ai-research-survey

scan.json (33310B)

---

 {
   "paper": {
     "title": "PIGuard: Prompt Injection Guardrail via Mitigating Overdefense for Free",
     "authors": [
       "Hao Li",
       "Xiaogeng Liu",
       "Ning Zhang",
       "Chaowei Xiao"
     ],
     "year": 2025,
     "venue": "ACL 2025 (Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics, Volume 1: Long Papers)",
     "doi": "10.18653/v1/2025.acl-long.1468"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "PIGuard, a DeBERTa-based prompt guard model trained with the Mitigating Over-defense for Free (MOF) strategy, achieves 83.48% average accuracy across benign, malicious, and over-defense detection, substantially outperforming the best open-source baseline ProtectAIv2 (64.01%) while maintaining comparable inference speed. The NotInject benchmark reveals that all existing open-source prompt guard models suffer severe over-defense, with accuracy below 60% (near random guessing at 50%). The MOF approach, which identifies biased tokens via single-token probing and generates debiasing training data, effectively mitigates over-defense without requiring any over-defense-specific dataset, and outperforms traditional shortcut mitigation methods that degrade malicious detection performance.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper states in the abstract: 'The code and datasets are released at https://github.com/leolee99/PIGuard.' A specific GitHub URL is provided."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The NotInject dataset and training data are released at the GitHub repository. Additionally, the training data is collected from 20 open-source datasets which are all individually cited and publicly available (Tables 4-6, Appendix A)."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper specifies the backbone (DeBERTaV3-base) and training hyperparameters (Sec 5.1) but does not provide a requirements.txt, Dockerfile, or detailed environment specification with library versions."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "Training details are given in Section 5.1 (batch size, epochs, learning rate, optimizer) but the paper does not include step-by-step reproduction instructions. A GitHub repository is linked but its contents cannot be verified from the paper text."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1, 2, 3, 7, 9, and 10 report only point estimates (e.g., '83.48%') with no confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims PIGuard 'surpasses' and 'outperforms' baselines based solely on comparing raw accuracy numbers. No statistical significance tests (t-tests, bootstrap, etc.) are used for any comparative claims."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper consistently reports improvements with baseline context, e.g., 'PIGuard achieves an average accuracy of 83.48%... exceeding the top open-source model, ProtectAIv2, by 30.4%' (Sec 5.2). Table 1 provides all absolute numbers enabling magnitude assessment."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "NotInject contains 339 samples (113 per difficulty level). The MOF generates 1,000 samples. Neither sample size is justified through power analysis or principled reasoning. The 1,000 MOF sample count is selected via ablation (Table 9) rather than a priori justification."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Results appear to be single-run with no mention of multiple experimental runs, random seeds, or any spread measure (std dev, IQR). No variance is reported anywhere in the paper."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares against 5 prompt guard models (Fmops, Deepset, PromptGuard, ProtectAIv2, LakeraGuard) and 3 LLM-based methods (GPT-4o, Llama-2-chat, LlamaGuard3), as shown in Table 1."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include current state-of-the-art models: ProtectAIv2 (2024), LakeraGuard (2024), GPT-4o (2024), and LlamaGuard3 (2024). These represent the most recent prompt guard solutions available."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 presents a comprehensive ablation study showing the individual and combined effects of basic dataset training, data-centric augmentation, and MOF (with finetuning vs. scratch retrain). Table 3 compares MOF against standard shortcut mitigation. Table 9 ablates MOF sampling scale."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper evaluates on three accuracy dimensions (over-defense, benign, malicious), plus GFLOPs, inference time, and efficiency (accuracy/time). Table 1 reports all six metrics."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation of PIGuard and baselines is fully automated using accuracy on benchmark datasets. No human evaluation of the system's detection outputs was conducted. Human evaluators were only used for dataset construction (trigger word refinement), not system evaluation."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "NotInject is explicitly not used for training (MOF generates its own data independently). PINT and WildGuard are external benchmarks. BIPIA uses a train/test split (Table 5 lists 'BIPIA_train' separately from test evaluation in Table 7)."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 7 provides per-benchmark breakdowns for all models across NotInject subsets (one-word, two-word, three-word), WildGuard, PINT, and BIPIA. Table 8 shows topic category distribution within NotInject."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper shows failure cases of OTHER models (Figures 2, 3, 7) but does not analyze where PIGuard itself fails. No error analysis or qualitative examples of PIGuard's failures are provided despite ~17% error rate."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 shows data-centric augmentation alone HURTS over-defense accuracy (75.22% → 64.31%). Table 3 shows standard shortcut mitigation degrades malicious accuracy by 10.42%. Table 9 shows diminishing returns at 2,000 MOF samples."