ai-research-survey

scan.json (33211B)

---

 {
   "paper": {
     "title": "Optimization-based Prompt Injection Attack to LLM-as-a-Judge",
     "authors": [
       "Jiawen Shi",
       "Zenghui Yuan",
       "Yinuo Liu",
       "Yue Huang",
       "Pan Zhou",
       "Lichao Sun",
       "Neil Zhenqiang Gong"
     ],
     "year": 2024,
     "venue": "CCS '24 (ACM SIGSAC Conference on Computer and Communications Security)",
     "arxiv_id": "2403.17710",
     "doi": "10.1145/3658644.3690291"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "JudgeDeceiver, an optimization-based prompt injection attack on LLM-as-a-Judge, achieves 89–99% attack success rates across four open-source LLMs and two benchmarks, vastly outperforming manual prompt injection (max 40.7% ASR) and jailbreak attacks (max 53.6% ASR). The attack transfers across models, with sequences optimized on Llama-3-8B achieving up to 99% ASR on Llama-2-13B and 79% on GPT-4. Three detection-based defenses (known-answer, PPL, PPL-W) are insufficient, with false negative rates of 40–100%.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states: 'Our implementation is available at this repository: https://github.com/ShiJiawenwen/JudgeDeceiver.'"
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available benchmarks MT-Bench and LLMBar. All 10 target question-response pairs for each benchmark are fully specified in the appendix (Figures 13–17). The code repository is provided for reconstruction of evaluation datasets."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, conda environment file, or environment setup section is mentioned in the paper. Only model names and temperature settings are given."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "While Algorithm 1 describes the optimization process and a GitHub repo is provided, the paper does not include step-by-step reproduction instructions, scripts to replicate main experiments, or a 'Reproducing Results' section."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1–12 are reported as point estimates (e.g., '90.8% ASR') without confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims JudgeDeceiver 'outperforms' all baselines by comparing raw ASR/PAC numbers (e.g., Table 2, Table 3) without any statistical significance tests such as p-values, t-tests, or bootstrap tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports absolute improvements with baseline context, e.g., 'ASR improvements ranging from 37.2% to 78.7% on MTBench and 43.3% to 92.1% on LLMBar' (Section 4.2), and provides both ASR-B (baseline error rate) and ASR for interpreting improvement magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The choice of 10 target QR pairs, 500 clean responses, 3 shadow candidate response sets, and 600 optimization iterations is not justified. No power analysis or rationale for these specific numbers is provided."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "While temperature=0 makes LLM generation deterministic, the optimization process in Algorithm 1 involves random token selection (step 9), yet no variance across optimization runs, standard deviations, or spread measures are reported."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares against 6 manual prompt injection attacks (naive, escape characters, context ignore, fake completion, combined, fake reasoning) in Table 2 and 4 jailbreak attacks (TAP, PAIR, AutoDAN, GCG) in Table 3."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Jailbreak baselines include GCG (2023), AutoDAN (2023), TAP (2023), and PAIR (2023), which are contemporary and represent state-of-the-art adversarial attack methods."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table 4 ablates the three loss terms one by one. Figure 6 ablates hyperparameters α and β. Additional ablations cover shadow response numbers (Figure 5), initialization types (Table 5), injected sequence locations (Table 6), and sequence length effects."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Four evaluation metrics are defined and used: ACC (accuracy), ASR-B (baseline attack success rate), ASR (attack success rate), and PAC (positional attack consistency), as defined in Section 4.1.4."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated through LLM-as-a-Judge outputs. No human evaluation of attack quality, detectability, or the injected sequences' naturalness is included."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The injected sequence is optimized using shadow candidate responses (Section 3.2), while evaluation uses a separate set of 500 clean responses per benchmark generated by 10 different LLMs (Section 4.1.1). The evaluation responses are never seen during optimization."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Tables 1a and 1b provide per-question-response pair breakdowns (QR-1 through QR-10) for all four metrics across all four models and both datasets."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses cases where the attack is less effective: QR-8 and QR-9 on Mistral-7B achieve only 71% and 77% ASR (Table 1a). The defense evaluation (Section 6) shows where defenses partially succeed. Figure 6 shows hyperparameter settings that degrade performance."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 4 shows removing loss terms hurts performance. Figure 6 shows excessive α=10 drops ASR to 82% and β≥0.5 severely reduces ASR. Table 5 shows 'Character' initialization achieves only 70% ASR. The tradeoff between stealthiness (L_perplexity) and attack effectiveness is explicitly discussed."