ai-research-survey

scan.json (32576B)

---

 {
   "paper": {
     "title": "PISanitizer: Preventing Prompt Injection to Long-Context LLMs via Prompt Sanitization",
     "authors": [
       "Runpeng Geng",
       "Yanting Wang",
       "Chenlong Yin",
       "Minhao Cheng",
       "Ying Chen",
       "Jinyuan Jia"
     ],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2511.10720",
     "doi": "10.48550/arXiv.2511.10720"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "PISanitizer defends against prompt injection in long-context LLMs by using an attention-based sanitization approach that intentionally lets an LLM follow any instructions in context, then removes high-attention tokens driving instruction-following behavior. Across 6 LongBench datasets, 7 LLMs (including GPT-5), and multiple attack types, PISanitizer reduces attack success rates to near 0 while maintaining utility, outperforming baselines like Meta-SecAlign. The design creates an inherent dilemma for attackers: the more effective an injected instruction compels an LLM to follow it, the more likely it is to be sanitized.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states: 'The code is available at https://github.com/sleeepeer/PISanitizer.' A concrete repository URL is provided."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "All datasets used are publicly available benchmarks: LongBench, TaskTracker, AlpacaFarm, SQuAD-v2, Dolly, InjecAgent, and AgentDojo. Attack implementations reference open-source code from prior work."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions '96GB H100 GPU' for runtime and scipy.signal for implementation, but no requirements.txt, Dockerfile, or detailed environment specification is provided."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "While Algorithm 1 is provided and hyperparameters are detailed in Appendix B, the paper does not include step-by-step reproduction instructions, a README with commands, or scripts to replicate experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1-14 are point estimates. No confidence intervals, error bars, or ± notation appears anywhere in the paper."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims 'PISanitizer outperforms baselines' and 'significantly outperform state-of-the-art baselines' by comparing raw numbers in Table 4 without any statistical significance tests (no p-values, t-tests, etc.)."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Tables report absolute values for both baseline and PISanitizer (e.g., ASR drops from 0.92 to 0.0, utility maintained at 0.59 vs 0.59 without attack), providing sufficient context for the magnitude of effects."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "They use 100 samples per dataset (selected from 200 in LongBench) with no justification for why 100 is sufficient and no power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance across runs, or spread measures are reported. All results appear to be from single experimental runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 4 compares against 7 baselines: Sandwich Prevention, Instructional Prevention, Meta-SecAlign, PromptArmor, PromptLocate, DataFilter, plus detection-based defenses (DataSentinel, PromptGuard, AttentionTracker)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include very recent work: Meta-SecAlign (2025), DataSentinel (2025), DataFilter (2025), PromptLocate (2026), AttentionTracker (2025). These represent the current state of the art."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 ablates: consecutive token joint consideration vs. individual thresholding (Table 7), different sanitization instructions (Table 8), noise-aware vs. average attention aggregation (Table 9), and hyperparameter sensitivity (Figure 3)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Evaluation uses both Utility (task-specific: F1, ROUGE-L, Edit Sim, exact match) and ASR. Table 14 additionally reports token-level precision, recall, and F1-score. Table 4 also reports runtime."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated. ASR uses string matching or LLM-as-a-judge (Appendix D). Utility uses automated metrics from LongBench. No human evaluation of PISanitizer's outputs."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The paper selects 100 samples per dataset for evaluation but does not describe any held-out test set separate from data used to tune hyperparameters (ws, d, θ). It is unclear whether the same data used for ablation was used for final reporting."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by dataset (6 tasks), attack type (6 heuristic + GCG), backend LLM (7 models), injected task type (4 types), context length (Table 13), and token-level sanitization accuracy per dataset (Table 14)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 discusses failure with knowledge corruption attacks (non-instructional manipulation). Section 6.2 discusses failure with benign instructions in context (11/13 AgentDojo utility loss cases). Section 6.1 also discusses potential 'weak' attacks."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.2 reports utility loss on AgentDojo (0.82 → 0.71 without attacks). Section 6.1 reports PISanitizer cannot restore full utility when injected data (not just instructions) is present. Table 11 notes LCC utility doesn't fully recover."