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of 'surpassing the existing best model by 30.4%' and '87.32% over-defense accuracy' are supported by Table 1 data, though the 30.4% figure represents relative improvement ((83.48-64.01)/64.01) rather than the more commonly expected absolute difference (19.47pp), which is slightly misleading but technically supported."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper's causal claims about MOF improving performance are supported by controlled ablation studies (Table 2) with single-variable manipulation: basic dataset → +augmentation → +MOF, with each component isolated. Table 3 further compares MOF against an alternative approach using the same base model."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims PIGuard is 'a robust and open-source solution for detecting prompt injection attacks' without bounding to the tested benchmarks (PINT, BIPIA, WildGuard, NotInject). The limitations section acknowledges gaps in domain-specific applications but the title and abstract framing is broader than the tested settings."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper attributes PIGuard's success entirely to MOF and data-centric augmentation without discussing alternative explanations. For example, the specific choice of DeBERTaV3-base backbone, the training data distribution, or the particular mix of open-source datasets could contribute to the results, but these are not explored."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures accuracy on specific benchmarks and frames results in terms of these specific metrics (over-defense accuracy, benign accuracy, malicious accuracy). Claims match the granularity of measurements without inflating proxy metrics to broader outcomes."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "DeBERTaV3-base is specified. GPT-4o-mini is versioned ('2024-07-18 version'). However, GPT-4o is used as a key baseline without a snapshot date or API version. LlamaGuard3 lacks a specific version. Multiple models lack precise versioning."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt text is provided in Appendix D: Figure 10 (word-based generation), Figure 11 (LLM injection detection, used for both data refinement and LLM baseline evaluation), and Figure 12 (data augmentation). The paper states 'the same prompts are employed to facilitate malicious content detection by GPT-4o and Llama-2-chat.'"
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "PIGuard training hyperparameters are well-documented (Sec 5.1: batch size 32, 3 epochs, Adam optimizer, lr 2e-5, 100-step warmup, max token length 512). However, temperature and sampling settings for GPT-4o, GPT-4o-mini, and Llama-2-chat API calls are not stated, which affects reproducibility of both data generation and baseline evaluation."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "PIGuard is a text classification model (DeBERTa-based). No agentic scaffolding is used."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 documents the full NotInject construction pipeline (trigger word identification → refinement → corpus generation) with Algorithm 1. Section 4.1 details training data collection from 20 datasets with counts (Tables 4-6). Section 4.2 describes MOF data generation. Data pipeline stages and counts are documented."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' section is present after the Conclusions, discussing the NotInject dataset's potential shortcomings in capturing real-world diversity, particularly in domain-specific applications like healthcare and finance."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations section mentions specific concerns: 'the NotInject dataset, while carefully designed, may not fully capture the diversity of real-world benign inputs, particularly in domain-specific applications. This could result in the underestimation of models' over-defense tendency in complex, sensitive fields such as healthcare or finance.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The limitations discuss future work directions but do not explicitly state what the results do NOT show. No explicit boundaries on which languages, attack types, or deployment scenarios are excluded from the claims. The paper does not state specific things it did not test beyond the general mention of domain-specific gaps."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The NotInject dataset and code are released at https://github.com/leolee99/PIGuard. Training data is sourced from 20 publicly available open-source datasets, all individually cited with links in Appendix A."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 provides detailed data collection procedures for NotInject (trigger word identification via word frequency analysis, refinement via LLM + human evaluation, corpus generation). Section 4.1 describes training data collection from 20 sources with counts. Algorithm 1 formalizes the trigger word identification process."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "Three human evaluators with 'security expertise' were used for trigger word refinement (Sec 3.2), but their recruitment method, specific qualifications, and potential selection biases are not described. Only the evaluation protocol (5-point frequency scale, Figure 6) is provided."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full data pipeline is documented: Section 3.2 shows the 3-step NotInject construction pipeline with Figure 4. Section 4.1 documents training data aggregation from 20 sources with counts at each stage (Tables 4-6). Section 4.2 describes the MOF pipeline (token recheck → generation → refinement → retraining). Figure 9 reports error ratios after generation."