ai-research-survey

scan.json (23392B)

---

 {
   "paper": {
     "title": "A Multi-Agent LLM Defense Pipeline Against Prompt Injection Attacks",
     "authors": [
       "S M Asif Hossain",
       "Ruksat Khan Shayoni",
       "Mohd Ruhul Ameen",
       "Akif Islam",
       "M. F. Mridha",
       "Jungpil Shin"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2509.14285"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, code archive, or link to implementation is provided anywhere in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The HPI_ATTACK_DATASET is described but no download link or repository is provided for the 55 attack prompts."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions ChatGLM-6B and Llama2-13B but provides no environment specifications, dependency lists, or setup details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No reproduction instructions, scripts, or step-by-step guide provided."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Only point estimates (ASR percentages) are reported. No confidence intervals or error bars on any results."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims defense reduces ASR from 20-30% to 0% but no statistical significance tests are performed."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "ASR reductions are reported with baseline context: e.g., 'ASR reached 30% for ChatGLM' reduced to '0% across all tested scenarios' (Section V, Table IV). Percentage improvements with baselines provided."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for why 55 attacks or 400 total instances are sufficient. No power analysis or discussion of sample adequacy."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures reported. All results are single-run point estimates."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Undefended systems serve as baselines (Section IV-B), and a taxonomy-based filter serves as a baseline defense (Section IV-C)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "No comparison against existing prompt injection defense methods from the literature (e.g., SmoothLLM, Self-Guard, SelfDefend). The only baselines are undefended and a simple rule-based filter."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "The paper tests three architectures but does not ablate components within them (e.g., removing the Guard agent, removing the Coordinator). No controlled single-variable manipulation."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "Only Attack Success Rate (ASR) is reported. No metrics for false positive rate, latency overhead, legitimate query handling quality, or user experience."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "Section III-A states 'Two authors independently reviewed all outputs, achieving over 95% agreement, with disagreements resolved through discussion.' This is human evaluation of system outputs."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No separation between development and test sets. The same 55 attacks appear to be used for both designing the defense and evaluating it."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table V provides per-category ASR breakdown across 10 attack categories with baseline and protected rates."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "With 100% mitigation claimed, no failure cases exist to discuss. The paper does not analyze near-misses or edge cases."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "Every experiment shows perfect defense (0% ASR). No configurations that failed or approaches that were tried and abandoned are reported."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 100% mitigation across 400 evaluations and 0% ASR, which matches Table IV results. The claims are internally consistent."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims the multi-agent pipeline 'achieved 100% mitigation' (causal) but the evaluation does not control for confounds — the defense was designed with knowledge of the attack dataset, creating a circular evaluation."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title and abstract frame results broadly ('Prompt Injection Attacks') but testing was limited to 55 hand-crafted attacks on two older models (ChatGLM-6B, Llama2-13B). No discussion of whether results generalize to other models or novel attack types."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of alternative explanations. The 100% success could be due to the attacks being too simple, the defense being tuned to the specific dataset, or the models being old/small. None of these alternatives are considered."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "ASR measures whether an attack's intended failure mode appears in the output, but the paper frames this as comprehensive 'security' without discussing what ASR does and does not capture (e.g., subtle information leakage, partial compliance, semantic attacks)."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "ChatGLM-6B (2022) and Llama2-13B (2023) are specified with model sizes in Section IV-A."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "System prompts for the Coordinator and Guard agents are described functionally (Table III) but the actual prompt text used is not provided."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No temperature, top-p, max tokens, or other inference parameters are reported for either model."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The multi-agent architecture is described in detail with workflow diagrams (Figs 1-3), agent roles (Table III), and the pipeline stages including API Gateway, Event Orchestrator, Coordinator, Guard, and Buffer stages."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper states attacks were 'manually validated and labeled' but does not describe how the 55 attacks were selected, what criteria were used, or how the 400 total instances were generated from the 55 unique attacks."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "No dedicated limitations or threats-to-validity section. The conclusion mentions 'open challenges remain' in one sentence but this is not a substantive limitations discussion."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No specific threats to validity discussed. The conclusion vaguely mentions 'adaptive adversarial strategies, indirect and multi-turn attacks' but these are future work, not threats to current validity."