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims (ASR near 0, maintained utility, outperforms baselines, efficient at ~1.8s, robust to adaptive attacks) are all supported by Tables 1, 2, 4, 10, and associated text in Section 5."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims (sanitization reduces ASR) are supported by controlled ablation experiments in Section 5.3: removing consecutive token consideration (Table 7), changing sanitization instructions (Table 8), and comparing attention aggregation strategies (Table 9) isolate component contributions."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 explicitly states failure modes: knowledge corruption attacks (6.1), benign instructions (6.2), and potential weak attacks (6.1). The scope is bounded to instruction-based prompt injection. Title is appropriately scoped to 'Prompt Injection to Long-Context LLMs.'"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not consider alternative explanations for PISanitizer's effectiveness. It does not discuss whether, e.g., the sanitization process itself (context modification) contributes to reduced ASR independent of the attention mechanism, or whether removal of any random tokens might partially achieve the same effect."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "Metrics directly measure what is claimed: ASR measures attack success (string match or LLM judge), Utility measures task performance (F1, ROUGE-L, etc.). No proxy gap exists between measurement and framing."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Open-source models are specified (Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen3-Omni-30B-A3B-Instruct) but closed-source models are listed only as 'GPT-4o', 'GPT-4o-mini', 'GPT-4.1', 'GPT-5' without snapshot dates or API versions."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full sanitization instructions provided in Section 4.1 and Appendix C (4 variants). Injected task prompts in Appendix A. LLM-as-a-judge prompt in Appendix D. GCG suffix initialization in Appendix E."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Appendix B details: ws=9 (>500 tokens) or ws=5 (<500 tokens), d=10, θ=0.01, max 5 repetitions. GCG: 500 iterations, suffix of 50 tokens. Adaptive attack: β=5000. Peak filtering threshold 0.005."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "PISanitizer is a preprocessing/sanitization step, not agentic scaffolding. No agentic workflow, tool use, or multi-step scaffolding is involved in the defense mechanism itself."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 describes dataset construction: 100 random samples per dataset from LongBench's 200, random injection location for contaminated contexts. Appendix A describes target answer generation using GPT-4o with the exact prompt. Appendix E details suffix initialization for GCG attacks."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 'Discussion and Limitation' contains substantive discussion in two subsections: 6.1 'Core Motivations of PISanitizer' (failure conditions with experiments) and 6.2 'Benign Instructions in a Context' (with AgentDojo experiments)."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 identifies specific threats: (1) knowledge corruption attacks bypass PISanitizer because they don't use explicit instructions, with experimental validation on Open-Prompt-Injection. (2) 'Weak' attacks that receive low attention could evade detection. Section 6.2: benign instructions removed in 11/13 AgentDojo failure cases."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 explicitly states PISanitizer cannot defend against knowledge corruption (non-instructional manipulation) and may fail against 'weak' attacks with low attention. Section 6.2 states it cannot distinguish benign from malicious instructions. Future work is bounded to multimodal extension."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (per-sample results, attention weight dumps, individual trial outcomes) is released. Only aggregate metrics are reported in tables."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 describes data sources (LongBench with 6 datasets, 200 samples each, 100 selected), how contaminated contexts are constructed, and injected task construction (Appendix A)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from standard public benchmarks (LongBench, TaskTracker, AlpacaFarm, SQuAD-v2, Dolly, InjecAgent, AgentDojo)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: benchmark selection → sample selection (100/200) → contaminated context construction (attack-specific injection at random location) → evaluation with ASR/Utility metrics. Appendices A, D, E provide implementation details."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the paper. Funding sources are not disclosed."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All authors are affiliated with The Pennsylvania State University, clearly stated in the header. They are not affiliated with any company whose products are evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Cannot determine funder independence because no funding source is disclosed. Without disclosure, independence cannot be verified."