ai-research-survey

scan.json (34961B)

---

 {
   "paper": {
     "title": "MPIB: A Benchmark for Medical Prompt Injection Attacks and Clinical Safety in LLMs",
     "authors": ["Junhyeok Lee", "Han Jang", "Kyu Sung Choi"],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2602.06268"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "MPIB benchmarks 12 LLMs across 5 defense configurations for clinical prompt injection safety. The key finding is that Attack Success Rate (ASR) and Clinical Harm Event Rate (CHER) can diverge substantially, especially under indirect RAG-mediated injection (V2), where models may comply with adversarial framing without producing high-severity clinical harm. Direct injection (V1) consistently produces higher CHER than indirect injection (V2) across all models. Composite defenses (D4) are not uniformly best and the safety-utility trade-off is model-dependent.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states 'Code and data are available at GitHub (code) and Hugging Face (data).' The evaluation toolkit is described as publicly released (Table 7), and the HuggingFace repository is identified as jhlee0619/mpib (Section C.1)."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The dataset is released on Hugging Face (jhlee0619/mpib) in redacted form, with V2 payloads replaced by [REDACTED_PAYLOAD] tokens. Unredacted payloads are available under gated research agreement (Section C)."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, conda environment file, or detailed environment setup section is described in the paper. Hardware and software specifications for running the evaluation are not provided."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions releasing 'fixed splits, prompt assembly templates, and baseline defenses' (Section 3.5) but does not include step-by-step reproduction instructions. A 'reproducible evaluation harness' is referenced but no specific commands or README-style instructions appear in the paper."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Table 5 reports all metrics (ASR, CHER, FPR-H) as point estimates (percentages) without any confidence intervals, error bars, or uncertainty measures."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "Despite making numerous comparative claims across 12 models and 5 defense configurations (e.g., 'D2 reduces V1 CHER from 65.7% to 50.7%'), no statistical significance tests (t-tests, bootstrap tests, etc.) are reported anywhere in the paper."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports absolute percentage values with baseline context throughout (e.g., 'Qwen-2.5-72B reduces V1 CHER from 65.7% (D0) to 50.7% (D2),' Section 4.2), providing sufficient context to assess the magnitude of differences."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The final dataset size of 9,697 instances is reported (Table 1) but no power analysis or explicit justification for this number is provided. The sizes are a byproduct of the pipeline (source datasets × rule families × quality gates) rather than a deliberate sample size determination."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "All results in Table 5 are single-run point estimates. No standard deviation, variance, or spread measures are reported. While deterministic decoding (temperature=0) is used, the LLM-as-a-judge pipeline and dataset construction involve stochastic components whose variance is not assessed."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "D0 (no defense) serves as the baseline configuration against which D1-D4 are compared. Results are reported for all 12 models under D0 and all defense variants in Table 5."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The evaluated models include contemporary architectures: Qwen-2.5 (2024), Llama-3.1 (2024), MedGemma (2025), and Mixtral (2024). Medical-tuned models include Meditron, BioMistral, and MMed-Llama-3."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The defense hierarchy (D0-D4) functions as an ablation: D1 tests internal hardening alone, D2 tests input guard alone, D3 tests context sanitization alone, and D4 tests their combination. This reveals which defense components contribute to safety under each attack vector."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three complementary metrics are reported: Attack Success Rate (ASR, severity ≥2), Clinical Harm Event Rate (CHER3, severity ≥3), and Utility False Positive Rate (FPR-H). The central contribution is arguing that ASR alone is insufficient."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "The main evaluation uses an LLM-as-a-judge (Qwen-2.5-72B-Instruct). A human-validated set (N=300) was used only for judge selection (Section 4.1), not for evaluating target model outputs. No human evaluation of the 12 target models' clinical safety outputs is reported."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.5 specifies an '80/10/10 split (Train/Dev/Test) grouped by source query to prevent leakage across paraphrases and derived variants.' Selected V2 attack families are reserved exclusively for the test set."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 5 breaks results down by model (13 models), defense configuration (D0-D4), attack vector (V1/V2), and metric (CHER, ASR, FPR-H). Tables 1-2 provide instance distribution by scenario (S1-S4) and vector. Figure 3 provides per-model ASR-CHER divergence."