ai-research-survey

scan.json (30345B)

---

 {
   "paper": {
     "title": "PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization",
     "authors": [
       "Yang Jiao",
       "Xiaodong Wang",
       "Kai Yang"
     ],
     "year": 2025,
     "venue": "SIGIR '25 (48th International ACM SIGIR Conference on Research and Development in Information Retrieval)",
     "arxiv_id": "2504.07717",
     "doi": "10.1145/3726302.3730058"
   },
   "scan_version": 3,
   "active_modules": [
     "experimental_rigor",
     "data_leakage"
   ],
   "methodology_tags": [
     "benchmark-eval",
     "theoretical"
   ],
   "key_findings": "PR-Attack jointly poisons both the prompt (via a backdoor trigger in soft prompts) and the knowledge database (via optimized poisoned texts), formulated as a bilevel optimization problem. It achieves 90–100% attack success rate across 6 LLMs and 3 QA datasets with only a single poisoned text per target question. When the trigger is inactive, the system achieves higher accuracy than naive RAG, demonstrating stealth. All tested models are small open-source LLMs (1B–7B parameters).",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository URL is provided anywhere in the paper. No GitHub, Zenodo, or other archive link is mentioned."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses three publicly available QA datasets: Natural Questions (NQ), HotpotQA, and MS-MARCO, following the same setup as PoisonedRAG [104]. These are standard public benchmarks."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications are provided — no requirements.txt, Dockerfile, library versions, or hardware details. Only model names and sizes are listed."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No reproduction instructions are included. Algorithm 1 describes the optimization procedure at a mathematical level, but no runnable scripts or step-by-step instructions are provided."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "Figures 2 and 3 show error bars (standard deviation) for the average performance across LLMs for both ASR and ACC metrics."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used. Claims that PR-attack 'outperforms' baselines are based solely on comparing point estimates in Tables 1 and 2 without any p-values, t-tests, or other tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Tables 1 and 2 provide absolute ASR and ACC percentages for all methods across all settings, giving sufficient baseline context to assess the magnitude of improvement (e.g., PR-attack 93% vs. PoisonedRAG 62% on NQ with Vicuna)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The number of target questions used for evaluation is not stated or justified. The paper says it follows PoisonedRAG's setup but does not specify the sample size or provide any justification."
       },
       "variance_reported": {
         "applies": true,
         "answer": true,
         "justification": "Figures 2 and 3 report standard deviations across LLMs. The paper states PR-attack 'exhibits a low standard deviation, highlighting both its effectiveness and broad applicability.'"
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Six baseline methods are compared: GCG Attack, Corpus Poisoning, Disinformation Attack, Prompt Poisoning, GGPP, and PoisonedRAG (Table 1). For stealth evaluation, comparison against without-RAG and naive RAG baselines is provided (Table 2)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include recent methods: PoisonedRAG (2024), GGPP (2024), GCG Attack (2023), and Corpus Poisoning (2023). These represent the state of the art in RAG attacks."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "The system has two key components (poisoned texts and soft prompt/trigger) but no ablation study removes one component while keeping the other within PR-attack's own framework. The comparisons with prompt-only (Prompt Poisoning) and RAG-only (PoisonedRAG) methods are separate implementations, not controlled ablations."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Two metrics are used: Attack Success Rate (ASR) for attack effectiveness (Table 1) and Accuracy (ACC) for stealth evaluation when the trigger is not activated (Table 2)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is included. Evaluation is entirely automated using substring matching for ASR, following PoisonedRAG's setup. The paper notes this 'yields ASRs comparable to those obtained through human evaluation' per [104] but does not perform its own human evaluation."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The soft prompt and poisoned texts are optimized for specific target questions (Eq. 2), and ASR is evaluated on those same target questions. There is no separation between optimization targets and evaluation targets."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down per LLM (6 models) and per dataset (NQ, HotpotQA, MS-MARCO) in Tables 1 and 2, and parameter sensitivity is shown per LLM in Figures 4 and 5."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No failure cases are discussed. The paper does not analyze when or why PR-attack fails, even though ASR is not 100% in all settings."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "No negative results are reported. Every experiment shows PR-attack achieving the best performance. No configurations that failed or approaches that were tried and abandoned are mentioned."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'high attack success rate even with a limited number of poisoned texts and significantly improved stealth.' Table 1 confirms 90%+ ASR with a single poisoned text, and Table 2 confirms ACC exceeding naive RAG."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims joint optimization of prompt and poisoned texts 'enables the proposed method to achieve superior performance' (Sec. 4.2), but there is no controlled ablation within PR-attack's own framework to isolate the contribution of each component. Comparisons with separate methods (Prompt Poisoning, PoisonedRAG) use different implementations and cannot establish causality."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims attacks on 'Large Language Models' generically, but all six tested models are small open-source LLMs (1B–7B parameters). No commercial API models (GPT-4, Claude) or larger models are tested. The paper also uses only one retriever (Contriever) but claims generality about RAG systems."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations are discussed. For example, the paper does not consider whether smaller models are inherently more vulnerable, whether Contriever-specific properties enable the attack, or why ACC exceeds naive RAG when the trigger is inactive."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "ASR directly measures what is claimed (whether the LLM generates the target answer when the trigger is activated). ACC directly measures correctness when the trigger is inactive. The measurements match the stated claims without proxy gaps."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are listed as 'Vicuna 7B', 'LLaMA-2 7B', 'LLaMA-3.2 1B', 'GPT-J 6B', 'Phi-3.5 3.8B', 'Gemma-2 2B' with paper citations, but exact versions are not specified (e.g., Vicuna 1.3 vs 1.5, LLaMA-2 base vs chat). No snapshot dates or version identifiers are given."