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement appears in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense mechanism (PISanitizer) against prompt injection, not model knowledge or capability on benchmarks. Contamination of benchmark data in model training is not the relevant concern here."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates a defense rather than model capability. Whether the model has seen LongBench tasks during training is not the primary evaluation concern."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defense effectiveness against prompt injection, not pre-trained model knowledge. Benchmark contamination is structurally inapplicable to this evaluation focus."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All evaluation is automated using benchmark datasets and LLM-as-a-judge."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Study involves only automated evaluation on benchmark datasets."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 4 reports runtime in seconds for all methods across 6 datasets. Section 5.2 states: 'it takes around 1.8s for PISanitizer to sanitize a very long input containing thousands of tokens.' Runtime is measured on a 96GB H100 GPU."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions '96GB H100 GPU' for runtime measurement but does not state total computational budget (total GPU hours, total experiments, API costs for closed-source LLMs like GPT-5)."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. Results appear to be from single runs. The random sample selection (100/200) and random injection locations are not assessed for sensitivity."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not state how many runs produced the reported results. No 'averaged over K runs' or similar statement appears."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Hyperparameters (ws, d, θ) are reported and ablated in Figure 3 and Appendix F, but no search budget is stated — it is unclear how the default values were selected."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "Default hyperparameters (ws=9, d=10, θ=0.01) are stated in Appendix B but no justification for their selection is provided. The ablation study (Figure 3) shows robustness but does not explain how these specific defaults were chosen."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper performs many comparisons across 6 datasets × multiple attacks × multiple baselines with no correction for multiple comparisons (no Bonferroni, Holm, or similar)."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors re-implement PromptArmor themselves ('As there is no open-source implementation for PromptArmor, we implement it ourselves') and compare against it without acknowledging potential author-evaluation bias."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Table 4 reports runtime alongside performance but does not show performance as a function of compute budget. No analysis at matched compute levels or performance curves across compute. PromptLocate is ~50x slower but this tradeoff is not systematically analyzed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses LongBench as the primary benchmark without discussing whether its tasks are representative of real-world prompt injection scenarios. No discussion of construct validity for the evaluation setup."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "PISanitizer is a preprocessing defense applied uniformly across all model comparisons, not a scaffold. The paper does not compare models with different scaffolding."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether LongBench tasks (published 2024) could appear in training data of models like GPT-5 or Llama-3.1. Temporal leakage is not addressed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For example, the sanitization LLM (Llama-3.1-8B) might have seen similar attack patterns during training."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether training and test data share structural similarities. The 100 samples per dataset are randomly selected but independence is not verified."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is applied (no canary strings, membership inference, or decontamination)."
       }
     }
   },
   "claims": [
     {
       "claim": "PISanitizer reduces attack success rates to nearly 0 across 6 datasets and multiple prompt injection attacks including GCG optimization-based attacks.",
       "evidence": "Table 1 shows ASR ≤ 0.04 across all 6 LongBench datasets and 6 attack types (most entries 0.0). GCG attack ASR reduced from 0.82-1.0 to 0.0-0.02.",
       "supported": "strong"
     },
     {
       "claim": "PISanitizer maintains utility comparable to no-defense settings on clean contexts.",
       "evidence": "Table 1 shows identical or near-identical utility scores with and without PISanitizer when no attack is present (e.g., HotpotQA: 0.59 vs 0.59, GovReport: 0.34 vs 0.34).",
       "supported": "strong"
     },
     {
       "claim": "PISanitizer generalizes effectively across 7 different backend LLMs including GPT-5.",
