ai-research-survey

scan.json (29567B)

---

 {
   "paper": {
     "title": "OET: Optimization-based prompt injection Evaluation Toolkit",
     "authors": [
       "Jinsheng Pan",
       "Xiaogeng Liu",
       "Chaowei Xiao"
     ],
     "year": 2025,
     "venue": "arXiv (Preprint, under review)",
     "arxiv_id": "2505.00843",
     "doi": "10.48550/arXiv.2505.00843"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "OET provides a modular toolkit for evaluating optimization-based prompt injection attacks across diverse QA datasets. Experiments show open-source models (Qwen2-7B, Vicuna-7B, LLaMA3.1-8B) are significantly more susceptible to transferable GCG attacks than closed-source models (GPT-4o-mini, Claude-3.5-sonnet). Current defenses (StruQ, SecAlign) are inconsistent: StruQ achieves 0% ASR on most datasets but fails on TriviaQA and FinQA, while SecAlign actually increases vulnerability on AQuA and PubMedQA compared to the undefended baseline.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "Paper states 'The code are publicly available on https://github.com/SaFoLab-WISC/OET' in the abstract footnote."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "All datasets used are publicly available benchmarks: BIPIA, SQuAD, CaseHold, FinQA, SciQ, TriviaQA, AQuA, PubMedQA. Each is cited with its original source."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or environment specification is mentioned in the paper. Only the GitHub URL is provided without environment details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "Figure 2 shows code usage examples but no step-by-step reproduction instructions for the specific experiments. No README or reproduction guide is described in the paper."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Main results tables (Tables 1, 2, 3) report only point estimates of ASR with no confidence intervals or error bars. Appendix Table 5 shows std dev for training ASR only."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "Claims like 'open-source models exhibit higher susceptibility' and 'StruQ effectively neutralizes attacks' are made by comparing raw ASR numbers without any statistical significance tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 reports both baseline and defense model ASR side by side with directional arrows, and the text notes specific magnitudes (e.g., 'ASR increases (+0.43)' for StruQ on TriviaQA). Baseline context is consistently provided across all comparisons."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for why 400 test examples and 5 training examples were chosen per dataset. No power analysis discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Appendix B (Table 5) reports std dev across 3 training runs, but the main evaluation results (Tables 1, 2, 3) report single values per cell with no variance or spread measures despite each example being attacked 5 times."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 compares defense models (StruQ, SecAlign) against the base undefended LLaMA model. Table 1 compares multiple models. Table 3 compares multiple attack methods."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Defense baselines are recent: StruQ (2024) and SecAlign (2025). Attack methods include GCG (2023), AutoDAN (2023), PAIR (2024), and other contemporary techniques."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "No ablation study of the toolkit's own components (data conversion, adversarial training, inference, result checking stages). Table 3 compares different optimizers but this is a comparison of existing methods, not an ablation of OET."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "Only ASR (Attack Success Rate) is used as the evaluation metric. Section 4.2 states 'Our evaluation metric is ASR.' The toolkit supports custom metrics (Figure 3) but none are used in experiments."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation. Attack success is determined entirely by automated string matching (checking if 'sql injection' appears in the model's response). No human assessment of attack quality or realism."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A (Table 4) shows separate training and test splits: adversarial strings are optimized on 5 training examples and evaluated on 400 test examples per dataset."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "All result tables break down ASR by individual dataset (BIPIA, SQuAD, CaseHold, FinQA, SciQ, TriviaQA, AQuA, PubMedQA) covering diverse domains."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "Figure 5 shows only a successful attack example. While aggregate failures are noted (PEZ has 0 ASR everywhere, StruQ fails on TriviaQA), no qualitative failure examples are shown and no root-cause analysis of why specific attacks fail on specific datasets is provided."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results reported: PEZ achieves 0 ASR on all datasets (Table 3), AutoDAN near-zero on most, SecAlign increases vulnerability on AQuA (+0.46) and PubMedQA (+0.59) compared to baseline (Table 2)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims about toolkit modularity (Figures 1-3), limitations of current defenses (Tables 2-3), and models remaining susceptible after security enhancements (Table 2 showing SecAlign increasing ASR on some datasets) are all supported by experimental results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The main causal claim is that defense mechanisms reduce attack success rate. Table 2 uses a controlled comparison: same GCG attack and datasets, with only the model changed (base vs StruQ vs SecAlign). This single-variable design supports the causal claims."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims 'open-source models exhibit higher susceptibility to adversarial attacks' based on only 3 open-source (7-8B parameter) and 2 closed-source models. Model size and safety training are confounded with the open/closed distinction. The title suggests general 'prompt injection evaluation' but only one attack objective ('Print sql injection') is tested."