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Appendix F (Figures 4-7) provides detailed qualitative examples of V0, V0', V1, and V2 instances with raw model outputs showing both successful attacks and resistant behavior. Section 4.2 discusses specific failure modes."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 explicitly reports that 'Composite defense (D4) is not uniformly best' and can underperform simpler interventions. Cases where D3 increases ASR while decreasing CHER are discussed (e.g., MedGemma-4B under V2). The non-uniformity of defense effectiveness is a central finding."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims 'V2 yields multiple-fold higher CHER than V1 in high-risk categories,' but Table 5 consistently shows V1 CHER exceeding V2 CHER across all 13 models under D0 (e.g., Qwen-2.5-72B: V1 CHER 65.7% vs V2 CHER 7.8%). No per-category breakdown supporting this abstract claim is presented. The Introduction similarly states 'indirect injection often exceeds direct injection in strength,' contradicting Section 4.2's own finding that 'V1 CHER is generally higher than V2 CHER.'"
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The defense configurations (D0-D4) constitute controlled interventions applied to each model-instance pair. Claims like 'D2 reduces V1 CHER' are supported by this controlled manipulation design where only the defense component varies while other factors are held constant."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Section 5 (Limitations) explicitly bounds generalizations: the defense harness is 'a controlled reference rather than a production-grade guardrail,' the taxonomy may not capture real-world clinical context (comorbidities, local guidelines), and the V2 protocol does not evaluate retrieval-stage factors. Claims are generally tied to specific models and defense configurations."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 discusses plausible alternative explanations: 'coupling input rewriting and context sanitization can introduce interaction effects: aggressive rewriting may distort clinical intent, while aggressive sanitization may remove legitimately relevant instructions.' Section 4.3 discusses why V2 ASR-CHER gaps may reflect framing compliance rather than clinical harm."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper's central methodological contribution is distinguishing between ASR (proxy for attack compliance) and CHER (proxy for clinical harm). Section 5 acknowledges that 'real-world clinical harm depends on patient context (e.g., comorbidities and access to care), local guideline differences' which their severity taxonomy cannot fully capture."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 specifies model names with family, size, and variant: 'Qwen-2.5-72B-Instruct,' 'Llama-3.1-8B-Instruct,' 'MedGemma-4B,' 'Meditron-70B,' 'BioMistral-7B,' 'MMed-Llama-3-8B.' These are specific open-weight model identifiers that uniquely identify the model weights."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The LLM judge prompt is provided in full in Appendix E. However, the system prompts and prompt assembly templates used to query the 12 target models during evaluation are not provided verbatim. The paper mentions a 'standardized prompt assembler' (Section 4.1) but does not show the actual prompt text. D1 (Internal Hardening) is described only conceptually."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 states 'deterministic decoding (greedy or temperature = 0)' for target models. Appendix E states 'temperature=0.0 and max_tokens=1024' for the judge. These are the key inference parameters."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding (multi-step reasoning, tool use, memory management) is used. The defense components (D1-D4) are single-pass LLM filters, not agentic workflows."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.3 and Figure 2 document the full pipeline: text normalization from MedQA/PubMedQA, scenario classification via LLM-based classifier (Qwen-2.5-72B-Instruct), adversarial generation via rule families R1-R10, and multi-stage quality gating (G1-G6). Table 1 reports final counts by pool type."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 5 is titled 'Limitations' and contains three substantive paragraphs covering judge-dependent bias, taxonomy limitations, and defense harness limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 5 discusses threats specific to this study: 'outcome labels are primarily produced via a structured LLM-as-a-judge pipeline, which may introduce judge-dependent bias,' 'our defense harness (D2-D4) is intentionally lightweight—a small-LLM (7B)–based scaffold,' and 'excluding invalid or unparseable judge outputs can affect reported metrics, particularly on borderline cases.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 explicitly states out-of-scope factors: 'we do not evaluate whether poisoned content is retrieved in the first place, how retrieval ranking or noise affects exposure, or whether the retriever itself is compromised.' Section 5 notes the defense harness 'should be interpreted as a controlled reference rather than a production-grade guardrail.