       "evidence": "Table 2 shows ASR reduced to ≤ 0.02 across all 7 LLMs (Llama-3.1-8B, Llama-3.1-70B, Qwen3-Omni-30B, GPT-4o, GPT-4o-mini, GPT-4.1, GPT-5) while maintaining utility.",
       "supported": "strong"
     },
     {
       "claim": "PISanitizer significantly outperforms state-of-the-art baselines including Meta-SecAlign.",
       "evidence": "Table 4 shows PISanitizer achieves ASR 0.0-0.02 under GCG attack while Meta-SecAlign has ASR 0.85-1.0. Under Combined Attack, PISanitizer achieves ASR 0.0-0.01 vs Meta-SecAlign 0.0-0.58. However, no statistical significance tests are used.",
       "supported": "moderate"
     },
     {
       "claim": "PISanitizer is efficient, taking around 1.8 seconds to sanitize a context with thousands of tokens.",
       "evidence": "Table 4 shows PISanitizer runtime of 10.14-13.92s total (including backend LLM generation), comparable to other defenses except PromptLocate (633-761s). The sanitization-specific time of ~1.8s is stated in Section 5.2.",
       "supported": "strong"
     },
     {
       "claim": "PISanitizer is robust to optimization-based and heuristic adaptive attacks.",
       "evidence": "Table 10 shows ASR ≤ 0.04 across 6 adaptive attacks (4 heuristic, 2 optimization-based), though these represent specific adaptive strategies the authors designed rather than a comprehensive adversarial evaluation.",
       "supported": "moderate"
     },
     {
       "claim": "PISanitizer achieves high precision (0.80) and recall (0.90) for token-level sanitization of injected prompts.",
       "evidence": "Table 14 provides per-dataset, per-attack precision/recall/F1 for token sanitization. Average across all settings: 0.80 precision, 0.90 recall, 0.82 F1-score.",
       "supported": "strong"
     },
     {
       "claim": "Existing detection-based defenses are ineffective for long-context prompt injection.",
       "evidence": "Table 5 shows DataSentinel and AttentionTracker have 1.0 FPR (flag everything as contaminated), while PromptGuard has 0.50-0.99 FNR (misses most injections).",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or variance reporting",
       "detail": "All results across Tables 1-14 are point estimates from apparently single experimental runs. With 100 samples per dataset and random injection locations, variance across sample selections and injection positions could be substantial but is never quantified."
     },
     {
       "flag": "No statistical significance tests",
       "detail": "The paper claims PISanitizer 'significantly outperforms' baselines (Section 1) based solely on comparing raw numbers across many datasets and attack types, without any statistical tests to support these comparative claims."
     },
     {
       "flag": "Self-implemented baseline",
       "detail": "PromptArmor is re-implemented by the authors ('As there is no open-source implementation for PromptArmor, we implement it ourselves and use GPT-4o') creating potential for unfair comparison. No validation of their re-implementation against the original is provided."
     },
     {
       "flag": "Adaptive attacks designed by defenders",
       "detail": "All 6 adaptive attacks (Section 5.4) are designed by the authors/defenders themselves. The paper does not involve external red-teamers or independent adversarial evaluation, which could miss stronger attack strategies."
     },
     {
       "flag": "No held-out validation",
       "detail": "Hyperparameters (ws=9, d=10, θ=0.01) appear tuned on the same data used for evaluation. No separate validation split is described for hyperparameter selection."
     }
   ],
   "cited_papers": [
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Y. Liu", "Y. Jia", "R. Geng", "J. Jia", "N. Z. Gong"],
       "year": 2024,
       "relevance": "Key benchmark paper formalizing prompt injection attacks and defenses, provides the Open-Prompt-Injection benchmark and attack implementations used in this evaluation."
     },
     {
       "title": "Meta SecAlign: A secure foundation LLM against prompt injection attacks",
       "authors": ["S. Chen", "A. Zharmagambetov", "D. Wagner", "C. Guo"],
       "year": 2025,
       "arxiv_id": "2507.02735",
       "relevance": "State-of-the-art fine-tuning-based defense against prompt injection; primary baseline comparison showing PISanitizer's superiority."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["S. Chen", "A. Zharmagambetov", "S. Mahloujifar", "K. Chaudhuri", "D. Wagner", "C. Guo"],
       "year": 2025,
       "relevance": "DPO-based defense against prompt injection; precursor to Meta-SecAlign and relevant baseline for understanding fine-tuning-based defense approaches."
     },
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["S. Chen", "J. Piet", "C. Sitawarin", "D. Wagner"],
       "year": 2024,
       "relevance": "Prevention-based defense using special delimiters and fine-tuning; foundational work in the fine-tuning defense family."
     },
     {
       "title": "DataSentinel: A game-theoretic detection of prompt injection attacks",
       "authors": ["Y. Liu", "Y. Jia", "J. Jia", "D. Song", "N. Z. Gong"],
       "year": 2025,
       "relevance": "State-of-the-art detection-based defense for prompt injection; key baseline shown to be ineffective for long contexts."
