ai-research-survey

scan.json (31992B)

---

 {
   "paper": {
     "title": "Mitigating Indirect Prompt Injection via Instruction-Following Intent Analysis",
     "authors": [
       "Mintong Kang",
       "Chong Xiang",
       "Sanjay Kariyappa",
       "Chaowei Xiao",
       "Bo Li",
       "Edward Suh"
     ],
     "year": 2025,
     "venue": "arXiv preprint",
     "arxiv_id": "2512.00966",
     "doi": "10.48550/arXiv.2512.00966"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "IntentGuard, a defense framework that uses instruction-following intent analysis to detect and mitigate indirect prompt injection, achieves zero false positives on benign inputs while reducing attack success rates by over 90% under strong adaptive attacks (e.g., 100% to 8.5% on Mind2Web with PAIR attacks and Qwen3-32B). The approach works by extracting the LLM's intended instructions via 'thinking intervention' strategies on reasoning-enabled models, then tracing each instruction's origin to flag those from untrusted data segments. The defense consistently outperforms training-free baselines (SEP Defense, PromptArmor) across two benchmarks and two models.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, code archive, or link to source code is provided anywhere in the paper. No mention of code release plans."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available benchmarks: AgentDojo (Debenedetti et al., 2024) and Mind2Web (Deng et al., 2023) with AdvAgent (Xu et al., 2024). Both are standard public datasets."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications, requirements.txt, Dockerfile, or dependency listings are provided. The paper mentions model names but no runtime environment details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. While the method is described algorithmically and prompts are given in the appendix, there are no concrete reproduction steps."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Tables 1 and 2 report only point estimates (e.g., Utility 0.773, ASR 0.468) with no confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims IntentGuard outperforms baselines across multiple settings but provides no statistical significance tests (no p-values, t-tests, or bootstrap tests). Comparisons are based solely on comparing point estimates."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper consistently reports both baseline and treated values, enabling effect size assessment: 'ASR drops from 100.0% (vanilla) to 8.5% (IntentGuard)' and 'from 72.6% to 10.9%' with full comparison tables showing absolute values for all methods."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for benchmark sizes (97 tasks/629 adversarial cases for AgentDojo; 440 tasks for Mind2Web). These are standard benchmarks used as-is, but no power analysis or sample size rationale is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported across experimental runs. All results appear to be single-run numbers."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Three baselines are compared: (i) Vanilla (unprotected model), (ii) SEP Defense (Zverev et al., 2024), and (iii) PromptArmor (Shi et al., 2025). Results for all methods are shown in Tables 1 and 2."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "SEP Defense (2024) and PromptArmor (2025) are recent, representative training-free defenses. The paper notes these 'are representative training-free defenses and thus enable fair comparison with IntentGuard' (Section 4.1)."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Figure 3a ablates thinking intervention components (system prompt only, +start-of-thinking, +end-of-thinking, +both). Figure 3b ablates in-context demonstration strategies (format specification, conflict reasoning, adversarial reasoning). Table 3 compares sparse vs. dense embeddings."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three metrics are reported: Utility (task performance), ASR (attack success rate), and FPR (false positive rate). Tables 1-2 report all three."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is included. All evaluation is automated through the AgentDojo and Mind2Web benchmark frameworks."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Results are reported on established benchmark test sets: AgentDojo's 629 adversarial test cases and Mind2Web's 440 tasks. These benchmarks have predefined evaluation protocols."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by attack type (Template, Beam Search, GCG, PAIR) across both benchmarks and both models in Tables 1-2. Ablation studies provide additional breakdowns by component configuration."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Figure 4 presents a confusion matrix analyzing IIA faithfulness, identifying 10.9% truly unfaithful cases and 5.3% where the model intends to follow but fails to execute correctly. The paper also discusses a single case of utility degradation (Mind2Web, Qwen3-32B: 0.840→0.810)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports utility degradation in one setting (Mind2Web with Qwen3-32B, 0.840→0.810) and shows in Figure 3a that individual thinking interventions alone are less effective than their combination. The IIA faithfulness analysis reveals 10.9% unfaithful predictions."