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Temperature is set to 0 for all models to avoid randomness (Section 4.1), but no seed sensitivity analysis is performed. API-based models may still exhibit non-determinism even at temperature 0, and this is not explored."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not state how many experimental runs produced the reported results. Setting temperature to 0 implies single runs, but this is not explicitly stated."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "The primary threshold θ=0.8 is used without stating how it was selected. The sensitivity test in Table 4 tests 5 values (0.5-0.9) but this is post-hoc analysis on the test data, not a proper search budget report."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The threshold θ=0.8 is stated as the primary value to 'balance detection sensitivity and false positive rate' (Section 3.3.1), but the selection process is not described. The sensitivity analysis in Table 4 is performed on the same test data used for final evaluation."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Multiple comparisons are made across 4 attack types × 3 models × 8 defense methods without any correction for multiple comparisons (Bonferroni, etc.)."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement and evaluate their own system against baselines they also implemented (e.g., LLM Detector, DeBERTa Detector). There is no acknowledgment of self-comparison bias per Lucic et al. (2018)."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "MELON uses approximately 2x compute vs baselines, but performance is not plotted or analyzed as a function of compute budget. Defenses like tool filter or prompt augmentation use much less compute but are compared directly without normalizing for compute."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper chooses AgentDojo because it is 'the latest one containing many diverse attack cases' (Section 4.1) but does not discuss whether AgentDojo's simulated environments adequately represent real-world IPI attack scenarios."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The defense mechanism IS the scaffold being tested. MELON modifies the agent's execution pipeline, and the comparison is between different defense scaffolds applied to the same base agent. The scaffold is the independent variable."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AgentDojo tasks or their solutions existed before the models' training cutoffs. If models were trained on similar task patterns, evaluation results may be inflated."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the AgentDojo evaluation setup leaks information to the models. The paper does not analyze whether task descriptions or tool schemas provide hints about expected solutions."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 629 attack cases share user tasks across attack types (e.g., the same user task paired with different attacks). Non-independence of these test cases is not discussed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is applied. No canary strings, membership inference, or decontamination is discussed."
       }
     }
   },
   "claims": [
     {
       "claim": "MELON and MELON-Aug achieve the lowest attack success rate while maintaining high utility, outperforming all baseline defense methods.",
       "evidence": "Table 1 shows MELON achieves 0.24% average ASR on GPT-4o with 58.78% UA, and MELON-Aug achieves 0.32% ASR with 68.72% UA, compared to the best baseline (Tool Filter at 2.34% ASR, 65.54% UA). Figure 1 and Figure 3 visualize the trade-off.",
       "supported": "strong"
     },
     {
       "claim": "MELON-Aug reduces ASR to 0.32% while maintaining 68.72% utility on GPT-4o.",
       "evidence": "Table 1, GPT-4o row for MELON-Aug shows averaged UA=68.72% and ASR=0.32%. This compares favorably to no-defense baseline of 69.08% UA and 16.06% ASR.",
       "supported": "strong"
     },
     {
       "claim": "Each of the three key design components (customized masking function, tool call cache, focused tool call comparison) is essential for effective detection.",
       "evidence": "Table 2 ablation study shows removing any component increases ASR: Basic (no Tf) 2.70% vs 0.95%, No Cache 1.75% vs 0.95%, Full Comp. 17.33% vs 0.95%. All variants perform worse than the full MELON.",
       "supported": "strong"
     },
     {
       "claim": "MELON's performance is insensitive to key hyperparameters (task-neutral prompt formulation and similarity threshold).",
       "evidence": "Table 3 shows ASR ranges from 0.95% to 1.43% across 5 prompt variants. Table 4 shows ASR is 0.95% for thresholds 0.5, 0.7, 0.8, and 0.9, and 1.11% for 0.6. Only tested on GPT-4o with Important Messages attack.",
       "supported": "moderate"
     },
     {
       "claim": "Error rates of the ensemble detector decrease exponentially with the number of weak detectors.",
       "evidence": "Section 3.4 provides a theoretical proof using Hoeffding's inequality, showing error bounds of exp(-2n(θ-µB)²) for false positives and exp(-2n(µV-θ)²) for false negatives. However, this applies to the ensemble variant, not the single-detector MELON actually evaluated in experiments.",
       "supported": "weak"
     },
     {
       "claim": "MELON's false positive detections all represent legitimate security concerns rather than detection errors.",
       "evidence": "Section 4.4 reports 9 false positives for GPT-4o (9.28% FPR). The authors examined all cases and found they involve user tasks that request execution of unverified external instructions. Three examples are shown in Appendix E.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Misleading 'Provable' claim in title",
       "detail": "The title claims 'Provable Defense' but the theoretical guarantee (Section 3.4) applies to an ensemble of n detectors, not the single-detector MELON evaluated in experiments. The bounds require µB < θ < µV which is assumed but never empirically verified. The evaluated system and the 'provable' system are different methods."
     },
     {
       "flag": "No held-out validation set",
       "detail": "Hyperparameter selection (θ=0.8) and all sensitivity analyses (Tables 3, 4) are performed on the same AgentDojo test data used for final evaluation. This conflates model selection with model evaluation."
