ai-research-survey

scan.json (32943B)

---

 {
   "paper": {
     "title": "ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data",
     "authors": [
       "Ruiqi Wang",
       "Yuqi Jia",
       "Neil Zhenqiang Gong"
     ],
     "year": 2025,
     "venue": "NDSS 2026",
     "arxiv_id": "2512.09321",
     "doi": "10.14722/ndss.2026.240702"
   },
   "scan_version": 3,
   "active_modules": [
     "experimental_rigor",
     "data_leakage"
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "ObliInjection achieves ~99% attack success rate across three datasets and seven LLMs by contaminating just a single data segment, even when one of 6–100 segments is poisoned. The attack introduces an order-oblivious loss and orderGCG algorithm that together handle unknown segment orderings, substantially outperforming prior prompt injection attacks (Combined Attack 5.9–26.9%, Neural Exec 7.1–36.5%, JudgeDeceiver 40.1–56.8%). Existing prevention-based defenses (StruQ, SecAlign) and detection-based defenses (PPL, DataSentinel) are insufficient, with the attack still achieving 53–78% ASR against prevention defenses and 79–93% false negative rates against detectors.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states: 'Our code and data are available at: https://github.com/ReachalWang/ObliInjection.' A working URL is provided."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper states code and data are available at the GitHub URL. Additionally, the three evaluation datasets (Amazon Reviews, Multi-News, HotpotQA) are publicly available standard benchmarks."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions hardware used (A100 GPU, H200 GPUs) but does not provide environment specifications such as requirements.txt, Dockerfile, or library versions in the paper itself."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "The paper provides detailed algorithm pseudocode (Algorithms 1-5) and hyperparameter settings, but does not include step-by-step reproduction instructions or a 'Reproducing Results' section. The GitHub link may contain a README but the paper itself lacks explicit instructions."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All ASR results in Tables II–VIII are reported as point estimates without confidence intervals or error bars. For example, Table II reports '99.0' for ObliInjection on Amazon Reviews without any uncertainty measure."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims 'ObliInjection substantially outperforms all baseline attacks' based solely on comparing ASR numbers (e.g., 99.0% vs 56.8%) without any statistical significance tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides baseline context for all comparisons. For example, Table II shows ObliInjection at 99.0% vs Combined Attack at 5.9%, Neural Exec at 7.1%, and JudgeDeceiver at 56.8% on Amazon Reviews, making the magnitude of improvement clear."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses 100 target tasks per dataset and 50 permutations for ASR calculation but provides no justification for why these numbers were chosen and no power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "ASR is computed by sampling 50 permutations, but no standard deviation, interquartile range, or other spread measure across those permutations is reported. Only average ASR is given."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Five baselines are compared: Combined Attack, Neural Exec, JudgeDeceiver, and two ablation variants (ObliInjection-GCG and ObliInjection-CE). These are described in Section V-A and compared in Table II."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Neural Exec (AISec 2024), JudgeDeceiver (CCS 2024), and Combined Attack (USENIX Security 2024) are all recent and represent the state of the art in prompt injection attacks."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Extensive ablation studies in Section V-C cover: forms of contaminated segment (Table V), shadow instruction quality (Table VI), number of target tasks (Fig. 4a), buffer size (Fig. 4b), number of shadow sources (Fig. 4c), token/segment candidates (Fig. 5), and component ablations via ObliInjection-GCG and ObliInjection-CE variants."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "The primary attack evaluation uses only a single metric: Attack Success Rate (ASR). FPR/FNR are used for detection defense evaluation but the attack itself is measured solely by ASR."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No systematic human evaluation is performed. The paper mentions manual review of keyword matches ('93.1% exactly match') in the limitations but this is a spot-check of the evaluation metric, not a human evaluation of attack quality."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Step V uses validation shadow segments held out from optimization to select the final contaminated segment. Table IV separately evaluates on 90 target tasks not used during the 10-task optimization, demonstrating held-out evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down per dataset (3 datasets), per LLM (7 models), per attack variant, and per hyperparameter setting across Tables II–VIII and Figures 4–5."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses lower transfer ASR to GPT-4o (24.0% without API access, Section V-C), reduced effectiveness against SecAlign-Adapt (53.3%), and the keyword-matching metric limitation with a specific counterexample ('Some people might think the product is useless, but others love it')."