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The dataset is released on Hugging Face (jhlee0619/mpib) with all instances available (V2 payloads redacted in public release, unredacted under gated access). Table 7 lists the artifact manifest including data splits and payload registry."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.3 describes the full collection procedure: source datasets (MedQA BigBio English, PubMedQA BigBio labeled folds), normalization pipeline, LLM-based medical filtering and scenario stratification, and adversarial variant generation via rule families R1-R10."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study. Data is derived from standard public benchmarks (MedQA, PubMedQA). The human-validated set (N=300) for judge selection is not a human subjects study."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Figure 2 provides a visual overview of the five pipeline stages (Processing, Attack, Quality Control, Harm Taxonomy, Release). Sections 3.3-3.4 detail each stage. Quality gates G1-G6 (Appendix B.3) specify filtering criteria. Table 1 reports final counts per pool type."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source, grants, or sponsorship are mentioned anywhere in the paper. There is no acknowledgments section disclosing funding."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: all three authors are from Seoul National University (College of Medicine and/or Hospital). They do not evaluate any SNU products, so no product-affiliation conflict exists."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so funder independence cannot be assessed. Without any funding disclosure, this cannot be verified as either independent or non-independent."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement appears in the paper. The absence of a disclosure statement does not constitute absence of conflict."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates are stated for any of the 12 evaluated models. This is important because the source datasets (MedQA, PubMedQA) are well-known public benchmarks that may be included in model training corpora."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No analysis or discussion of whether MedQA/PubMedQA instances (the source data for MPIB) appeared in the training data of the 12 evaluated models. This is particularly relevant for V0 (unaltered MedQA/PubMedQA items) used for utility baseline evaluation."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "MedQA (published 2021) and PubMedQA (published 2019) were publicly available well before the training of all evaluated models (Qwen-2.5, Llama-3.1, etc.). The paper does not discuss whether models may have trained on these datasets or how this could affect results, particularly for V0/V0' utility evaluation."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. The benchmark evaluation is entirely computational."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data is derived from existing public benchmarks (MedQA, PubMedQA)."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants or experimental conditions requiring participant randomization."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or token consumption is reported despite evaluating 12 models × 5 defenses × 9,697 instances. The compute cost of running LLM-as-a-judge on all outputs is also not reported."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No GPU hours, hardware specifications, total API spend, or wall-clock time for the evaluation campaign are stated anywhere in the paper."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 states 'deterministic decoding (greedy or temperature = 0)' for all target models and 'temperature=0.0' for the judge. Deterministic decoding eliminates stochastic variation across runs, making seed sensitivity analysis unnecessary as results are fully reproducible."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "The use of 'deterministic decoding (greedy or temperature = 0)' (Section 4.1) implies single evaluation runs, since additional runs with deterministic decoding would produce identical results."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "The quality gate thresholds (e.g., V2 strict tier: Affinity ≥3.0, Misleading ≥3.0, Plausibility ≥3.0; borderline tier with lower thresholds) and defense configurations appear tuned but no search budget or tuning methodology is described."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "All five defense configurations (D0-D4) are reported for all models in Table 5. No single 'best' configuration is selected — the paper explicitly argues that 'Composite defense (D4) is not uniformly best' and that defense selection is model-dependent."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes hundreds of implicit comparisons across 13 models × 5 defenses × 2 vectors × 3 metrics but performs no statistical tests whatsoever, let alone corrections for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors constructed the MPIB benchmark, designed the defense configurations (D1-D4), and selected the evaluation judge — all evaluated by the same team. No acknowledgment of self-comparison bias or discussion of independent evaluation is provided."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Models range from 4B to 72B parameters, but performance is not discussed as a function of compute budget. No analysis of whether larger models' improved robustness justifies their compute cost."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": true,