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of (1) 'no utility degradation in all but one setting' and (2) 'reducing attack success rates from 100% to 8.5%' are directly supported by Tables 1-2. The Mind2Web Qwen3-32B PAIR row confirms ASR drops from 100.0% to 8.5%, and utility matches vanilla in all but one cell."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims ('IntentGuard achieves...', 'reducing ASR') are supported by controlled comparisons holding model and benchmark constant while varying the defense method. Ablation studies in Figure 3 isolate the contribution of individual components through controlled single-variable manipulation."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The abstract explicitly bounds results: 'on two agentic benchmarks (AgentDojo and Mind2Web) using two reasoning-enabled LLMs (Qwen-3-32B and gpt-oss-20B).' The title describes the method without claiming universal applicability."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for observed results. Section 5 discusses future directions but does not consider confounds such as whether the results are specific to reasoning-enabled models, whether the thinking intervention simply adds noise that disrupts attacks, or whether benchmark-specific artifacts drive the results."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures ASR (attack success rate) and Utility directly on the benchmarks. These metrics directly match the claims being made about defense effectiveness and task performance. No proxy gap exists between measurement and framing."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific models are identified: 'Qwen3-32B (Yang et al., 2025)' and 'gpt-oss-20B (Agarwal et al., 2025)' with references to their respective technical reports/model cards. These are specific model identifiers with family, version, and size."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt text is provided in Appendix A for all three thinking intervention strategies (start-of-thinking prefilling, end-of-thinking intervention, adversarial in-context demonstration). The PAIR attack prompt is also provided in full in Appendix B."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "Origin Tracing hyperparameters are reported (sliding window size 1/2, stride 1/8, alert threshold 0.7, token set ratio metric). However, LLM inference hyperparameters (temperature, top-p, max tokens, sampling strategy) are not stated for either model."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "IntentGuard's three-step pipeline is described in detail: (1) Intent Extraction via thinking intervention (Section 3.4, Figure 2), (2) Origin Tracing via sliding-window embedding matching (Section 3.3), (3) Injection Mitigation with alert and recovery modes. The full workflow is illustrated in Figure 1."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "No documentation of how the benchmark data was preprocessed before evaluation. The paper describes the benchmarks at a high level (Section 4.1) but does not detail how inputs were formatted, how injections were integrated, or other preprocessing steps."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "Section 5 ('Discussion') discusses future research directions (training to enhance IntentGuard, alternative IIA designs, broader IIA applications) but is framed as future work rather than a substantive limitations section. There is no dedicated limitations or threats-to-validity section."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No specific threats to validity are discussed. Section 5 identifies opportunities for improvement but does not address threats such as generalization beyond reasoning-enabled models, sensitivity to prompt formatting, or potential overfitting of the evaluation to specific attack implementations."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "While Section 3.1 states the focus on indirect prompt injection and footnote 1 acknowledges a limitation regarding legitimate instruction-following tasks, the paper does not systematically state what the results do NOT show (e.g., applicability to non-reasoning models, real-world deployment scenarios, other attack types)."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (model outputs, per-example results, attack logs) is released for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Data sources are described: 'AgentDojo (Debenedetti et al., 2024) which provides 97 realistic multi-step tasks across four simulated environments and 629 adversarial test cases' and 'Mind2Web (Deng et al., 2023) with AdvAgent (Xu et al., 2024), a web-agent benchmark which covers 440 tasks across 4 different domains' (Section 4.1)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are standard benchmarks (AgentDojo, Mind2Web)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The evaluation pipeline from benchmark input to reported metrics is not documented in detail. There are no descriptions of how many examples were filtered, how edge cases were handled, or how the attack optimization pipeline produced final adversarial inputs."