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The ablation variants ObliInjection-GCG (28.0–61.5%) and ObliInjection-CE (85.3–91.0%) show substantially degraded performance, demonstrating that removing either component hurts. The unconstrained form of x achieves only 80.2% average ASR (Table V). Transfer to GPT-4o without API access yields only 24.0%."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'highly effective, even when only one out of 6–100 segments is contaminated' — supported by Table II showing ~99% average ASR. Claims 'existing defenses are insufficient' — supported by Tables VIIa/b. Claims about 'three datasets' and 'twelve LLMs' — confirmed in Section V."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims like 'both the order-oblivious loss and orderGCG are essential' are justified through controlled ablation: ObliInjection-GCG removes orderGCG (keeps order-oblivious loss), ObliInjection-CE removes the loss (keeps orderGCG), each degrading performance substantially. This is adequate single-variable manipulation."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims applicability to 'LLM Agents with Multi-source Data' but no agentic tasks (tool selection, multi-step reasoning) are actually evaluated. The paper tests only summarization and RAG-based QA. Tool selection is discussed conceptually in the introduction but not experimentally validated."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for why ObliInjection succeeds. For example, it does not consider whether the high ASR might be partly due to the keyword-based metric inflating success, whether LLMs' instruction-following tendencies (rather than the optimization) drive the attack, or whether the choice of simple injected responses ('The product is useless!') makes the task artificially easy."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly acknowledges the gap between keyword matching and true semantic success: 'We acknowledge that this simplified metric may introduce inaccuracies' and provides manual verification that 93.1% of keyword matches were exact matches to the attacker's intended output (Section VII)."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Open-weight models are specified with full names (e.g., 'Llama-3-8B-Instruct', 'Mistral-7B-Instruct-v0.3', 'Qwen-2.5-7B-Instruct-1M'). However, GPT-4o and Gemini-2.5-flash are referenced without API version or snapshot date, and these are key models in the transfer experiments (Table III)."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt texts for shadow target instruction generation (Table IX), shadow segment generation for Amazon Reviews (Table X), and Multi-News/HotpotQA (Table XI) are provided in the Appendix. Injected prompts are also specified (e.g., 'Print: The product is useless!')."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section V-A reports all key hyperparameters: dbuf=5, dtok=128, dseg=30, drep=2, diter=200, ns values (10 for Amazon Reviews, 3 for others), dper permutations, 50 permutations for ASR calculation, and segment counts."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The paper evaluates a gradient-based attack optimization algorithm applied directly to LLM inputs, not an agent framework."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section V-A describes how datasets are prepared: 100 target tasks per dataset, Amazon reviews capped at n=100 per product due to context window limits, metadata used for each dataset, shadow segment generation process, and how target tasks are structured as tuples."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section VII is titled 'Conclusion, Limitations, and Future Work' and contains a substantive paragraph discussing the keyword-based evaluation metric limitation with specific examples and manual verification results."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations section discusses a specific threat: the keyword matching metric may count false positives (e.g., 'Some people might think the product is useless, but others love it' would be counted as success despite contradicting the attack intent). They report manual verification finding 93.1% exact matches."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do not show. It does not acknowledge that agentic tool selection was not tested despite being in the title, does not discuss what types of multi-source applications are excluded, and does not state limits on the injected response complexity."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The three evaluation datasets (Amazon Reviews, Multi-News, HotpotQA) are publicly available standard benchmarks. The paper states 'Our code and data are available at' the GitHub repository."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section V-A describes dataset selection, task structure, and dataset statistics (Table I). Each dataset's purpose, segment meaning, and construction are documented. 100 target tasks per dataset, with specified segment counts and length statistics."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are standard public benchmarks (Amazon Reviews, Multi-News, HotpotQA)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full pipeline is documented: dataset selection → target task construction → shadow generation (Step I) → attack optimization (Steps II-IV) → validation selection (Step V) → evaluation via ASR with 50 permutations. Algorithm pseudocode details each stage."