ai-research-survey

scan.json (31613B)

---

 {
   "paper": {
     "title": "Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems",
     "authors": ["Donghyun Lee", "Mo Tiwari"],
     "year": 2024,
     "venue": "arXiv.org",
     "arxiv_id": "2410.07283",
     "doi": "10.48550/arXiv.2410.07283"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Prompt Infection demonstrates that self-replicating malicious prompts can propagate across agents in multi-agent systems, with self-replicating attacks outperforming non-replicating ones by 14-209% in global messaging. GPT-4o is more resistant to infection but more dangerous when compromised due to higher execution precision. Infection spreads in logistic growth patterns in social simulations and can exploit memory retrieval systems by manipulating importance scores. The proposed LLM Tagging defense, combined with Marking, reduces attack success to 0%, though neither is effective in isolation.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository, GitHub link, or archive is provided anywhere in the paper. The full attack prompt is shown in Appendix A, but no experimental code or simulation framework is released."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions creating 'a dataset of 120 user instructions across three tool types' paired with synthetic documents (Section 4.1), but this dataset is not released or made publicly available."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specification, dependency list, or system requirements are provided. The paper mentions using OpenAI's GPT models but provides no setup details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No reproduction instructions, scripts, or step-by-step guide are provided. The attack prompt is shown in Appendix A, but the full experimental setup (multi-agent simulation, evaluation pipeline) is not documented at a reproducible level."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are reported as point estimates (e.g., '13.92% higher success rate', '209% more effective'). No confidence intervals, error bars, or uncertainty measures are provided in any figure or table."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes multiple comparative claims (GPT-4o vs GPT-3.5, self-replicating vs non-replicating, various defenses) based solely on comparing raw percentages without any statistical significance tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports relative differences with baseline context: 'Self-Replicating infection achieves a 13.92% higher success rate' for GPT-4o, '209% more effective' for GPT-3.5 (Section 5.1). Defense results in Figure 7 show absolute success rates before and after applying LLM Tagging."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The dataset of 120 user instructions (360 pairs total) is stated without justification for why this number was chosen. No power analysis or discussion of statistical adequacy."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance, or spread measures are reported. The importance score experiment (Table 1) reports averages 'over 100 runs' but gives no variance. All other results appear to be single-run."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "A Non-Replicating Prompt Infection baseline is established (Section 4.1): the infection lacks self-replication, with the malicious prompt instructing the agent to 'say perform A.' This allows direct comparison of self-replication's impact."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "The only baseline is the authors' own non-replicating variant. No comparison to other MAS attack methods from prior work (e.g., Zhang et al. 2024a, Gu et al. 2024, Cohen et al. 2024's AI worm), despite discussing them in related work."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Multiple ablation-style comparisons: self-replicating vs non-replicating infection, global vs local messaging, with vs without importance score manipulation (Table 1, Figures 6a-b), and individual defense mechanisms with and without LLM Tagging (Figure 7)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper evaluates attack success rate across multiple threat types (data theft, scam, malware, content manipulation), analyzes failure categories (Attack Ignored, Mixed Action, Deformed Infection, No Action, Agent Error in Figure 5), and measures infection propagation dynamics (Figure 6)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated or based on predefined success criteria. No human evaluators were used to assess whether attacks or defenses succeeded. Success criteria are described (Section 4.1) but it is unclear if assessment was automated or manual."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of separating development and test data. The attack prompts were presumably developed and tested on the same 360 pairs. No held-out evaluation set is mentioned."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by messaging type (global vs local, Figures 4a-b), model (GPT-4o vs GPT-3.5), threat type (data theft, scam, malware, content manipulation), defense strategy (Figure 7), failure category (Figure 5), and population size (Figure 6)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Figure 5 provides a detailed analysis of failure reasons across categories: Attack Ignored, Mixed Action, Deformed Infection, No Action, and Agent Error, with comparative analysis between GPT-4o and GPT-3.5 in both infection modes."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results are reported: self-replicating infection is outperformed by non-replicating for data theft with many agents (Section 5.1), no individual defense strategy is effective alone (Section 6), LLM Tagging alone reduces success rate by only 5% (Section 6)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims — MAS are 'highly susceptible', infection spreads 'even when agents do not publicly share all communications' (local messaging experiments), LLM Tagging 'when combined with existing safeguards, significantly mitigates infection spread' (Marking + Tagging achieves 0% in Figure 7) — are all supported by experimental results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims (e.g., 'self-replication enables scalable attacks') are supported by controlled experimental comparisons: same setup with and without self-replication, same models with and without importance score manipulation. The experimental design involves controlled single-variable manipulation."