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding sources, grants, or sponsors are mentioned anywhere in the paper. There is no acknowledgments section disclosing funding."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly stated: Washington University in St. Louis and University of Wisconsin-Madison. These are academic institutions not directly affiliated with any evaluated product."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence of funding cannot be assessed. The university affiliations suggest likely academic funding (NSF, etc.) which would be independent, but this is not stated."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement is present in the paper. There is no declaration of financial interests, patents, or equity."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates a defense tool (PIGuard, a fine-tuned DeBERTa classifier) rather than testing a pre-trained model's knowledge on benchmarks. The LLM baselines (GPT-4o, etc.) are contextual comparisons, not the main contribution."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense tool rather than evaluating pre-trained model capability on benchmarks. Per schema guidelines, contamination items are NA for studies that test defenses/tools rather than model knowledge."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense tool rather than evaluating pre-trained model capability on benchmarks. Per schema guidelines, contamination items are NA for defense/tool evaluation studies."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human subjects study is conducted. Three human evaluators assist with dataset annotation (trigger word refinement) but this is not a human subjects study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human subjects study is conducted. The paper includes an Ethics Statement but no IRB approval is needed for dataset annotation work."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human subjects study. Human evaluators are described only as having 'security expertise.'"
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human subjects study is conducted."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human subjects study is conducted."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human subjects study is conducted."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human subjects study is conducted."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 reports GFLOPs (60.45) and inference time (15.34ms) for PIGuard and all baselines. An efficiency metric (accuracy/inference time) is also computed. Figure 1 visualizes the performance-efficiency tradeoff."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Training compute is not stated. The paper reports training hyperparameters (Sec 5.1) but does not quantify total GPU hours, training time, or API costs for data generation with GPT-4o-mini."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. Results appear to be from a single training run."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. It is unclear whether results are from single or multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Hyperparameters are stated (Sec 5.1) but no search budget, number of configurations tried, or search method is reported. Only the MOF sampling scale is ablated (Table 9 tests 3 values)."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Table 9 transparently shows the selection of 1,000 MOF samples by comparing 500, 1,000, and 2,000 samples with the 1,000 configuration yielding the best average accuracy (83.48%). Table 2 shows all ablation configurations that led to the final design."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Multiple comparisons are made across 8+ models on 4+ benchmarks with no statistical tests at all, let alone multiple comparison corrections."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors train and evaluate PIGuard against baselines without acknowledging author-evaluation bias. While the baselines are existing models (not re-implemented), the evaluation setup and benchmark selection are controlled by the authors."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 reports both performance (accuracy) and compute (GFLOPs, inference time) for all models. Figure 1 plots performance vs. time efficiency. The paper discusses how PIGuard achieves comparable accuracy to GPT-4o at 503x higher efficiency."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses PINT, BIPIA, WildGuard, and NotInject benchmarks without discussing whether these benchmarks capture real-world prompt injection detection needs or whether benchmark performance translates to deployment effectiveness."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. All models are classifiers or directly prompted LLMs, with no scaffold-dependent comparisons."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Training data includes datasets like BIPIA_train, TaskTracker, and jailbreak-classification that share origins with test benchmarks. No discussion of temporal relationships between training and test data creation."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup could inadvertently leak information. For example, the NotInject dataset is constructed using the same trigger word identification methodology that could overlap with PIGuard's MOF-identified tokens."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Training uses BIPIA_train (Table 5) while testing on BIPIA (Table 7). Training uses TaskTracker and jailbreak-classification which share structural similarities with test sets. The independence of train and test examples is not explicitly verified or discussed."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is applied. No decontamination pipeline, overlap analysis, or membership checks between training and test data."