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "Figure 1 shows a prompt template ('Question: ... Contexts: ... Please generate a response...') and the trigger word 'cf' is stated. However, the soft prompt consists of 15 learned embedding tokens that cannot be represented as text and are not provided. The actual prompts sent to the models cannot be fully reconstructed."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Key hyperparameters are stated in Sec. 4.1: b=20 tokens per poisoned text, n=15 trainable soft prompt tokens, k=5 retrieved texts, temperature=0.5, trigger word 'cf'. Step sizes and smoothing parameters for the optimization are not specified."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The approach directly optimizes prompts and poisoned texts for a standard RAG pipeline without any agentic workflow."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper says target questions and answers are 'generated according to the procedure described in [104]' without reproducing the details. The number of target questions, how they were selected, and how knowledge databases were set up are not documented in this paper."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations, threats to validity, or similar section. The paper contains Introduction, Related Work, Method, Experiment, and Conclusion with no limitations discussion."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed anywhere in the paper. There is no consideration of potential confounds or methodological weaknesses."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper does not acknowledge what was NOT tested (e.g., larger models, other retrievers, defense mechanisms, real-world deployment conditions)."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data or outputs are released. Only aggregated results in tables and figures are provided."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "Data collection is delegated to prior work: 'the target questions and answers are generated according to the procedure described in [104].' The paper does not describe how many target questions were used, how knowledge databases were constructed, or what the data characteristics are."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are standard QA benchmarks (NQ, HotpotQA, MS-MARCO)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The optimization algorithm is described (Algorithm 1), but the full pipeline from raw datasets to final evaluation numbers is not documented. How models were loaded, how retrieval was implemented, and how ASR was computed via substring matching are not detailed."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The Acknowledgments section lists funding: NSFC grants 12371519 and 61771013, Asiainfo Technologies, Fundamental Research Funds for Central Universities, Shanghai Jiading District funds, and Tongji University PhD overseas research funding."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Tongji University (Yang Jiao, Kai Yang) and Columbia University (Xiaodong Wang). These institutions do not produce the evaluated models."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Funders include NSFC (Chinese government), Asiainfo Technologies, and university research funds. None of the funders produce the LLMs being evaluated (Vicuna, LLaMA, GPT-J, etc.), so they appear independent of the outcome."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is included in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates are stated for any of the six models used. This is relevant because the QA benchmarks (NQ 2019, HotpotQA 2018, MS-MARCO 2016) predate all models and could be in training data."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the QA benchmark questions and answers appeared in the models' training data. Since all benchmarks predate all models by years, significant overlap is likely."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "NQ (2019), HotpotQA (2018), and MS-MARCO (2016) were all published years before any of the tested models were trained. Contamination risk is not addressed. This is especially relevant for the ACC metric — if models have memorized correct answers, ACC comparisons are confounded."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or wall-clock time is reported. The bilevel optimization requires iterative gradient estimation and LLM forward passes, but no cost figures are provided."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Theoretical complexity is analyzed (Eq. 12) but no actual compute budget is stated — no GPU hours, hardware specs, training/optimization time, or total compute cost."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No results across multiple random seeds are reported. The standard deviations in Figures 2 and 3 are across different LLMs, not across seeds for a given configuration."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. It is unclear whether results are from single runs or averaged over multiple trials."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. Parameters b=20, n=15, k=5 are stated as defaults without explaining how they were selected. Sensitivity analyses (Figures 4, 5) are provided post-hoc but no search budget is given."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The default configuration (b=20, n=15) is used without justification. Figures 4 and 5 show sensitivity analysis, but how the default values were chosen is not explained."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper compares 7 methods × 6 LLMs × 3 datasets (126 comparisons in Table 1 alone) with no statistical tests and therefore no multiple comparison correction."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement all baselines and their own method. No discussion of self-comparison bias is provided. No independent evaluation or re-implementation verification is mentioned."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "PR-attack requires iterative bilevel optimization while some baselines (e.g., Disinformation Attack) are much cheaper. No comparison at matched compute budgets is provided."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses NQ, HotpotQA, and MS-MARCO without discussing whether these QA benchmarks are appropriate for measuring RAG attack effectiveness in real-world settings. No construct validity analysis is provided."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. The attack targets the standard RAG pipeline directly (retriever + LLM) without agentic scaffolding."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not addressed. NQ (2019), HotpotQA (2018), and MS-MARCO (2016) predate all models by years. Models likely encountered these QA pairs during training, which could inflate ACC scores and confound attack evaluations."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not addressed. The evaluation provides top-5 retrieved texts as context. Whether the retrieval setup leaks answer information differently across methods is not considered."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not addressed. No discussion of whether target questions share structural similarities or whether results on related questions could be non-independent."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is used. No canary strings, membership inference, n-gram overlap analysis, or decontamination pipelines are applied."