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgements section states: 'This work was supported by NSF under grant no. 2450935, 2131859, 2125977, 2112562, and 1937787.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All three authors are from Duke University, clearly stated. They evaluate third-party LLMs (Meta's Llama, Mistral, Qwen, OpenAI GPT-4o, Google Gemini) with no affiliation conflict."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "NSF (National Science Foundation) is a government funding agency with no financial stake in whether the attack succeeds or fails against any particular LLM vendor."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper. Absence of disclosure is not the same as absence of conflict."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates an attack method's effectiveness at manipulating LLM outputs, not a pre-trained model's capability on a knowledge benchmark. The evaluation measures attack success rate, not model knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests attack effectiveness rather than model knowledge. Whether models have seen the benchmark data during training is not relevant to whether the adversarial attack can hijack their output."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — this is a red-teaming/attack study that evaluates adversarial manipulation success, not a capability benchmark evaluation."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All experiments are automated evaluations of attack algorithms on LLMs."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Section VIII describes ethics considerations but these are about responsible disclosure, not human subjects research."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section V-B reports: 'optimizing a contaminated segment for 10 target tasks takes fewer than 4 hours on a single A100 GPU for all evaluated LLMs except Llama-4-17B, and about 13 hours for Llama-4-17B using two H200 GPUs.' Section V-C mentions '120K API queries' for GPT-4o log probability access."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": true,
         "justification": "Hardware (A100 GPU, two H200 GPUs) and approximate wall-clock times are reported for optimization. API query counts for GPT-4o experiments are stated (120K queries)."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. The attack optimization involves randomness (permutation sampling, token candidate selection) but results are not reported across seeds."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "The paper states ASR is calculated over 50 sampled permutations (Section V-A), optimization runs for diter=200 iterations, and specifies all iteration/sample counts in the algorithms."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Default hyperparameter values (dbuf=5, dtok=128, dseg=30, drep=2) are stated but the paper does not report how these defaults were selected or what search budget was used to find them. Ablation studies (Figs. 4-5) show sensitivity but do not constitute a reported search budget."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Step V explicitly selects the best contaminated segment via validation ASR on held-out shadow segments, not on the test data. The selection criterion (highest validation ASR) is clearly described in Algorithm 1 and Section IV-B."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical significance tests are performed, so multiple comparison correction is not applicable. The paper compares methods using point estimates only."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors adapted all baseline attacks (Combined Attack, Neural Exec, JudgeDeceiver) to the multi-source setting themselves. No discussion of whether their adaptations may disadvantage baselines or whether the baselines' original authors would implement them differently."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Section V-A states: 'for attacks such as Neural Exec, JudgeDeceiver, and ObliInjection-GCG that do not employ a beam search strategy, we set dseg = 5×30 to ensure the total computational cost remains approximately consistent across different attack methods, enabling fair comparisons.'"
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the three benchmark datasets (Amazon Reviews, Multi-News, HotpotQA) are representative of real-world multi-source LLM application scenarios, or whether the keyword-based ASR metric accurately captures attack success in practice beyond the 93.1% spot-check."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is involved. The attack is applied directly to LLM inputs without scaffolding/tooling that could confound results."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the evaluated LLMs may have been trained on the benchmark datasets (Amazon Reviews published 2023, Multi-News 2019, HotpotQA 2018). While this is less critical for attack evaluation than capability benchmarks, it could affect the baseline task performance that the attack attempts to hijack."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup provides information not available in a real attack scenario. The shadow segments are synthesized by GPT-4o which may differ from what a real attacker could produce."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of independence between training and test data. The 100 target tasks per dataset are drawn from standard benchmarks without verifying independence from model training data."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is applied."