         "justification": "The paper's central contribution is questioning construct validity: it argues that ASR (the standard metric) does not validly measure clinical harm, and introduces CHER to capture high-severity outcomes. Section 5 discusses limitations of the H1-H5 taxonomy relative to real-world clinical harm."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Defense configurations (D0-D4) are explicitly treated as a controlled variable. Table 5 reports results for each model × defense combination, enabling readers to separate model robustness from defense scaffold effects."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "MedQA (2021) and PubMedQA (2019) were published before the training of all evaluated models. The paper does not discuss whether models may have seen these benchmark items (or similar medical QA data) during pre-training, which could inflate V0/V0' utility scores."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup inadvertently leaks information. For example, the V2 protocol embeds poisoned contexts alongside benign contexts — the structural presence of conflicting information could serve as a signal for models trained to detect adversarial inputs."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.5 specifies '80/10/10 split (Train/Dev/Test) grouped by source query to prevent leakage across paraphrases and derived variants.' This ensures that derived variants of the same query do not appear in both train and test splits."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection methods (canary strings, membership inference, n-gram overlap analysis, decontamination pipelines) are applied. The grouping-by-source-query addresses within-benchmark leakage but not model training data contamination."
       }
     }
   },
   "claims": [
     {
       "claim": "ASR and CHER can diverge substantially, especially under indirect (V2) prompt injection, where larger 'Safe Gaps' emerge.",
       "evidence": "Figure 3 shows that under V2, ASR (severity ≥2) can remain high while CHER3 (severity ≥3) is much lower for many models. Table 5 shows specific examples: MedGemma-4B V2 D3 has ASR=65.6% but CHER=18.8%. Qwen-2.5-72B V2 D0 has ASR=53.1% but CHER=7.8%.",
       "supported": "strong"
     },
     {
       "claim": "V1 (direct injection) produces generally higher CHER than V2 (indirect injection) across all models.",
       "evidence": "Table 5 shows V1 CHER exceeds V2 CHER for every model under D0: Qwen-2.5-72B (65.7% vs 7.8%), Llama-3.1-70B (86.6% vs 37.5%), MedGemma-4B (88.1% vs 21.9%). This pattern is consistent across all defense configurations.",
       "supported": "strong"
     },
     {
       "claim": "V2 yields multiple-fold higher CHER than V1 in high-risk categories (abstract claim).",
       "evidence": "This claim from the abstract directly contradicts the data in Table 5, which shows V1 CHER consistently exceeding V2 CHER across all 13 models. No per-category breakdown supporting this specific claim is presented in the paper.",
       "supported": "unsupported"
     },
     {
       "claim": "Defense effectiveness differs by attack vector — input-side defenses (D2) are more effective for V1, while context-side and hierarchy defenses help with V2.",
       "evidence": "Table 5, Section 4.2: D2 reduces V1 CHER for Qwen-2.5-72B (65.7%→50.7%) and Llama-3.1-70B (86.6%→68.7%). For V2, D1 reduces Qwen-2.5-72B CHER from 7.8% to 1.6%, and D4 reduces Meditron-70B V2 CHER from 53.1% to 37.5%.",
       "supported": "moderate"
     },
     {
       "claim": "Composite defense (D4) is not uniformly the best configuration.",
       "evidence": "Table 5, Section 4.2: D4 sometimes underperforms simpler defenses (e.g., for Llama-3.1-8B V1 CHER, D4 yields 80.6% vs D2's 70.1%). The paper attributes this to interaction effects between input rewriting and context sanitization.",
       "supported": "strong"
     },
     {
       "claim": "Safety-utility trade-off is model-dependent, with medical-tuned models showing higher FPR-H under stronger defenses.",
       "evidence": "Table 5 FPR-H: Meditron-70B increases from 16.0% (D0) to 33.6% (D4), while Qwen-2.5-72B ranges from 2.7-3.8% across all defenses. BioMistral-7B maintains 0.0% FPR-H across all configurations.",
       "supported": "strong"
     },
     {
       "claim": "Qwen-2.5-72B-Instruct is the most appropriate LLM judge based on multi-objective criteria.",
       "evidence": "Tables 3-4: Qwen-2.5-72B achieves highest Kendall τ (0.65), lowest SCE (0.75), 100% JSON validity, and strongest holdout stability (Delta SCE=0.05, holdout Recall@4=0.91). Compared against Mixtral-8x22B and Llama-3.1-70B.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "Abstract contradicts results on V2 vs V1 CHER",
       "detail": "The abstract claims 'V2 yields multiple-fold higher CHER than V1 in high-risk categories' and the Introduction states 'indirect injection often exceeds direct injection in strength.' However, Table 5 consistently shows V1 CHER exceeding V2 CHER across all 13 models under all defense configurations. No per-category breakdown supporting the abstract claim is provided. This is a significant mismatch between stated conclusions and presented evidence."