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'highly effective' (supported by 89–99% ASR in Table 1), 'much more effective than existing prompt injection attacks' (supported by Table 2 showing manual attacks max at 40.7%), and 'defenses are insufficient' (supported by Tables 11–12 showing 40–100% FNR). All claims are substantiated."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims about component contributions are supported by controlled ablation studies: Table 4 removes individual loss terms (single-variable manipulation), showing L_aligned and L_enhancement each reduce ASR when removed. This constitutes adequate controlled experimentation for the causal claims made."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title says 'Prompt Injection Attack to LLM-as-a-Judge' without qualification. The threat model assumes open-source LLMs (Section 2.2), but main evaluation is on four 7B–8B models. Transferability to larger/proprietary models is mixed (5% to 79% ASR from Llama-2-7B to GPT-4, Table 7). The broad title and abstract do not bound claims to the tested model scale."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for why the attack succeeds. No confounding factors are considered, such as whether the attack exploits specific model weaknesses vs. general LLM-as-a-Judge vulnerabilities, or whether the high ASR on some models (e.g., Llama-2-7B at 31% ASR-B baseline) reflects weak judging rather than strong attacks."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The metrics (ASR, PAC) directly measure what is claimed — the attack success rate is defined as the probability of the target response being selected, and this is exactly what the paper claims to optimize. No proxy gap exists between measurement and framing."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Several key models lack exact version identifiers. 'Mistral-7B-Instruct' does not specify v0.1 vs v0.2. 'gpt-3.5-turbo' lacks a snapshot date (changes over time). While some models are specific ('gpt-4-0125-preview', 'mistral-large-2407'), the main evaluation models are insufficiently specified."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The LLM-as-a-Judge prompt template is shown in Figure 2. Manual attack prompts are provided in Table 15. Shadow response generation prompts are in Table 14. Target response generation prompt is in Figure 12. Detection prompts are given in Section 6."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1.3 reports: temperature=0, 600 optimization iterations, suffix length=20 tokens, initial token='correct'. Default α and β values are explored in Figure 6. Top-K and batch size B parameters are described in Section 3.4."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. JudgeDeceiver is a direct gradient-based optimization attack, not an agentic system."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1.1 documents: target question selection criteria (covering various topics), target response generation using GPT-3.5-turbo with manual selection of 'most unsuitable' response, clean response generation from 10 LLMs (10 per LLM per question, manually selecting 50 high-quality ones), and shadow response generation via rephrased prompts."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated Limitations or Threats to Validity section. The conclusion (Section 8) mentions two future work directions in a single sentence but provides no substantive discussion of limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed. The paper does not address potential threats such as the small number of target QR pairs (10), reliance on specific prompt templates, or the gap between simulated scenarios and real deployments."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper does not explicitly state what the results do NOT show, such as limitations to specific model scales, the reliance on white-box access for optimization, or that real-world deployments may differ from the simulated settings."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "While code is released, the specific experimental outputs (all 500 clean responses per benchmark, optimization logs, raw model outputs for all experiments) are not mentioned as being available."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1.1 describes data collection: target questions selected from MT-Bench and LLMBar covering diverse topics, target responses generated via GPT-3.5-turbo, clean responses generated by 10 named LLMs with manual quality selection. Case study data sources are also described (Sections 5.1–5.3)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are standard benchmarks (MT-Bench, LLMBar) and LLM-generated responses."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: benchmark selection → target question selection → target response generation (GPT-3.5-turbo + manual selection) → clean response generation (10 LLMs × 10 responses → manually select 50) → shadow response generation (5 prompts × 1 LLM). Each step and its filtering criteria are described."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information, acknowledgments section, or grant numbers are mentioned in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All author affiliations are clearly listed: Huazhong University of Science and Technology, University of Notre Dame, Lehigh University, and Duke University."