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit statement of what results do NOT show. The paper does not bound its claims to the specific models or attack types tested."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The 55 attack prompts and model outputs are not released. Only aggregated ASR statistics are provided."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section III-A describes the HPI_ATTACK_DATASET construction with 8 categories, representative examples (Table I), and suite composition (Table II)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants — this is an automated evaluation of LLM defenses against a curated attack dataset."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "It is unclear how 55 unique attacks become 400 evaluation instances. Table II shows 100+50+50=200 for the three suites, but the paper claims 400 total. The multiplication/duplication process is not explained."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All author affiliations are listed: Wichita State University, Marshall University, University of Rajshahi, AIUB, University of Aizu."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding information disclosed, so independence cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests defense mechanisms against prompt injection, not model knowledge on benchmarks. The attacks are novel hand-crafted prompts, not knowledge benchmarks."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Not evaluating pre-trained model capability on a knowledge benchmark — testing defense pipeline effectiveness against injection attacks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not a benchmark-knowledge evaluation. The concern here is defense effectiveness, not whether models memorized answers."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. Evaluation is automated against a curated attack dataset."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No latency, token cost, or overhead measurements reported despite the multi-agent pipeline requiring multiple LLM calls per query."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No hardware, GPU hours, or computational resources mentioned."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds or sensitivity across runs. Results appear to be single-run."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit statement of how many runs produced the results."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search described for the defense pipeline or LLM inference settings."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No description of how the defense configurations were tuned or selected."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Authors designed both the attacks and defenses and evaluate their own system without acknowledging this bias."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "The multi-agent pipeline requires multiple LLM calls per query vs. single-call baseline, but no compute/latency comparison is provided."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the 55 hand-crafted attacks are representative of real-world prompt injection threats. The benchmark's construct validity is unexamined."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The defense pipeline itself is scaffolding around the LLMs, but no analysis separates the contribution of the scaffolding from model capabilities. The same scaffold-model bundle is always evaluated together."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the attack patterns in the dataset overlap with patterns seen during model training."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The defense was designed with knowledge of the attack categories it would be tested against — this potential feature leakage (defense tuned to test set) is not discussed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 400 instances are derived from 55 unique attacks, likely with repetitions. Non-independence between instances within attack categories is not discussed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method applied."
       }
     }
   },
   "claims": [
     {
       "claim": "Multi-agent defense pipeline achieves 100% mitigation, reducing ASR to 0% across all 400 evaluations on 55 unique attack types",
       "evidence": "Table IV shows 0% ASR for all three defended configurations (v1 Taxonomy ON, Phase2 Coordinator ON, Phase2 Chain ON) across 200 defended evaluations. Section V-A.",
       "supported": "weak"
     },
     {
       "claim": "Baseline (undefended) systems show 20-30% ASR",
       "evidence": "Table IV: v1 Taxonomy OFF = 30% ASR (30/100), Phase2 Coordinator OFF = 20% (10/50), Phase2 Chain OFF = 30% (15/50). Section V-A.",
       "supported": "moderate"
     },
     {
       "claim": "Delegate attacks have 100% baseline ASR, making them the most dangerous category",
       "evidence": "Table V shows Delegate category: 10 cases, 100% baseline ASR. Section V-B, Fig 6.",
       "supported": "moderate"
     },
     {
       "claim": "Defense success is driven more by comprehensive detection than architectural sophistication",
       "evidence": "Section VI states all three architectures achieved identical 0% ASR despite different designs (Table VI). However, this could also indicate the attacks are too simple.",
       "supported": "weak"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "A multi-agent LLM defense pipeline using Coordinator and Guard agents achieves 0% Attack Success Rate across 400 evaluations of 55 prompt injection attacks on ChatGLM-6B and Llama2-13B. Baseline undefended systems showed 20-30% vulnerability, with delegate and role-play attacks being most dangerous. All three defense architectures (rule-based filter, coordinator pipeline, chain-of-agents) achieved identical perfect mitigation, suggesting attack simplicity rather than architectural sophistication drove results.",
   "red_flags": [
     {
       "flag": "Perfect results (100% mitigation)",
       "detail": "Achieving exactly 0% ASR across all 400 evaluations with no failures or near-misses is suspicious. Real-world security evaluations almost never achieve perfect scores. This suggests the attack dataset may be too simple or the defense was overfitted to the test set."