     },
     {
       "title": "Neural exec: Learning (and learning from) execution triggers for prompt injection attacks",
       "authors": ["D. Pasquini", "M. Strohmeier", "C. Troncoso"],
       "year": 2024,
       "relevance": "Optimization-based prompt injection attack learning execution triggers; demonstrates advanced attack techniques evaluated against PISanitizer."
     },
     {
       "title": "The instruction hierarchy: Training LLMs to prioritize privileged instructions",
       "authors": ["E. Wallace", "K. Xiao", "R. Leike", "L. Weng", "J. Heidecke", "A. Beutel"],
       "year": 2024,
       "relevance": "OpenAI's instruction hierarchy defense deployed in GPT-4o-mini; relevant prevention-based approach to prioritizing system messages over third-party content."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["K. Greshake", "S. Abdelnabi", "S. Mishra", "C. Endres", "T. Holz", "M. Fritz"],
       "year": 2023,
       "relevance": "Foundational paper on indirect prompt injection attacks against real-world LLM applications."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": ["E. Debenedetti", "I. Shumailov", "T. Fan", "J. Hayes", "N. Carlini"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "CaMeL defense using security policies and control/data flow analysis to prevent prompt injection; alternative defense paradigm discussed as a limitation."
     },
     {
       "title": "A critical evaluation of defenses against prompt injection attacks",
       "authors": ["Y. Jia", "Z. Shao", "Y. Liu", "J. Jia", "D. Song", "N. Z. Gong"],
       "year": 2025,
       "arxiv_id": "2505.18333",
       "relevance": "Critical evaluation showing fine-tuning-based defenses are vulnerable to optimization-based attacks, motivating PISanitizer's different approach."
     },
     {
       "title": "PromptLocate: Localizing prompt injection attacks",
       "authors": ["Y. Jia", "Y. Liu", "Z. Shao", "J. Jia", "N. Z. Gong"],
       "year": 2026,
       "relevance": "Attribution-based defense localizing injected prompts in context; key baseline comparison showing PISanitizer's better utility-effectiveness tradeoff."
     },
     {
       "title": "Defending against prompt injection with DataFilter",
       "authors": ["Y. Wang", "S. Chen", "R. Alkhudair", "B. Alomair", "D. Wagner"],
       "year": 2025,
       "arxiv_id": "2510.19207",
       "relevance": "Concurrent work training a sequence-to-sequence model to filter injected instructions; baseline comparison showing PISanitizer's advantage in long contexts."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["A. Zou", "Z. Wang", "N. Carlini", "M. Nasr", "J. Z. Kolter", "M. Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "GCG attack method used as the optimization-based attack in this paper's evaluation."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Q. Zhan", "Z. Liang", "Z. Ying", "D. Kang"],
       "year": 2024,
       "relevance": "Benchmark for evaluating prompt injection in LLM agents; used to evaluate PISanitizer in agent scenarios."
     },
     {
       "title": "AgentDojo: A dynamic environment to evaluate attacks and defenses for LLM agents",
       "authors": ["E. Debenedetti", "J. Zhang", "M. Balunović", "L. Beurer-Kellner", "M. Fischer", "F. Tramèr"],
       "year": 2024,
       "relevance": "Dynamic environment for evaluating prompt injection attacks and defenses in LLM agents; used to test PISanitizer's limitations with benign instructions."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "PISanitizer is a deployable defense that works as a preprocessing step with any backend LLM, including closed-source ones like GPT-5, and code is released."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "The core insight reverses conventional wisdom: instead of preventing LLMs from following injected instructions (the standard approach), PISanitizer intentionally encourages it, creating an attacker dilemma."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that existing defenses (including GPT-4o-mini's built-in protection) fail for long-context prompt injection, raising security concerns for production LLM applications."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no claims of misconduct, no drama — straightforward defense research."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code is released on GitHub (https://github.com/sleeepeer/PISanitizer) and only requires an open-source LLM (Llama-3.1-8B) and scipy."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Penn State is a known university but not a famous AI lab. Paper evaluates GPT-5 which adds some brand appeal."
     }
   }
 }