       }
     }
   },
   "claims": [
     {
       "claim": "PIGuard achieves 83.48% average accuracy across benign, malicious, and over-defense detection, surpassing the best open-source model (ProtectAIv2) by 30.4%.",
       "evidence": "Table 1 shows PIGuard at 83.48% average accuracy vs. ProtectAIv2 at 64.01%. The 30.4% is relative improvement ((83.48-64.01)/64.01 ≈ 30.4%), not absolute difference (19.47pp). Section 5.2.",
       "supported": "strong"
     },
     {
       "claim": "Existing open-source prompt guard models suffer severe over-defense, with accuracy below 60% (near random guessing at 50%).",
       "evidence": "Table 1 shows over-defense accuracy: Fmops 28.32%, Deepset 29.50%, PromptGuard 0.29%, ProtectAIv2 57.23%. All below 60%. Evaluated on NotInject (339 samples). Section 3.3 and Figure 5.",
       "supported": "strong"
     },
     {
       "claim": "The MOF strategy effectively mitigates over-defense without relying on over-defense-specific datasets.",
       "evidence": "Table 2 ablation shows MOF with scratch retrain improves over-defense from 64.31% to 87.32% when combined with data-centric augmentation, using only automatically generated debiasing data. Section 4.2.",
       "supported": "strong"
     },
     {
       "claim": "PIGuard achieves performance comparable to GPT-4o while being a lightweight DeBERTa-based model.",
       "evidence": "Table 1: PIGuard 83.48% average vs. GPT-4o 85.53% average, with PIGuard inference time of 15.34ms vs. GPT-4o's 7907.18ms. PIGuard is 503x more efficient. Section 5.2.",
       "supported": "moderate"
     },
     {
       "claim": "Data-centric augmentation alone worsens the over-defense problem.",
       "evidence": "Table 2: Over-defense accuracy drops from 75.22% (basic dataset) to 64.31% after adding data-centric augmentation. Section 5.3.",
       "supported": "strong"
     },
     {
       "claim": "MOF outperforms traditional shortcut mitigation methods, which degrade malicious detection performance.",
       "evidence": "Table 3: Standard shortcut mitigation achieves 86.73% over-defense but only 65.53% malicious (10.42% drop). MOF achieves 87.32% over-defense AND 77.39% malicious. Section 5.4.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No variance or uncertainty reporting",
       "detail": "All results across Tables 1, 2, 3, 7, 9, and 10 report single point estimates with no error bars, confidence intervals, standard deviations, or multiple-run results. It is impossible to assess result stability."
     },
     {
       "flag": "No statistical significance tests",
       "detail": "All comparative claims ('surpasses', 'outperforms') are based on raw number comparisons without any statistical significance testing. Given the lack of variance reporting, it is unclear whether the differences are meaningful."
     },
     {
       "flag": "Ambiguous improvement percentage",
       "detail": "The abstract and Section 5.2 claim PIGuard 'surpasses' ProtectAIv2 'by 30.4%'. This is a relative improvement, but 'by X%' is conventionally read as percentage points in ML. The absolute improvement is 19.47pp. Table 1 caption reports 30.8%, inconsistent with the 30.4% figure."
     },
     {
       "flag": "Potential train/test data overlap",
       "detail": "Training data includes datasets (BIPIA_train, TaskTracker, jailbreak-classification) from the same sources as test benchmarks. While train/test splits appear to be honored, independence is not explicitly verified or discussed."
     },
     {
       "flag": "LLM-dependent data construction and evaluation",
       "detail": "GPT-4o-mini is used for both NotInject corpus generation AND safety verification (refinement), creating a potential circularity. If GPT-4o-mini has systematic blind spots, both construction and verification would share them."
     }
   ],
   "cited_papers": [
     {
       "title": "Ignore Previous Prompt: Attack Techniques For Language Models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Foundational work identifying the concept of prompt injection attacks, including goal hijacking and prompt leakage."