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper tests only GPT-4o and GPT-3.5 Turbo with a single MAS architecture, but the title and abstract claim broadly about 'multi-agent systems.' While Section 7 acknowledges 'Our experiments focused on the GPT family, leaving other LLMs like Claude, Llama, and Gemini underexplored,' the main claims are not qualified to the tested setting."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for the observed results. For example, why GPT-4o is more resistant could relate to RLHF differences, safety training intensity, or instruction following fidelity — none of these are explored. The Section 7 limitations discuss coverage gaps but not confounds."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures 'attack success rate' and defines it precisely for each threat type (Section 4.1): data theft requires three agents compromised with a POST request generated; scam/malware/manipulation requires final agent producing malicious output while concealing the prompt. Claims match the granularity of measurements."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses 'GPT-4o' and 'GPT-3.5 Turbo' (Section 4.1) without specifying version snapshots or API dates. Per schema, marketing names like 'GPT-4o' without a snapshot date do not count as specified versions."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The full functional self-replication infection prompt is provided in Appendix A (Figure 8), including the actual text used. The defense prompts (Marking, Sandwich, etc.) are described by name with references to prior work."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No temperature, top-p, max_tokens, or other API parameters are reported for any of the GPT model calls used in experiments."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The multi-agent application structure is described: first agent is tool-specific, followed by strategist, summarizer, editor, and writer (Section 4.1). Communication methods (global and local messaging) are explained. The society of agents setup describes memory retrieval with top-K=3 selection based on importance, recency, and relevance scores."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The dataset creation process is described at high level (120 user instructions, 3 tool types, synthetic documents), but the specific process for generating user instructions, the synthetic data generation pipeline, and the web document injection methodology are not documented in sufficient detail to reproduce."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 'Limitations and Future Work' provides a dedicated discussion of the study's limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 discusses specific threats: experiments limited to GPT family, only basic MAS architectures tested, handcrafted attacks only (algorithmically generated prompts could bypass defenses), Claude preliminary tests incomplete due to computational costs, attack prompts are exposed in MAS offering detection opportunities."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 explicitly states: other LLMs are underexplored, only basic MAS architectures tested, handcrafted attacks used (not automated prompt generation), stealthier methods needed. These are specific boundaries of what was not tested."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data, experimental logs, or detailed results are made available. Only aggregate figures and tables are presented."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "The data creation process is described briefly — '120 user instructions across three tool types, paired with synthetic PDFs and emails' and 'synthetic user data stored in a CSV file' (Section 4.1) — but the actual generation methodology, selection criteria, and representative examples (beyond the attack prompt) are not provided."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data is entirely synthetic."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline from synthetic data generation to final attack success metrics is not documented step by step. How user instructions were paired with attack prompts, how success was determined programmatically, and the intermediate processing steps are not described."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the paper. No grants, sponsors, or funding sources are mentioned."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Donghyun Lee (University College London) and Mo Tiwari (Stanford University). These are academic institutions with no product conflict regarding the evaluated OpenAI models."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding source is disclosed, so independence cannot be assessed. The absence of a funding statement is noted."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a security attack (prompt injection propagation), not model knowledge on a benchmark. The evaluation measures attack success rates, not the models' pre-trained capabilities. Contamination is structurally inapplicable."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the paper evaluates a novel attack/defense mechanism, not pre-trained model capability on benchmark tasks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the evaluation is about prompt injection propagation success, not model knowledge that could be contaminated by training data."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All experiments use LLM agents and synthetic data."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The ethical statement discusses responsible disclosure but no IRB review was needed or conducted."