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No formal funding acknowledgments section. The only disclosure is a footnote: 'This work was done during an internship at NVIDIA.' No grants or specific funding sources are listed."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: NVIDIA (Kang, Xiang, Kariyappa, Xiao, Suh), University of Illinois Urbana-Champaign (Kang, Li), Johns Hopkins University (Xiao). The NVIDIA internship is explicitly noted."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "NVIDIA, where the work was conducted, has commercial interests in LLM safety and security for its AI products and platforms. A strong defense framework could benefit NVIDIA's product offerings. The funder is not independent of the outcome."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is included in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense framework (IntentGuard) rather than evaluating a pre-trained model's knowledge or capability on benchmarks. The contamination concern is not central to the claims."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defenses against prompt injection rather than evaluating model knowledge. Train/test overlap is not relevant to the defense effectiveness claims."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates a defense mechanism, not a model's inherent capabilities. Benchmark contamination does not affect the validity of the defense evaluation."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "Table 3 reports Origin Tracing time (0.075-0.352s), and Remark 3 states computational overhead is 'minimal.' However, no overall inference cost, API costs, tokens consumed, or wall-clock time per evaluation is reported."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. The paper does not report GPU hours, total API spend, hardware used, or total evaluation time."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. All results appear to be from single runs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is not stated. It is unclear whether results are from single runs or averaged across multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. The default parameters (window ratio 0.5, threshold 0.7) appear chosen without documented search. Table 4 shows robustness to parameter choices but is not a search budget disclosure."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The default configuration (union of start/end instruction sets, adversarial reasoning demonstration, sparse embeddings, threshold 0.7) is stated but the selection rationale is not explicit. The ablation study justifies the thinking intervention combination but not the full parameter selection process."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes many comparisons across 4 attacks × 4 methods × 2 models × 2 benchmarks without any statistical testing, let alone correction for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own IntentGuard system against baselines and design their own adaptive attacks. No acknowledgment of self-comparison bias or independent evaluation is provided."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "IntentGuard adds inference overhead (thinking intervention tokens, Origin Tracing) compared to baselines, but performance is not reported as a function of compute budget. Table 3 compares tracing time for sparse vs. dense embeddings but does not provide compute-matched comparisons against baselines."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AgentDojo and Mind2Web adequately measure real-world prompt injection defense effectiveness. The paper does not address whether synthetic multi-tool and web-agent benchmarks are valid proxies for actual deployment scenarios."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "All defense methods are compared using the same backbone models (Qwen3-32B, gpt-oss-20B) and the same benchmark evaluation frameworks. The external LLM detector in PromptArmor uses the same backbone model as IntentGuard for fair comparison (Section 4.1)."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AgentDojo or Mind2Web tasks were available before the training cutoffs of Qwen3-32B or gpt-oss-20B, which could affect utility scores."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup could leak information to the models (e.g., through benchmark-specific patterns in the evaluation framework)."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of independence between benchmark examples or whether structural similarities among test cases could inflate results."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is used or discussed."