     },
     {
       "title": "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "arxiv_id": "2302.12173",
       "relevance": "Key work on indirect prompt injection attacks against real-world LLM-integrated applications."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["Xiaogeng Liu", "Zhiyuan Yu", "Yizhe Zhang", "Ning Zhang", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Automatic attack generation methods for prompt injection, providing context for defense evaluation."
     },
     {
       "title": "Prompt Injection Attacks and Defenses in LLM-Integrated Applications",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2023,
       "arxiv_id": "2310.12815",
       "relevance": "Survey of prompt injection attack and defense landscape for LLM-integrated applications."
     },
     {
       "title": "Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models",
       "authors": ["Jingwei Yi", "Yueqi Xie", "Bin Zhu", "Keegan Hines", "Emre Kiciman", "Guangzhong Sun", "Xing Xie", "Fangzhao Wu"],
       "year": 2023,
       "arxiv_id": "2312.14197",
       "relevance": "BIPIA benchmark for indirect prompt injection, used as a key evaluation dataset in this paper."
     },
     {
       "title": "Are you still on track!? Catching LLM task drift with activations",
       "authors": ["Sahar Abdelnabi", "Aideen Fay", "Giovanni Cherubin", "Ahmed Salem", "Mario Fritz", "Andrew Paverd"],
       "year": 2024,
       "arxiv_id": "2406.00799",
       "relevance": "TaskTracker dataset for detecting LLM task drift from prompt injection, used in training data."
     },
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunović", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "arxiv_id": "2406.13352",
       "relevance": "Dynamic evaluation environment for LLM agent attacks and defenses."
     },
     {
       "title": "Llama Guard: LLM-based input-output safeguard for human-AI conversations",
       "authors": ["Hakan Inan", "Kartikeya Upasani", "Jianfeng Chi"],
       "year": 2023,
       "arxiv_id": "2312.06674",
       "relevance": "LLM guardrail approach for detecting unsafe content, represents alternative defense paradigm to prompt guard models."
     },
     {
       "title": "StruQ: Defending Against Prompt Injection with Structured Queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David A. Wagner"],
       "year": 2024,
       "relevance": "Structured query defense approach against prompt injection, an alternative defense strategy."
     },
     {
       "title": "Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attacks",
       "authors": ["Dario Pasquini", "Martin Strohmeier", "Carmela Troncoso"],
       "year": 2024,
       "arxiv_id": "2403.03792",
       "relevance": "Novel attack method using learned execution triggers for prompt injection."
     },
     {
       "title": "Tensor Trust: Interpretable Prompt Injection Attacks from an Online Game",
       "authors": ["Sam Toyer", "Olivia Watkins", "Ethan Adrian Mendes"],
       "year": 2023,
       "arxiv_id": "2311.01011",
       "relevance": "Gamified prompt injection attack dataset providing real-world attack examples."
     },
     {
       "title": "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks",
       "authors": ["Seungju Han", "Kavel Rao", "Allyson Ettinger"],
       "year": 2024,
       "arxiv_id": "2406.18495",
       "relevance": "Open-source moderation tool and benchmark used for benign accuracy evaluation in this paper."
     },
     {
       "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Benchmark for indirect prompt injection in tool-integrated LLM agents, used as training data source."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 3,
       "justification": "PIGuard is a fully open-source, lightweight prompt guard model with released code, data, and model weights that a practitioner could deploy immediately for prompt injection detection."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The finding that guard models have over-defense issues is somewhat expected given known shortcut learning problems in NLP classifiers; the MOF solution is novel but not contrarian."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that existing prompt injection defenses (including Meta's PromptGuard) are unreliable, with accuracy near random guessing on trigger-word inputs, raising concerns about deployed defense systems."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Names specific commercial and open-source products (Meta PromptGuard, ProtectAI, Lakera) as deficient but presents findings in standard academic framing without controversy."
     },
     "demo_ability": {
       "score": 3,
       "justification": "Code, model, and datasets are released on GitHub (https://github.com/leolee99/PIGuard), making it immediately testable."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "From university researchers (WashU, UW-Madison) rather than a major AI lab; published at ACL which is prestigious but not a household name."
     }
   }
 }