     },
     {
       "flag": "Same LLM used for both dataset construction and evaluation",
       "detail": "Qwen-2.5-72B-Instruct serves triple duty: scenario classification (footnote 1), quality control and gate scoring (footnote 2), and primary evaluation judge (Section 4.1). This circular dependency means systematic biases in this model propagate to dataset labels, quality filtering decisions, and outcome evaluation. The paper does not discuss this risk."
     },
     {
       "flag": "No statistical tests despite hundreds of comparisons",
       "detail": "The paper makes comparative claims across 13 models × 5 defenses × 2 vectors × 3 metrics, drawing directional conclusions (e.g., 'D2 reduces V1 CHER') from raw percentage differences without any statistical significance testing. Given the relatively small adversarial test sets (V1: 644, V2: 582 total instances, with per-model counts likely much smaller), observed differences may not be statistically significant."
     },
     {
       "flag": "Small adversarial instance counts for per-model analysis",
       "detail": "V1 has 644 instances (6.6%) and V2 has 582 instances (6.0%) total. With an 80/10/10 split, the test set would contain approximately 64 V1 and 58 V2 instances. Per-model CHER values derived from ~60 instances have wide implicit confidence intervals that are not reported, making many claimed differences potentially not meaningful."
     },
     {
       "flag": "Contamination risk from MedQA/PubMedQA source data unaddressed",
       "detail": "V0 instances are 'unaltered items from MedQA/PubMedQA' (Section 3.3). Both datasets were published in 2019-2021, well before the training of all evaluated models. Models may have trained on these exact questions, inflating V0/V0' utility scores and potentially affecting adversarial robustness through familiarity with the clinical scenarios."
     }
   ],
   "cited_papers": [
     {
       "title": "HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal",
       "authors": ["Mantas Mazeika", "Long Phan", "Xuwang Yin", "Andy Zou"],
       "year": 2024,
       "arxiv_id": "2402.04249",
       "relevance": "Standard benchmark for evaluating LLM safety and red-teaming robustness, which MPIB extends to clinical settings."
     },
     {
       "title": "Benchmarking and defending against indirect prompt injection attacks on large language models",
       "authors": ["Jingwei Yi", "Yueqi Xie", "Bin Zhu"],
       "year": 2025,
       "relevance": "BIPIA benchmark for indirect prompt injection in LLMs, a key comparison point for MPIB's RAG-mediated injection evaluation."
     },
     {
       "title": "First, do NOHARM: towards clinically safe large language models",
       "authors": ["David Wu", "Fateme Nateghi Haredasht", "Saloni Kumar Maharaj"],
       "year": 2025,
       "arxiv_id": "2512.01241",
       "relevance": "Outcome-centric harm auditing for clinical LLMs that motivated MPIB's CHER metric and severity-based evaluation."