       }
     }
   },
   "claims": [
     {
       "claim": "IntentGuard preserves benign utility with zero false positive alerts in all but one experiment setting.",
       "evidence": "Tables 1 and 2 show FPR=0.000 for IntentGuard in all settings. Utility matches vanilla in all cases except Mind2Web with Qwen3-32B (0.840→0.810).",
       "supported": "strong"
     },
     {
       "claim": "IntentGuard reduces PAIR attack success rate from 100% to 8.5% on Mind2Web with Qwen3-32B.",
       "evidence": "Table 2, Mind2Web, Qwen3-32B row: Vanilla ASR=1.000, IntentGuard ASR=0.085 under PAIR attack.",
       "supported": "strong"
     },
     {
       "claim": "IntentGuard substantially outperforms PromptArmor, achieving over 20% higher utility and more than 50% lower ASR under PAIR attacks on AgentDojo.",
       "evidence": "Table 1: Under PAIR attacks, IntentGuard Utility=0.687 vs PromptArmor=0.432 (25.5pp higher), IntentGuard ASR=0.092 vs PromptArmor=0.659 (56.7pp lower) for Qwen3-32B.",
       "supported": "strong"
     },
     {
       "claim": "Combining start-of-thinking prefilling and end-of-thinking refinement yields the strongest robustness, driving ASR below 0.1.",
       "evidence": "Figure 3a shows individual interventions reduce ASR to ~0.3 and ~0.2 respectively, while their combination achieves ASR below 0.1.",
       "supported": "moderate"
     },
     {
       "claim": "The IIA is faithful for 83.8% of instructions (strictly along the confusion matrix diagonal).",
       "evidence": "Figure 4 shows the confusion matrix with 64.5% (No Intent, Not Followed) + 19.3% (Intent, Followed) = 83.8% on the diagonal, with only 10.9% truly unfaithful (No Intent, Followed).",
       "supported": "moderate"
     },
     {
       "claim": "Sparse embeddings match dense embeddings in robustness while being far more efficient for Origin Tracing.",
       "evidence": "Table 3 shows comparable ASR (0.092 vs 0.094 for Qwen3-32B) with sparse tracing time of 0.075s vs dense 0.274s.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or variance across runs",
       "detail": "All results in Tables 1-2 are point estimates with no uncertainty quantification. Given that LLM outputs are stochastic, single-run results may not be stable. The large number of comparisons (4 attacks × 4 methods × 2 models × 2 benchmarks) makes random variation a real concern."
     },
     {
       "flag": "Self-designed adaptive attacks",
       "detail": "The PAIR-adaptive attack and the adaptive optimization targets for Beam Search and GCG are designed by the same authors who built IntentGuard. This creates potential for unconscious bias in attack design — the authors may not fully stress-test their own defense's weaknesses. The concurrent work by Nasr et al. (2025) is referenced but their attacks are not directly evaluated."
     },
     {
       "flag": "NVIDIA conflict of interest not formally disclosed",
       "detail": "Five of six authors are affiliated with NVIDIA, and the work was done during an NVIDIA internship. NVIDIA has commercial interests in LLM safety for its AI platforms. No formal conflict of interest statement or funding acknowledgment is provided."
     },
     {
       "flag": "Limited model diversity",
       "detail": "Only two reasoning-enabled models (Qwen3-32B, gpt-oss-20B) are tested. The framework explicitly requires reasoning-enabled LLMs that generate thinking traces, but no evidence is provided for models without extended reasoning capabilities (e.g., GPT-4o, Claude, Llama)."
     }
   ],
   "cited_papers": [
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Foundational paper defining indirect prompt injection attacks on LLM-integrated applications."
     },
     {
       "title": "AgentDojo: A dynamic environment to evaluate attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "Multi-tool agentic benchmark used for evaluating prompt injection attacks and defenses."
     },
     {
       "title": "Mind2Web: Towards a generalist agent for the web",
       "authors": ["Xiang Deng", "Yu Gu", "Boyuan Zheng", "Shijie Chen", "Sam Stevens", "Boshi Wang", "Huan Sun", "Yu Su"],
       "year": 2023,
       "relevance": "Web-agent benchmark used with AdvAgent for evaluating defense against prompt injection in web interaction."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2024,
       "arxiv_id": "2410.05451",
       "relevance": "Finetuning-based defense against prompt injection using preference optimization, compared as alternative defense approach."
     },
     {
       "title": "PromptArmor: Simple yet effective prompt injection defenses",
       "authors": ["Tianneng Shi", "Kaijie Zhu", "Zhun Wang", "Yuqi Jia", "Will Cai"],
       "year": 2025,
       "arxiv_id": "2507.15219",
       "relevance": "LLM-based prompt injection detector used as a primary baseline defense in the evaluation."