     },
     {
       "flag": "Circular evaluation design",
       "detail": "The authors designed both the attack dataset and the defense pipeline. The defense was likely tuned with knowledge of the attacks it would face, creating a non-independent evaluation. No held-out attacks were used."
     },
     {
       "flag": "Outdated and small models",
       "detail": "ChatGLM-6B (2022) and Llama2-13B (2023) are older, smaller models. Results may not generalize to larger, more capable models like GPT-4 or Claude that are more commonly deployed."
     },
     {
       "flag": "Tiny attack dataset",
       "detail": "Only 55 unique attacks across 8 categories is very small for a security evaluation claiming comprehensive coverage. Real prompt injection attacks are diverse and rapidly evolving."
     },
     {
       "flag": "No false positive analysis",
       "detail": "The paper reports no metrics on whether the defense incorrectly blocks legitimate queries. A defense that blocks everything would also achieve 0% ASR."
     },
     {
       "flag": "Inconsistent sample counts",
       "detail": "Table II shows 25+15+15=55 unique attacks and 100+50+50=200 suite instances, but the paper claims 400 evaluations. The doubling is unexplained — likely running each suite on both models, but this is never explicitly stated."
     },
     {
       "flag": "No comparison with existing defenses",
       "detail": "Multiple published prompt injection defenses exist (SmoothLLM, Self-Guard, SelfDefend, PPA) but none are compared against. The only baselines are undefended and a trivial rule-based filter."
     }
   ],
   "cited_papers": [
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["F. Liu"],
       "year": 2023,
       "arxiv_id": "2310.12815",
       "relevance": "Systematic taxonomy of prompt injection attacks and defense benchmarking — directly relevant to evaluating LLM security."
     },
     {
       "title": "GenTel-Shield: A model-agnostic prompt injection detector",
       "authors": ["S. Li"],
       "year": 2024,
       "arxiv_id": "2409.00594",
       "relevance": "Prompt injection detection tool relevant to LLM security evaluation methodology."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["K. Greshake"],
       "year": 2023,
       "relevance": "Seminal work on indirect prompt injection in real LLM applications, key to AI safety research."
     },
     {
       "title": "SmoothLLM: Defending large language models against jailbreaking attacks",
       "authors": ["A. Robey"],
       "year": 2023,
       "arxiv_id": "2310.03684",
       "relevance": "Defense mechanism against LLM jailbreaking — directly comparable approach to the surveyed paper."
     },
     {
       "title": "Are aligned neural networks adversarially aligned?",
       "authors": ["N. Carlini"],
       "year": 2023,
       "relevance": "Evaluates robustness of safety-aligned LLMs to adversarial attacks — core AI safety evaluation work."
     },
     {
       "title": "Jailbroken: How does LLM safety training fail?",
       "authors": ["A. Wei"],
       "year": 2023,
       "relevance": "Analysis of failure modes in LLM safety training — foundational for understanding LLM security vulnerabilities."
     },
     {
       "title": "Self-guard: Empower the LLM to safeguard itself",
       "authors": ["Y. Wang"],
       "year": 2023,
       "arxiv_id": "2310.15851",
       "relevance": "Self-defensive LLM architecture relevant to multi-agent safety approaches."
     },
     {
       "title": "SelfDefend: LLMs can defend themselves against jailbreaking in a practical manner",
       "authors": ["B. Jiang"],
       "year": 2023,
       "arxiv_id": "2312.00038",
       "relevance": "Practical LLM self-defense mechanism against jailbreaking, comparable approach."
     },
     {
       "title": "To protect the LLM agent against prompt injection with polymorphic prompt",
       "authors": ["Y. Wang"],
       "year": 2024,
       "arxiv_id": "2506.05739",
       "relevance": "Polymorphic prompt assembly defense against prompt injection — directly relevant defense technique."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["A. Zou"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "GCG attack method demonstrating transferable adversarial prompts across LLMs — key attack methodology paper."
     }
   ]
 }