       }
     }
   },
   "claims": [
     {
       "claim": "PR-attack achieves at least 90% ASR across all LLMs and datasets with only a single poisoned text per target question.",
       "evidence": "Table 1 shows ASR ranging from 91% to 100% across 6 LLMs × 3 datasets. The lowest is 91% (Llama-2 on NQ).",
       "supported": "moderate"
     },
     {
       "claim": "PR-attack exhibits remarkable stealthiness, achieving higher accuracy than naive RAG when the trigger is not activated.",
       "evidence": "Table 2 shows PR-attack ACC consistently exceeds naive RAG ACC across all settings (e.g., Gemma-2 on NQ: 95% vs 67%).",
       "supported": "weak"
     },
     {
       "claim": "PR-attack outperforms all state-of-the-art RAG attack methods.",
       "evidence": "Table 1 shows PR-attack achieves the highest ASR in all 18 settings (6 LLMs × 3 datasets), often by 10-30 percentage points.",
       "supported": "moderate"
     },
     {
       "claim": "PR-attack demonstrates broad applicability across various LLMs.",
       "evidence": "Tested on 6 LLMs (Vicuna, LLaMA-2, GPT-J, Phi-3.5, Gemma-2, LLaMA-3.2). Figures 2 and 3 show low standard deviation across LLMs.",
       "supported": "weak"
     },
     {
       "claim": "PR-attack is not sensitive to hyperparameters b (poisoned text length) and n (soft prompt length).",
       "evidence": "Figures 4 and 5 show ASR remains comparable across b ∈ {20,30,40,50,60} and n ∈ {10,15,20,25,30}.",
       "supported": "moderate"
     },
     {
       "claim": "The bilevel optimization framework provides theoretical complexity guarantees for the attack generation process.",
       "evidence": "Section 3.4 derives the overall complexity as O((B₁(K log K + (c₁+1)Mbd) + B₂Mnc₂)T) in Eq. (12).",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "ACC exceeds clean RAG baseline",
       "detail": "Table 2 shows PR-attack (trigger inactive) achieving HIGHER accuracy than naive RAG across all settings — sometimes by large margins (e.g., Gemma-2 NQ: 95% vs 67%). This is unexplained and suspicious: how does a system with poisoned knowledge and an attack prompt outperform a clean system? The soft prompt may be acting as a beneficial prompt tuning, but this confound is not discussed."
     },
     {
       "flag": "Only small open-source models tested",
       "detail": "All six models are small (1B–7B) open-source LLMs. No commercial API models (GPT-4, Claude, Gemini) or larger models (70B+) are tested, yet the title and claims reference 'Large Language Models' generically. Smaller models may be more vulnerable to prompt manipulation."
     },
     {
       "flag": "No significance tests across 126+ comparisons",
       "detail": "Claims of superiority are based on comparing raw percentages in Table 1 (7 methods × 6 LLMs × 3 datasets) without any statistical testing. The differences could partly reflect noise, especially since the number of target questions is not even stated."
     },
     {
       "flag": "No failure analysis",
       "detail": "Despite ASR being below 100% in many settings, no failure cases are analyzed. What types of questions resist the attack? Which poisoned texts fail to be retrieved? This analysis is absent."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper contains no limitations, threats to validity, or ethics discussion. For a paper proposing a novel attack on AI systems, this omission is notable."
     },
     {
       "flag": "Single retriever tested",
       "detail": "Only Contriever is used as the retriever. RAG systems use diverse retrievers (BM25, DPR, ColBERT, etc.), and attack effectiveness may vary significantly across retrievers. Yet the paper claims generality about RAG systems."