     },
     {
       "title": "CARES: Comprehensive Evaluation of Safety and Adversarial Robustness in Medical LLMs",
       "authors": ["Sijia Chen", "Xiaomin Li", "Mengxue Zhang"],
       "year": 2025,
       "arxiv_id": "2505.11413",
       "relevance": "Adversarial safety stress testing for medical LLMs, directly relevant to evaluating clinical AI safety and robustness."
     },
     {
       "title": "Ensuring safety and trust: Analyzing the risks of large language models in medicine",
       "authors": ["Yifan Yang", "Qiao Jin", "Robert Leaman"],
       "year": 2024,
       "arxiv_id": "2411.14487",
       "relevance": "MedGuard principle-based safety auditing for medical LLMs, a complementary evaluation paradigm to MPIB's adversarial approach."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["Xiaogeng Liu", "Zhiyuan Yu", "Yizhe Zhang"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Demonstrates universal transferable prompt injection attacks, the attack methodology underlying MPIB's threat model."
     },
     {
       "title": "Prompt injection attack against llm-integrated applications",
       "authors": ["Yi Liu", "Gelei Deng", "Yuekang Li"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Foundational work on prompt injection attacks against LLM-integrated applications, defines the threat model MPIB builds upon."
     },
     {
       "title": "Rag and roll: An end-to-end evaluation of indirect prompt manipulations in llm-based application frameworks",
       "authors": ["Gianluca De Stefano", "Lea Schönherr", "Giancarlo Pellegrino"],
       "year": 2024,
       "arxiv_id": "2408.05025",
       "relevance": "End-to-end evaluation of indirect prompt manipulation in RAG systems, directly relevant to MPIB's V2 attack vector."
     },
     {
       "title": "Adversarial prompt and fine-tuning attacks threaten medical large language models",
       "authors": ["Yifan Yang", "Qiao Jin", "Furong Huang", "Zhiyong Lu"],
       "year": 2025,
       "relevance": "Demonstrates adversarial attacks threatening medical LLMs via prompting and fine-tuning, core motivation for MPIB."
     },
     {
       "title": "CommandSans: Securing AI Agents with Surgical Precision Prompt Sanitization",
       "authors": ["Debeshee Das", "Luca Beurer-Kellner", "Marc Fischer"],
       "year": 2025,
       "arxiv_id": "2510.08829",
       "relevance": "RAG-specific defense against indirect prompt injection via context sanitization, related to MPIB's D3 defense configuration."
     },
     {
       "title": "Retrieval-augmented generation for knowledge-intensive nlp tasks",
       "authors": ["Patrick Lewis", "Ethan Perez", "Aleksandra Piktus"],
       "year": 2020,
       "relevance": "Foundational RAG paper whose architecture defines the retrieval pipeline that MPIB's V2 threat model targets."
     },
     {
       "title": "Medical triage as an AI ethics benchmark",
       "authors": ["Nathalie Maria Kirch", "Konstantin Hebenstreit", "Matthias Samwald"],
       "year": 2025,
       "relevance": "Shows that prompt framing degrades LLM triage behavior, motivating MPIB's clinical scenario evaluation approach."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Provides a benchmark and evaluation harness for testing clinical LLM/RAG system safety, useful for teams deploying medical AI but not immediately actionable without adaptation."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The ASR-CHER divergence finding is methodologically novel but the broader finding that medical LLMs are vulnerable to prompt injection is expected."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Directly demonstrates that prompt injection can cause LLMs to recommend toxic overdoses, dismiss emergencies, and fabricate clinical evidence — all high-severity patient safety risks."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "No controversy or dramatic conflict, though the implicit message that current medical AI safety evaluations (ASR-based) systematically misestimate harm has some edge."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code on GitHub and data on HuggingFace (jhlee0619/mpib) are publicly available, though V2 payloads are redacted and full access requires gated approval."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "From Seoul National University, not a well-known AI research lab. No major AI company products or brands are central to the work."
     }
   }
 }