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Since no funding source is disclosed, independence of the funder cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial interest declarations are present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not state the training data cutoff dates for any of the four evaluated LLMs (Mistral-7B, Openchat-3.5, Llama-2-7B, Llama-3-8B). MT-Bench and LLMBar questions could be in their training data, affecting judging behavior."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the LLMs used as judges have seen MT-Bench or LLMBar data during pre-training. The models' familiarity with benchmark questions could confound both baseline accuracy (ACC) and attack success measurements."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "MT-Bench (2024) and LLMBar (2023) were published around the same time or before the models' training. No discussion of whether exposure to these benchmarks affects the judging behavior being attacked."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All experiments involve automated LLM evaluation."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study involves only automated attacks on LLM systems."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No API costs, tokens consumed, wall-clock time, or cost per attack are reported. The optimization requires 600 iterations of gradient computation on LLMs, but no cost quantification is provided."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No GPU hours, hardware specifications, or total compute budget are stated. The paper mentions 'larger computational resource consumption and GPU memory requirements' for larger m (Section 4.3) but does not quantify these."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "While temperature=0 makes LLM generation deterministic, the optimization in Algorithm 1 involves random token selection (step 9) and random subset sampling (step 8). No seed sensitivity analysis or results across multiple random seeds are reported."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of optimization runs per experiment is not explicitly stated. It is unclear whether each reported ASR comes from a single optimization run or is averaged over multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "While Figure 6 explores α and β values and several ablation dimensions are covered, the total search budget (number of configurations tried, compute spent on search) is not reported."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "Default settings (α=1, β=0.1, suffix length=20) are used but the selection rationale is not clearly stated. Figure 6 shows performance landscapes but does not explain whether selection was based on a validation set or the test data itself."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes many comparative claims across 4 models, 2 datasets, 10 QR pairs, and 10+ baseline methods without any correction for multiple comparisons or family-wise error rate."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement all 6 manual prompt injection baselines themselves (Table 15) and extend 4 jailbreak attacks to their setting. No acknowledgment of potential author-evaluation bias in implementing and evaluating these baselines."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "JudgeDeceiver requires 600 iterations of gradient-based optimization per QR pair while manual attacks require no optimization. This compute asymmetry is not discussed. Table 3 shows injected sequence lengths but not the optimization cost to produce them."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "MT-Bench and LLMBar are used without questioning whether they adequately represent real-world LLM-as-a-Judge deployment scenarios. The constructed evaluation datasets (10 QR pairs, 500 clean responses) are assumed to be representative without validation."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is involved. The attack directly optimizes token sequences via gradient descent."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. MT-Bench and LLMBar were published before or around the time the evaluated models were trained, creating potential temporal leakage in the models' judging behavior."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. The evaluation setup provides the LLM with the full question and both responses, which mirrors the intended use case, but no analysis of whether this setup inadvertently leaks information is provided."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. The shadow responses used for optimization and the clean responses used for evaluation are generated by potentially overlapping LLMs, which could introduce dependencies."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is used. No canary strings, membership inference tests, or decontamination pipelines are applied."
       }
     }
   },
   "claims": [
     {
       "claim": "JudgeDeceiver achieves average attack success rates of 89–99% across four LLMs on two benchmarks.",
       "evidence": "Table 1 shows average ASRs: Mistral-7B 90.8%/93.2%, Openchat-3.5 89.2%/88%, Llama-2-7B 98.9%/98.1%, Llama-3-8B 97.6%/97% on MT-Bench/LLMBar respectively (Section 4.2).",
       "supported": "strong"
     },
     {