     },
     {
       "flag": "Evaluation on same questions used for optimization",
       "detail": "The soft prompt and poisoned texts are optimized specifically for the target questions, and ASR is measured on those same questions. There is no held-out evaluation to test generalization beyond the optimized targets."
     }
   ],
   "cited_papers": [
     {
       "title": "PoisonedRAG: Knowledge Poisoning Attacks to Retrieval-Augmented Generation of Large Language Models",
       "authors": ["Wei Zou", "Runpeng Geng", "Binghui Wang", "Jinyuan Jia"],
       "year": 2024,
       "arxiv_id": "2402.07867",
       "relevance": "Primary baseline and experimental setup source for knowledge poisoning attacks on RAG-based LLMs."
     },
     {
       "title": "Prompt Perturbation in Retrieval-Augmented Generation Based Large Language Models",
       "authors": ["Zhibo Hu", "Chen Wang", "Yanfeng Shu", "Hye-Young Paik", "Liming Zhu"],
       "year": 2024,
       "relevance": "GGPP method — key baseline for prompt-based attacks on RAG systems."
     },
     {
       "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "GCG Attack — foundational adversarial attack method on aligned LLMs, used as baseline."
     },
     {
       "title": "PPT: Backdoor Attacks on Pre-trained Models via Poisoned Prompt Tuning",
       "authors": ["Wei Du", "Yichun Zhao", "Boqun Li", "Gongshen Liu", "Shilin Wang"],
       "year": 2022,
       "relevance": "Core inspiration for the backdoor trigger mechanism in soft prompt tuning used by PR-Attack."
     },
     {
       "title": "BadPrompt: Backdoor Attacks on Continuous Prompts",
       "authors": ["Xiangrui Cai", "Haidong Xu", "Sihan Xu", "Ying Zhang"],
       "year": 2022,
       "relevance": "Backdoor attacks on continuous prompts for pre-trained language models."
     },
     {
       "title": "PoisonPrompt: Backdoor Attack on Prompt-based Large Language Models",
       "authors": ["Hongwei Yao", "Jian Lou", "Zhan Qin"],
       "year": 2024,
       "relevance": "Backdoor attacks specifically targeting prompt-based LLMs, closely related attack paradigm."
     },
     {
       "title": "Prompt Injection Attack against LLM-integrated Applications",
       "authors": ["Yi Liu", "Gelei Deng", "Yuekang Li"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Prompt injection attacks on LLM-integrated applications, used as Prompt Poisoning baseline."
     },
     {
       "title": "A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly",
       "authors": ["Yifan Yao", "Jinhao Duan", "Kaidi Xu"],
       "year": 2024,
       "relevance": "Comprehensive survey on LLM security and privacy threats including prompt hacking and adversarial attacks."
     },
     {
       "title": "Poisoning Retrieval Corpora by Injecting Adversarial Passages",
       "authors": ["Zexuan Zhong", "Ziqing Huang", "Alexander Wettig", "Danqi Chen"],
       "year": 2023,
       "relevance": "Corpus poisoning attack on retrieval systems, used as baseline for adversarial passage injection."
     },
     {
       "title": "On the Risk of Misinformation Pollution with Large Language Models",
       "authors": ["Yikang Pan", "Liangming Pan", "Wenhu Chen", "Preslav Nakov", "Min-Yen Kan", "William Wang"],
       "year": 2023,
       "relevance": "Disinformation attack method using LLMs, used as baseline for misinformation generation."
     },
     {
       "title": "Security and Privacy Challenges of Large Language Models: A Survey",
       "authors": ["Badhan Chandra Das", "M. Hadi Amini", "Yanzhao Wu"],
       "year": 2024,
       "arxiv_id": "2402.00888",
       "relevance": "Survey covering security attacks on LLMs including prompt injection and data poisoning categories."
     },
     {
       "title": "Poisoning Web-Scale Training Datasets is Practical",
       "authors": ["Nicholas Carlini", "Matthew Jagielski"],
       "year": 2024,
       "relevance": "Demonstrates practical poisoning of web-scale datasets including Wikipedia, directly relevant to the attack vector assumed in PR-Attack."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "Security researchers could use the framework to test RAG system defenses, but no code is released and the technique requires bilevel optimization expertise to implement."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Joint prompt-RAG attack is a natural extension of existing single-vector attacks; the approach is not surprising to the security community."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates a stealthy attack on RAG systems achieving near-perfect success rates with minimal poisoning, with an explicit misinformation scenario (earthquake/nuclear testing) that could amplify panic."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "No controversy or accusatory angle — standard attack-paper structure proposing a new method and comparing with baselines."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or tool is released. The approach requires implementing bilevel optimization over LLM inference."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Tongji University and Columbia University are recognized institutions but not top AI labs. Published at SIGIR, a respected but niche venue for this topic."
     }
   }
 }