       }
     }
   },
   "claims": [
     {
       "claim": "ObliInjection achieves ~99% average ASR across three datasets and seven LLMs, even when only one out of 6–100 segments is contaminated.",
       "evidence": "Table II shows average ASR of 99.0% (Amazon Reviews), 98.7% (Multi-News), and 99.6% (HotpotQA) across seven LLMs, with minimum ASR of 93.8% (Mistral-7B on Multi-News).",
       "supported": "strong"
     },
     {
       "claim": "ObliInjection substantially outperforms existing prompt injection attacks in multi-source data settings.",
       "evidence": "Table II shows ObliInjection at 99.0% vs Combined Attack 5.9%, Neural Exec 7.1%, JudgeDeceiver 56.8% on Amazon Reviews. Similar gaps on Multi-News and HotpotQA.",
       "supported": "strong"
     },
     {
       "claim": "Both the order-oblivious loss and the orderGCG algorithm are essential components of ObliInjection.",
       "evidence": "Table II ablations: ObliInjection-GCG (removes orderGCG) averages 28.0–61.5%, ObliInjection-CE (removes order-oblivious loss) averages 85.3–91.0%, vs full ObliInjection at 98.7–99.6%.",
       "supported": "strong"
     },
     {
       "claim": "Contaminated segments optimized on 10 target tasks transfer well to 90 unseen target tasks.",
       "evidence": "Table IV shows average ASR of 97.1% (Amazon Reviews), 97.6% (Multi-News), 96.1% (HotpotQA) on unseen tasks, only slightly below the optimization tasks.",
       "supported": "strong"
     },
     {
       "claim": "ObliInjection transfers to unknown target LLMs, including closed-source models like GPT-4o.",
       "evidence": "Table III shows increasing ASR with more shadow LLMs: 24.0% on GPT-4o without API access (5 shadow LLMs), increasing to 95.2% with log probability access. 87.3% on Gemini-2.5-flash.",
       "supported": "moderate"
     },
     {
       "claim": "Existing prevention-based defenses (StruQ, SecAlign) are insufficient to mitigate ObliInjection.",
       "evidence": "Table VIIa: ASR of 77.9% against StruQ, 63.8% against SecAlign, and 53.3% against adapted SecAlign. Leave-one-segment-out (99.3%) and segment delimiters (96.3%) also fail.",
       "supported": "moderate"
     },
     {
       "claim": "Existing detection-based defenses (PPL, DataSentinel) fail to reliably detect ObliInjection's contaminated segments.",
       "evidence": "Table VIIb: PPL has 92.6% FNR and DataSentinel has 79.6% FNR, while contaminated segments still achieve 85.5–100% ASR across five LLMs.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "Title overgeneralizes beyond experiments",
       "detail": "The title claims applicability to 'LLM Agents with Multi-source Data' but no agentic tasks (tool selection, multi-step reasoning, MCP server manipulation) are experimentally evaluated. Only summarization and RAG-based QA are tested. Tool selection is mentioned conceptually in the introduction but absent from experiments."
     },
     {
       "flag": "No statistical significance testing",
       "detail": "Comparative claims across 7 LLMs × 3 datasets × 6 attacks are made based solely on point estimates of ASR without any statistical significance tests, confidence intervals, or variance measures. With stochastic evaluation (50 random permutations), the variability of ASR estimates is unknown."
     },
     {
       "flag": "Baselines adapted by attack authors",
       "detail": "All baseline attacks (Combined Attack, Neural Exec, JudgeDeceiver) were adapted from their original settings to the multi-source scenario by the ObliInjection authors. No discussion of whether these adaptations fairly represent the baselines' potential, or whether the original authors might adapt them differently."
     },
     {
       "flag": "Simplified evaluation metric",
       "detail": "ASR is measured by keyword matching (checking for 'useless', 'fake', or 'unknown' in the output). While the authors report 93.1% exact match on manual review, this metric conflates partial successes with full successes and does not capture the quality or convincingness of the attack output."
     }
   ],
   "cited_papers": [
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Y. Liu", "Y. Jia", "R. Geng", "J. Jia", "N. Z. Gong"],
       "year": 2024,
       "relevance": "Establishes formal framework and benchmark for prompt injection attacks and defenses, directly foundational to ObliInjection's threat model."
     },
     {
       "title": "Neural exec: Learning (and learning from) execution triggers for prompt injection attacks",
       "authors": ["D. Pasquini", "M. Strohmeier", "C. Troncoso"],
       "year": 2024,
       "relevance": "Gradient-based prompt injection attack targeting RAG systems, a key baseline for ObliInjection's multi-source comparison."