     },
     {
       "flag": "No statistical testing despite comparative claims",
       "detail": "The paper claims MELON 'significantly outperforms' baselines but provides no significance tests, confidence intervals, or error bars. With temperature=0 single-run evaluation, there is no way to assess result stability."
     },
     {
       "flag": "Funder conflict of interest",
       "detail": "The paper thanks OpenAI for support and is funded by Microsoft (OpenAI's primary investor). The evaluation heavily features OpenAI models (GPT-4o, o3-mini) and uses OpenAI's embedding API. Both entities benefit from research showing LLM agents can be defended."
     },
     {
       "flag": "Limited attack diversity",
       "detail": "Only four general prompt injection attack types are tested, all from the same AgentDojo benchmark. No adaptive attacks specifically designed to evade MELON are considered. The paper acknowledges excluding agent-specific attacks due to low efficacy, but this limits generalizability claims."
     }
   ],
   "cited_papers": [
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "Primary benchmark used for evaluation; defines the IPI attack/defense evaluation framework for LLM agents."
     },
     {
       "title": "StruQ: Defending Against Prompt Injection with Structured Queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Proposes adversarial training defense against prompt injection in LLMs, representing the training-based defense category."
     },
     {
       "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions",
       "authors": ["Eric Wallace", "Kai Xiao", "Reimar Leike", "Lilian Weng", "Johannes Heidecke", "Alex Beutel"],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Proposes training-based defense that teaches LLMs to prioritize system instructions over injected ones."
     },
     {
       "title": "Adversarial Attacks on Multimodal Agents",
       "authors": ["Chejian Xu", "Jiawei Koh", "Ruslan Salakhutdinov", "Daniel Fried", "Aditi Raghunathan"],
       "year": 2024,
       "arxiv_id": "2406.12814",
       "relevance": "Evaluates adversarial attacks on multimodal web agents including indirect prompt injection via images."
     },
     {
       "title": "Defending Against Indirect Prompt Injection Attacks With Spotlighting",
       "authors": ["Keegan Hines", "Gary Lopez", "Matthew Hall", "Federico Zarfati", "Yonatan Zunger", "Emre Kiciman"],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Proposes delimiter-based prompt augmentation defense against indirect prompt injection."
     },
     {
       "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "doi": "10.18653/v1/2024.findings-acl.624",
       "relevance": "Benchmark for evaluating indirect prompt injection attacks in tool-integrated LLM agents."
     },
     {
       "title": "Identifying the Risks of LM Agents with an LM-Emulated Sandbox",
       "authors": ["Yangjun Ruan", "Honghua Dong", "Andrew Wang", "Silviu Pitis", "Yongchao Zhou", "Jimmy Ba", "Yoav Dubois", "Chris J. Maddison", "Tatsunori Hashimoto"],
       "year": 2024,
       "relevance": "Proposes sandbox-based approach for identifying risks in LLM agents, relevant to agent safety evaluation."
     },
     {
       "title": "The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents",
       "authors": ["Feiran Jia", "Tong Wu", "Xinle Qin", "Anna Squicciarini"],
       "year": 2024,
       "arxiv_id": "2412.16682",
       "relevance": "Proposes alignment-check defense against IPI in LLM agents, conceptually similar to MELON's approach of verifying tool call alignment."
     },
     {
       "title": "Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents",
       "authors": ["Hanrong Zhang", "Jingyuan Huang", "Kai Mei", "Yifei Yao", "Zhenting Wang", "Chenlu Zhan", "Hongwei Wang", "Yongfeng Zhang"],
       "year": 2024,
       "arxiv_id": "2410.02644",
       "relevance": "Benchmark for formalizing attacks and defenses in LLM-based agents, directly relevant to agent security evaluation."
     },
     {
       "title": "Aligning LLMs to be Robust Against Prompt Injection",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "Chuan Guo"],
       "year": 2024,
       "arxiv_id": "2410.05451",
       "relevance": "Proposes alignment-based training defense against prompt injection attacks."
     },
     {
       "title": "A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-Based Systems",
       "authors": ["Fangzhou Wu", "Ning Zhang", "Somesh Jha", "Patrick McDaniel", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2402.18649",
       "relevance": "Surveys security concerns in real-world LLM-based systems including prompt injection."
     },
     {
       "title": "IsolateGPT: An Execution Isolation Architecture for LLM-Based Systems",
       "authors": ["Yuhao Wu", "Franziska Roesner", "Tadayoshi Kohno", "Ning Zhang", "Umar Iqbal"],
       "year": 2025,
       "relevance": "Proposes execution isolation defense for LLM systems, alternative architectural approach to defending against prompt injection."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Defense method applicable to production LLM agents with code released, but requires 2x compute overhead and integration with agent framework."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Novel masking-based detection approach is technically interesting but doesn't challenge widely-held beliefs about AI safety."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Directly demonstrates and defends against prompt injection attacks that can redirect AI agents to perform unauthorized actions like sending money or leaking data."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "Standard academic defense paper with no controversy, no claims of broken systems or dishonest benchmarks."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code available on GitHub (https://github.com/kaijiezhu11/MELON), though requires API keys and AgentDojo setup to reproduce."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Authors from UCSB and William & Mary, published at ICML. OpenAI support acknowledged but not an OpenAI paper."
     }
   }
 }