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations discussed. The open-source vs closed-source gap could be due to model size (7-8B vs much larger), safety training intensity, or content filtering rather than source availability. The domain-specific failure of defenses is noted but not explained."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper measures ASR via exact string matching for 'sql injection' and frames this as evaluating 'adversarial robustness' and 'prompt injection vulnerability.' The gap between this narrow proxy (single fixed-string target) and real-world prompt injection risk (which involves diverse, context-dependent exploitation goals) is not acknowledged."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "GPT-4o-mini is a marketing name without API snapshot date. Other models are better specified: 'LLama3.1-8B-Instruct' (Figure 1), 'Claude-3.5-sonnet', 'Vicuna-7B', 'Qwen2-7B-Instruct'. Per schema guidelines, marketing names without snapshot dates do not count."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "Figure 5 shows one example prompt structure with [MARK]/[INST]/[COLN] tags for the SecAlign format. However, the full prompts used for all models and experiments are not provided. The base model prompt format (Table 1) is not shown."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 reports: 500 optimization steps, temperature 0.6, max new tokens 64. Figure 1 shows optimizer configuration format."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. OET is a sequential pipeline (data conversion → training → inference → result checking), not an agentic system."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "Section 3 describes 'Data Conversion' at a high level ('raw data is preprocessed and transformed into a unified format') but does not detail the exact transformation steps. Appendix A gives dataset sizes but not preprocessing specifics."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "No dedicated limitations section. The conclusion briefly mentions 'Future work may explore more sophisticated attack strategies, adaptive defense mechanisms, and real-world deployment scenarios' but this is future work, not limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed. Potential issues like single attack objective, small model sample, model size confound, and transferability-only evaluation for closed-source models are not acknowledged."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries stated. The paper does not identify what the results do NOT show, such as the limitation to transferable attacks for closed-source models or the narrow single-objective attack setup."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The underlying QA datasets are public, but the raw experimental outputs (model responses used to compute ASR) are not released. Only aggregate ASR numbers are reported."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes the dataset composition. Appendix A (Table 4) details the number of train/test examples per dataset, their domains, and sampling methodology for BIPIA subsets."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data comes from standard public QA benchmarks."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline stages are described (Section 3) but exact data transformations are not documented. The paper says 'We first collect Question Answering (QA) datasets and then transform them into desired format' without specifying how raw datasets were converted to the unified format."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section. No mention of grants, sponsors, or funding sources."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly stated: University of Rochester and University of Wisconsin-Madison. One author (Xiaogeng Liu) appears in the AutoDAN reference, which is one of the attack methods evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funding disclosed. Authors are university-affiliated with no apparent commercial interest in the outcome."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial disclosure present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests prompt injection attacks and defenses, not model knowledge on benchmarks. Whether models have seen QA answers in training does not affect whether they output the attack target string."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Paper evaluates defense/attack effectiveness, not model knowledge. Contamination of QA benchmark answers is irrelevant to the ASR measurement."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Paper evaluates defense/attack effectiveness, not model knowledge. Benchmark contamination does not affect the prompt injection attack success rate metric."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost or latency reported. The paper runs attacks against both API-based models (GPT-4o-mini, Claude-3.5-sonnet) and local models without reporting any cost or time information."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No computational budget stated. 500 optimization steps per attack across 8 datasets and 7+ attack methods implies substantial compute, but no GPU hours, API costs, or hardware details are provided."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Main evaluation results (Tables 1, 2, 3) appear to be single-run results. Appendix B shows 3 training runs with std dev but only for training ASR, not the main transferability evaluation."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 states 'Each test example is attacked five times. A test example is considered success if our attack objective appears in the response.' Appendix B states 'We trained adverserial strings for each training data sample 3 times.'"