       "claim": "JudgeDeceiver significantly outperforms manual prompt injection attacks, which achieve a maximum ASR of no more than 40.7%.",
       "evidence": "Table 2 compares JudgeDeceiver against 6 manual attacks across 4 models and 2 datasets. The highest manual ASR is 40.7% (Fake Reasoning on Llama-2-7B LLMBar) vs JudgeDeceiver's 98.1% (Section 4.2).",
       "supported": "moderate"
     },
     {
       "claim": "JudgeDeceiver outperforms jailbreak attacks when adapted to the LLM-as-a-Judge problem.",
       "evidence": "Table 3 compares against TAP, PAIR, AutoDAN, and GCG on Mistral-7B. JudgeDeceiver achieves 90.8% ASR vs AutoDAN's 53.6% (best jailbreak) on MT-Bench (Section 4.2).",
       "supported": "moderate"
     },
     {
       "claim": "Known-answer detection cannot detect target responses with JudgeDeceiver's injected sequences (90–100% FNR).",
       "evidence": "Table 11 on Mistral-7B shows FNR of 90% on MT-Bench and 100% on LLMBar for known-answer detection, with 0% FPR (Section 6.4).",
       "supported": "strong"
     },
     {
       "claim": "Perplexity-based defenses (PPL and PPL-W) are insufficient, missing 40–90% of attacked responses.",
       "evidence": "Tables 11–12 show FNRs: PPL detection 50–80%, PPL-W detection 40–90% across models and datasets, while maintaining near-zero FPR (Section 6.4).",
       "supported": "strong"
     },
     {
       "claim": "The attack transfers across LLMs, with sequences optimized on Llama-3-8B achieving high ASR on other models.",
       "evidence": "Table 7 shows Llama-3-8B optimized sequences achieve 99% ASR on Llama-2-13B, 91% on Llama-3-70B, 88% on Claude3-Haiku, 79% on GPT-4. Llama-2-7B sequences transfer less well (e.g., 5% on GPT-4) (Section 4.3).",
       "supported": "moderate"
     },
     {
       "claim": "All three loss terms (L_aligned, L_enhancement, L_perplexity) contribute to attack effectiveness.",
       "evidence": "Table 4 shows removing L_aligned drops ASR from 97% to 87%, removing L_enhancement drops ASR to 84%, and removing L_perplexity increases ASR slightly to 98% but at the cost of stealthiness (Section 4.3).",
       "supported": "strong"
     },
     {
       "claim": "JudgeDeceiver is effective in three real-world scenarios: LLM-powered search (80–100% ASR), RLAIF (95–100% ASR), and tool selection (80–100% ASR).",
       "evidence": "Tables 8, 9, and 10 show results across scenario-specific evaluation sets on Mistral-7B (Section 5).",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No statistical tests for superiority claims",
       "detail": "All claims that JudgeDeceiver 'outperforms' baselines are based on comparing raw ASR/PAC numbers across Tables 2–3 without any statistical significance tests. Given the stochastic optimization process, results could vary across runs."
     },
     {
       "flag": "No error bars or variance across optimization runs",
       "detail": "Despite the optimization process involving random token selection (Algorithm 1, step 9), all results are reported as single point estimates. The stability of the attack across different random seeds is unknown."
     },
     {
       "flag": "Self-implemented baselines",
       "detail": "The authors implement all 6 manual prompt injection baselines and adapt all 4 jailbreak attacks to their setting. The implementations may not represent the best configurations of these methods. No acknowledgment of potential author-evaluation bias."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper lacks any dedicated discussion of limitations, threats to validity, or scope boundaries. Key limitations such as reliance on white-box model access, computational cost of optimization, small number of target QR pairs (10), and gap between simulated and real deployments are unaddressed."
     },
     {
       "flag": "Compute cost asymmetry ignored",
       "detail": "JudgeDeceiver requires 600 iterations of gradient-based optimization per target QR pair on open-source LLMs, while manual baselines require no computation. This asymmetry is never quantified or discussed, making the comparison unfair without cost context."
     },
     {
       "flag": "Case studies simulate rather than test real deployments",
       "detail": "The three 'real-world' case studies (LLM-powered search, RLAIF, tool selection) use simulated setups with Mistral-7B, not actual deployed systems. Bing Chat and Bard use proprietary models with unknown defenses, making generalization to real systems uncertain."
     }
   ],
   "cited_papers": [
     {
       "title": "GPT-4 Technical Report",
       "authors": ["Josh Achiam", "Steven Adler", "Sandhini Agarwal"],
       "year": 2023,
       "arxiv_id": "2303.08774",
       "relevance": "Foundational LLM used as clean response generator and transferability target in the evaluation."
     },
     {
       "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
       "authors": ["Andy Zou", "Zifan Wang", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "GCG attack method used as both a baseline and foundation for gradient-based token optimization in JudgeDeceiver."
     },
     {
       "title": "Formalizing and Benchmarking Prompt Injection Attacks and Defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Standardized framework for prompt injection attacks; provides combined attack baseline and detection-based defense methods evaluated in this paper."