     },
     {
       "title": "Optimization-based prompt injection attack to LLM-as-a-judge",
       "authors": ["J. Shi", "Z. Yuan", "Y. Liu", "Y. Huang", "P. Zhou", "L. Sun", "N. Z. Gong"],
       "year": 2024,
       "relevance": "GCG-based prompt injection targeting LLM-as-a-judge with multi-source data, another key baseline for ObliInjection."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["A. Zou", "Z. Wang", "J. Z. Kolter", "M. Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Introduces the GCG algorithm for adversarial attacks on LLMs, the foundational optimization method that ObliInjection's orderGCG extends."
     },
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["S. Chen", "J. Piet", "C. Sitawarin", "D. Wagner"],
       "year": 2025,
       "relevance": "Prevention-based defense against prompt injection via structured input formatting; evaluated as a defense against ObliInjection."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["S. Chen", "A. Zharmagambetov", "S. Mahloujifar", "K. Chaudhuri", "D. Wagner", "C. Guo"],
       "year": 2025,
       "relevance": "DPO-based defense that fine-tunes LLMs to resist prompt injection; evaluated and shown insufficient against ObliInjection."
     },
     {
       "title": "DataSentinel: A game-theoretic detection of prompt injection attacks",
       "authors": ["Y. Liu", "Y. Jia", "J. Jia", "D. Song", "N. Z. Gong"],
       "year": 2025,
       "relevance": "Game-theoretic detection-based defense against prompt injection; shown to have 79.6% FNR against ObliInjection."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["K. Greshake", "S. Abdelnabi", "S. Mishra", "C. Endres", "T. Holz", "M. Fritz"],
       "year": 2023,
       "relevance": "Foundational work on indirect prompt injection in real-world LLM-integrated applications, establishing the threat landscape ObliInjection addresses."
     },
     {
       "title": "PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models",
       "authors": ["W. Zou", "R. Geng", "B. Wang", "J. Jia"],
       "year": 2025,
       "relevance": "RAG-specific prompt injection attack that assumes attacker controls majority of retrieved passages; contrasted with ObliInjection's single-segment approach."
     },
     {
       "title": "A critical evaluation of defenses against prompt injection attacks",
       "authors": ["Y. Jia", "Z. Shao", "Y. Liu", "J. Jia", "D. Song", "N. Z. Gong"],
       "year": 2025,
       "arxiv_id": "2505.18333",
       "relevance": "Evaluates prompt injection defenses and shows fine-tuned models provide limited defense effectiveness, supporting ObliInjection's defense evasion findings."
     },
     {
       "title": "Lessons from defending Gemini against indirect prompt injections",
       "authors": ["C. Shi", "S. Lin", "S. Song", "J. Hayes", "I. Shumailov"],
       "year": 2025,
       "arxiv_id": "2505.14534",
       "relevance": "Industry perspective from Google on defending against indirect prompt injection, contextualizes the practical relevance of ObliInjection's threat model."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": ["E. Debenedetti", "I. Shumailov", "T. Fan", "J. Hayes", "N. Carlini"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "Software security-based defense approach using security policies on LLM agent actions; discussed as inapplicable to ObliInjection's target scenarios."
     },
     {
       "title": "Prompt injection attack to tool selection in LLM agents",
       "authors": ["J. Shi", "Z. Yuan", "G. Tie", "P. Zhou", "N. Z. Gong", "L. Sun"],
       "year": 2025,
       "arxiv_id": "2504.19793",
       "relevance": "Prompt injection targeting LLM agent tool selection, directly related to the agentic multi-source scenario ObliInjection conceptually addresses."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Security researchers and red-teamers testing multi-source LLM applications can use the released code and technique, though it requires significant compute and ML expertise."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Confirms that prompt injection remains a serious threat; the multi-source ordering angle is novel but doesn't challenge fundamental assumptions."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates a near-100% success rate attack that defeats existing defenses by contaminating just one out of 100 data segments, with implications for RAG, reviews, and AI Overviews."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Shows that StruQ, SecAlign, PPL, and DataSentinel defenses are insufficient, but the paper frames this constructively rather than as controversy."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code and data are released on GitHub, enabling reproduction, though the attack requires GPU compute and model access to run."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "From Duke University's security group; tests against GPT-4o and Gemini but not affiliated with a major AI lab."
     }
   }
 }