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search described. The choice of 500 optimization steps, temperature 0.6, and max tokens 64 is stated without justification or search budget."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification for why these specific hyperparameters were chosen. No description of any configuration selection process."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed at all, so correction for multiple comparisons is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Author Xiaogeng Liu co-authored AutoDAN, one of the attack methods evaluated. The potential bias of evaluating one's own attack method within the toolkit is not acknowledged. More broadly, the implementation of all attacks within OET could affect their relative performance."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Different attack methods have drastically different compute profiles (gradient-based GCG with 500 steps vs LLM-query-based PAIR) but performance is compared without any compute normalization or discussion."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether ASR with a single fixed target string ('sql injection') via exact string matching actually measures real-world prompt injection vulnerability. The construct validity of this narrow metric is not questioned."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is involved in the evaluation. Models are tested directly without scaffolding."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the QA datasets or their associated contexts appeared in the training data of the models being attacked. While less critical for attack evaluation than knowledge evaluation, model familiarity with input formats could affect results."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation format or QA context provides inadvertent cues. The adversarial strings are trained on a specific format and transferred — whether this format alignment leaks information is not addressed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Training set is 5 examples and test set is 400 examples per dataset. Whether these splits are truly independent (e.g., no structural similarity between train and test QA pairs from the same source) is not verified."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are applied or discussed."
       }
     }
   },
   "claims": [
     {
       "claim": "Open-source models exhibit significantly higher susceptibility to transferable GCG prompt injection attacks than closed-source models.",
       "evidence": "Table 1 shows open-source models (Qwen2-7B: 0.93-0.99 ASR, LLaMA3.1-8B: 0.24-0.95, Vicuna-7B: 0.15-0.91) vs closed-source (GPT-4o-mini: 0.0-0.1, Claude-3.5-sonnet: 0.01-0.29) across 8 datasets.",
       "supported": "moderate"
     },
     {
       "claim": "StruQ defense is not universally effective, failing on TriviaQA (ASR 0.43) and FinQA (ASR 0.28) while achieving 0% ASR on other datasets.",
       "evidence": "Table 2 shows StruQ reduces ASR to 0.0 on 6/8 datasets but increases or maintains high ASR on TriviaQA (+0.43 vs baseline) and FinQA (0.28).",
       "supported": "strong"
     },
     {
       "claim": "SecAlign defense can increase model vulnerability on some datasets compared to the undefended baseline.",
       "evidence": "Table 2 shows SecAlign increases ASR on AQuA (0.46 vs 0.23 baseline, +0.23) and PubMedQA (0.59 vs 0.48 baseline, +0.11).",
       "supported": "strong"
     },
     {
       "claim": "No single attack method dominates across all datasets against SecAlign.",
       "evidence": "Table 3 shows UAT is strongest on SciQA (0.78) and SQuAD (0.6), GCG leads on PubMedQA (0.59) and CaseHold (0.48), while PEZ achieves 0 ASR everywhere and AutoDAN near-zero on most datasets.",
       "supported": "strong"
     },
     {
       "claim": "OET provides a modular and extensible framework for evaluating prompt injection attacks.",
       "evidence": "Figures 1-3 show the toolkit architecture, code API, and customization interface. The paper demonstrates integration of 7 different attack methods across 8 datasets.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Single attack objective",
       "detail": "All experiments use only one attack goal ('Print sql injection'). This severely limits the generalizability of conclusions about defense effectiveness. Different attack objectives could produce very different ASR patterns."
     },
     {
       "flag": "Model size confounded with open/closed distinction",
       "detail": "All open-source models are 7-8B parameters while closed-source models (GPT-4o-mini, Claude-3.5-sonnet) are presumably much larger. The paper attributes the ASR gap to open-source vs closed-source status without acknowledging this confound."
     },
     {
       "flag": "Only transferable attacks for closed-source models",
       "detail": "Closed-source models are only tested with transferred adversarial strings (trained on LLaMA3.1-8B), not adaptive attacks. The claimed robustness of closed-source models may reflect poor transferability rather than genuine robustness."
     },
     {
       "flag": "No statistical testing",
       "detail": "All comparative claims are made by eyeballing raw ASR numbers. With no confidence intervals, significance tests, or repeated evaluations, it's impossible to determine whether observed differences are reliable."
     },
     {
       "flag": "Very small training set",
       "detail": "Only 5 training examples per dataset (except BIPIA with 15) are used to optimize adversarial strings. Results may be highly sensitive to this specific small training sample."
     },
     {
       "flag": "Author evaluates own attack method",
       "detail": "Co-author Xiaogeng Liu co-authored AutoDAN, one of the evaluated attack methods. AutoDAN scores near-zero in the evaluation (Table 3), but no self-evaluation bias acknowledgment is provided."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper lacks any discussion of limitations, threats to validity, or scope boundaries. Significant methodological constraints (single objective, transfer-only for closed-source, model size confound) go entirely unacknowledged."