     },
     {
       "title": "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "arxiv_id": "2302.12173",
       "relevance": "Foundational work on indirect prompt injection attacks against LLM-integrated applications, directly relevant to the threat model."
     },
     {
       "title": "Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena",
       "authors": ["Lianmin Zheng", "Wei-Lin Chiang", "Ying Sheng"],
       "year": 2024,
       "relevance": "Introduces the LLM-as-a-Judge concept and MT-Bench dataset used as the primary evaluation benchmark in this paper."
     },
     {
       "title": "RLAIF: Scaling Reinforcement Learning from Human Feedback with AI Feedback",
       "authors": ["Harrison Lee", "Samrat Phatale", "Hassan Mansoor"],
       "year": 2023,
       "arxiv_id": "2309.00267",
       "relevance": "Introduces RLAIF paradigm that uses LLM-as-a-Judge for automated preference annotation, one of three case studies demonstrating attack impact."
     },
     {
       "title": "AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models",
       "authors": ["Xiaogeng Liu", "Nan Xu", "Muhao Chen", "Chaowei Xiao"],
       "year": 2023,
       "arxiv_id": "2310.04451",
       "relevance": "Jailbreak attack baseline using hierarchical genetic algorithm; most competitive jailbreak method in the comparison (53.6% ASR)."
     },
     {
       "title": "MetaGPT: Meta Programming for Multi-Agent Collaborative Framework",
       "authors": ["Sirui Hong", "Xiawu Zheng", "Jonathan Chen"],
       "year": 2023,
       "arxiv_id": "2308.00352",
       "relevance": "Multi-agent framework using tool selection via LLM-as-a-Judge, motivating the tool selection attack scenario."
     },
     {
       "title": "PLeak: Prompt Leaking Attacks against Large Language Model Applications",
       "authors": ["Bo Hui", "Haolin Yuan", "Neil Gong", "Philippe Burlina", "Yinzhi Cao"],
       "year": 2024,
       "relevance": "Related prompt-level attack on LLM applications, demonstrating the broader vulnerability surface of LLM-integrated systems."
     },
     {
       "title": "StruQ: Defending against Prompt Injection with Structured Queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Defense approach using structured queries to prevent prompt injection, relevant to developing mitigations against attacks like JudgeDeceiver."
     },
     {
       "title": "Llama 2: Open Foundation and Fine-tuned Chat Models",
       "authors": ["Hugo Touvron", "Louis Martin", "Kevin Stone"],
       "year": 2023,
       "arxiv_id": "2307.09288",
       "relevance": "Open-source LLM family used as both evaluation target and transferability source in the attack evaluation."
     },
     {
       "title": "MetaTool Benchmark: Deciding Whether to Use Tools and Which to Use",
       "authors": ["Yue Huang", "Jiawen Shi", "Yuan Li"],
       "year": 2023,
       "relevance": "Benchmark for LLM tool usage awareness, used as the evaluation dataset for the tool selection attack case study."
     },
     {
       "title": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically",
       "authors": ["Anay Mehrotra", "Manolis Zampetakis", "Paul Kassianik"],
       "year": 2023,
       "arxiv_id": "2312.02119",
       "relevance": "Tree-based jailbreak attack method used as a baseline, demonstrating limitations of black-box approaches for this attack setting."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Directly relevant to anyone deploying LLM-as-a-Judge for search, RLAIF, or tool selection, but requires white-box access to open-source models for optimization."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Prompt injection attacks are well-known; the contribution is demonstrating optimization-based attacks are far more effective than manual ones in the LLM-as-a-Judge setting, which extends rather than overturns expectations."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates 90%+ attack success on LLM evaluation systems with three defenses proven insufficient, raising serious concerns about the integrity of LLM leaderboards, RLAIF training, and agent tool selection."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Implies LLM leaderboard rankings could be manipulated, but does not directly accuse any specific entity or call out existing benchmark results as fraudulent."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code released on GitHub (https://github.com/ShiJiawenwen/JudgeDeceiver), but running it requires open-source LLMs with GPU access for gradient computation."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Authors from HUST, Notre Dame, Lehigh, and Duke — well-regarded universities but not major AI labs. Published at CCS, a top security venue."
     }
   }
 }