     },
     {
       "title": "Attention Tracker: Detecting prompt injection attacks in LLMs",
       "authors": ["Kuo-Han Hung", "Ching-Yun Ko", "Ambrish Rawat", "I Chung", "Winston H Hsu", "Pin-Yu Chen"],
       "year": 2024,
       "arxiv_id": "2411.00348",
       "relevance": "Defense approach using attention-based internal signals to detect prompt injection, representing the detector-based defense category."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": ["Edoardo Debenedetti", "Ilia Shumailov", "Tianqi Fan", "Jamie Hayes", "Nicholas Carlini"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "System-level defense approach enforcing rules in agentic systems to mitigate prompt injection."
     },
     {
       "title": "Jailbreaking black box large language models in twenty queries",
       "authors": ["Patrick Chao", "Alexander Robey", "Edgar Dobriban", "Hamed Hassani", "George J Pappas", "Eric Wong"],
       "year": 2025,
       "relevance": "PAIR attack method used as the strongest adaptive attack baseline in the evaluation."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "GCG attack method used as a white-box adversarial attack baseline."
     },
     {
       "title": "The attacker moves second: Stronger adaptive attacks bypass defenses against LLM jailbreaks and prompt injections",
       "authors": ["Milad Nasr", "Nicholas Carlini", "Chawin Sitawarin"],
       "year": 2025,
       "arxiv_id": "2510.09023",
       "relevance": "Concurrent work proposing stronger adaptive attacks; shares similarities with IntentGuard's adaptive attack experiments."
     },
     {
       "title": "RL is a hammer and LLMs are nails: A simple reinforcement learning recipe for strong prompt injection",
       "authors": ["Yuxin Wen", "Arman Zharmagambetov", "Ivan Evtimov", "Narine Kokhlikyan", "Tom Goldstein", "Kamalika Chaudhuri", "Chuan Guo"],
       "year": 2025,
       "arxiv_id": "2510.04885",
       "relevance": "RL-based adaptive prompt injection attack representing a stronger attack methodology."
     },
     {
       "title": "AdvWeb: Controllable black-box attacks on VLM-powered web agents",
       "authors": ["Chejian Xu", "Mintong Kang", "Jiawei Zhang", "Zeyi Liao"],
       "year": 2024,
       "arxiv_id": "2410.17401",
       "relevance": "Black-box attack method targeting web agents, used with Mind2Web for evaluation."
     },
     {
       "title": "Meta SecAlign: A secure foundation LLM against prompt injection attacks",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "David Wagner", "Chuan Guo"],
       "year": 2025,
       "arxiv_id": "2507.02735",
       "relevance": "Finetuning-based defense training a foundation model to resist prompt injection."
     },
     {
       "title": "DataSentinel: A game-theoretic detection of prompt injection attacks",
       "authors": ["Yupei Liu", "Yuqi Jia", "Jinyuan Jia", "Dawn Song", "Neil Zhenqiang Gong"],
       "year": 2025,
       "relevance": "Known-answer detection approach for prompt injection using game-theoretic formulation."
     },
     {
       "title": "Effectively controlling reasoning models through thinking intervention",
       "authors": ["Tong Wu", "Chong Xiang", "Jiachen T Wang", "G Edward Suh", "Prateek Mittal"],
       "year": 2025,
       "arxiv_id": "2503.24370",
       "relevance": "Introduces the thinking intervention concept that IntentGuard adapts for instruction-following intent elicitation."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Proposes a concrete defense framework that practitioners building LLM agents could adopt, but requires reasoning-enabled models and custom implementation with no released code."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Novel perspective of analyzing instruction-following intent rather than detecting malicious text, but the overall finding that defenses can work is not surprising."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Directly addresses prompt injection security threats to LLM agents, showing attacks can achieve 100% success rate without defenses."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy or conflict; straightforward defense proposal and evaluation."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or tool is released. The approach cannot be tried without reimplementation."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "NVIDIA is a high-profile AI lab; the paper also evaluates models from well-known organizations."
     }
   }
 }