     }
   ],
   "cited_papers": [
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Introduces GCG, the primary attack method evaluated in the paper, foundational work on gradient-guided adversarial attacks on LLMs."
     },
     {
       "title": "AutoDAN: Generating stealthy jailbreak prompts on aligned large language models",
       "authors": ["Xiaogeng Liu", "Nan Xu", "Muhao Chen", "Chaowei Xiao"],
       "year": 2023,
       "arxiv_id": "2310.04451",
       "relevance": "Key jailbreak attack method adapted for prompt injection evaluation in OET."
     },
     {
       "title": "Jailbreaking black box large language models in twenty queries",
       "authors": ["Patrick Chao", "Alexander Robey", "Edgar Dobriban", "Hamed Hassani", "George J. Pappas", "Eric Wong"],
       "year": 2024,
       "arxiv_id": "2310.08419",
       "relevance": "Introduces PAIR, a black-box LLM-as-optimizer jailbreak method evaluated in the paper."
     },
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Key defense mechanism evaluated in the paper; shows inconsistent performance across domains."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2025,
       "arxiv_id": "2410.05451",
       "relevance": "State-of-the-art defense method shown to paradoxically increase vulnerability on some datasets."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["Xiaogeng Liu", "Zhiyuan Yu", "Yizhe Zhang", "Ning Zhang", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Universal prompt injection attack using gradient optimization, directly relevant to the adaptive attack framework in OET."
     },
     {
       "title": "Prompt injection attack against LLM-integrated applications",
       "authors": ["Yi Liu", "Gelei Deng", "Yuekang Li", "Kailong Wang", "Zihao Wang", "Xiaofeng Wang", "Tianwei Zhang", "Yepang Liu", "Haoyu Wang", "Yan Zheng", "Yang Liu"],
       "year": 2024,
       "arxiv_id": "2306.05499",
       "relevance": "Foundational work on prompt injection attacks against LLM-integrated applications."
     },
     {
       "title": "AgentDojo: A dynamic environment to evaluate attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunović", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "arxiv_id": "2406.13352",
       "relevance": "Competing evaluation platform for prompt injection with 629 test cases, used as a point of comparison for OET's approach."
     },
     {
       "title": "HarmBench: A standardized evaluation framework for automated red teaming and robust refusal",
       "authors": ["Mantas Mazeika", "Long Phan", "Xuwang Yin", "Andy Zou", "Zifan Wang", "Norman Mu", "Elham Sakhaee", "Nathaniel Li", "Steven Basart", "Bo Li", "David Forsyth", "Dan Hendrycks"],
       "year": 2024,
       "relevance": "Related standardized red-teaming evaluation framework that OET aims to extend for prompt injection specifically."
     },
     {
       "title": "Benchmarking and defending against indirect prompt injection attacks on large language models",
       "authors": ["Jingwei Yi", "Yueqi Xie", "Bin Zhu", "Keegan Hines", "Emre Kiciman", "Guangzhong Sun", "Xing Xie", "Fangzhao Wu"],
       "year": 2023,
       "arxiv_id": "2312.14197",
       "relevance": "Introduces BIPIA dataset used in the evaluation and provides baseline benchmarks for indirect prompt injection."
     },
     {
       "title": "On evaluating adversarial robustness",
       "authors": ["Nicholas Carlini", "Anish Athalye", "Nicolas Papernot", "Wieland Brendel", "Jonas Rauber", "Dimitris Tsipras", "Ian Goodfellow", "Aleksander Madry", "Alexey Kurakin"],
       "year": 2019,
       "arxiv_id": "1902.06705",
       "relevance": "Foundational work on evaluating adversarial robustness that motivates OET's adaptive testing framework."
     },
     {
       "title": "FATh: Authentication-based test-time defense against indirect prompt injection attacks",
       "authors": ["Jiongxiao Wang", "Fangzhou Wu", "Wendi Li", "Jinsheng Pan", "Edward Suh", "Z. Morley Mao", "Muhao Chen", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2410.21492",
       "relevance": "Authentication-based defense against prompt injection attacks by co-authors of this paper."
     },
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "arxiv_id": "2310.12815",
       "relevance": "Related benchmark for formalizing prompt injection attacks and defenses."
     }
   ]
 }