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No API costs, token counts, or latency figures are reported despite extensive use of GPT-4o and GPT-3.5 Turbo across 360+ attack scenarios and multi-agent society simulations with up to 50 agents."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, API spend, or hardware requirements are stated. Section 7 mentions 'computational costs' preventing full Claude experiments, but the actual budget for GPT experiments is not quantified."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds or sensitivity analysis. The society simulation involves random pairwise dialogues but results are not reported across multiple random seeds."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The importance score experiment states 'averaged over 100 runs' (Table 1), but for the main attack experiments (360 pairs) and society simulations, the number of runs is not stated. It is unclear whether results represent single runs or averages."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is described. The attack prompts, dataset size, population sizes, and K=3 memory retrieval parameter appear to be set without documented search or justification."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The infection prompt shown in Appendix A appears to be a refined artifact, but the paper does not describe how it was developed or selected from alternatives. No selection methodology is discussed."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes many comparisons (2 models × 2 infection modes × 2 messaging modes × 4 threat types, plus 6 defense strategies) without any multiple comparison correction."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own attack method and defense mechanism. No acknowledgment of author-evaluation bias, no independent evaluation, and no mitigation strategies discussed."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Self-replicating infection requires each agent to replicate the full prompt, increasing token consumption vs non-replicating. This compute difference is not quantified or discussed as a confound."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether their simulated multi-agent system reflects real-world MAS deployments. The simulated environment (tool-specific first agent → strategist → summarizer → editor → writer) may not represent actual production architectures, but this validity gap is not addressed."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "GPT-4o and GPT-3.5 Turbo are compared within the same multi-agent scaffold, isolating the model variable. Both global and local messaging modes are tested for each model. The scaffold is held constant across model comparisons."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether GPT models may have encountered similar prompt injection patterns or defense techniques in their training data, which could affect their resistance/susceptibility rates."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup provides signals not available in real-world scenarios (e.g., the simulated environment may be simpler than production systems, making attacks artificially easier or harder)."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 120 user instructions and their pairing with 3 tool types may share structural patterns. No discussion of independence between test cases or potential correlation in the 360 pairs."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is used or discussed."
       }
     }
   },
   "claims": [
     {
       "claim": "Self-replicating infection consistently outperforms non-replicating infection in most attack scenarios",
       "evidence": "Figure 4a shows 13.92% higher success rate for GPT-4o and 209% improvement for GPT-3.5 in global messaging for scam, malware, and content manipulation. Exception: data theft with many agents (Section 5.1).",
       "supported": "moderate"
     },
     {
       "claim": "Self-replicating infection is the only scalable method for compromising more than two agents in local messaging",
       "evidence": "Figure 4b shows non-replicating infection 'struggles to compromise more than two agents' in local messaging, while self-replicating infection achieves ~20% lower but still meaningful success rates (Section 5.1).",
       "supported": "moderate"
     },
     {
       "claim": "Stronger models (GPT-4o) are not inherently safer — they are more resistant to infection but more dangerous when compromised",
       "evidence": "Figure 5 shows GPT-4o ignores 66% of self-replicating attacks vs 9% for GPT-3.5, but GPT-4o has fewer 'Deformed Infection' and 'Mixed Action' failures, executing malicious tasks more precisely when compromised (Section 5.1).",
       "supported": "moderate"
     },
     {
       "claim": "Infection spreads in a logistic growth pattern in social simulations, and larger populations experience more efficient per-agent infection rates",
       "evidence": "Figure 6a shows full infection achieved at ~47% of total turns for 10 agents, decreasing to ~21.4% for 50 agents (Section 5.2).",
       "supported": "moderate"
     },
     {
       "claim": "Manipulating the importance scoring system creates a feedback loop that amplifies infection persistence and spread",
       "evidence": "Table 1 shows importance scores jump from 1.94 to 10.00 (GPT-4o) and 1.00 to 9.84 (GPT-3.5) with manipulation. Figure 6b shows without manipulation, infection dies out after K=3 turns (Section 5.2).",
       "supported": "strong"
     },
     {
       "claim": "Marking + LLM Tagging prevents all attacks, while neither defense is effective alone",
       "evidence": "Figure 7 shows Marking + LLM Tagging achieves 0% attack success rate. LLM Tagging alone reduces success by only 5%. Marking alone still permits 76% of attacks after counterattack (Section 6).",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No uncertainty quantification",
       "detail": "All results are reported as point estimates without confidence intervals, error bars, or variance across runs. For the society simulation with stochastic pairings, this is a significant omission — results could vary substantially across random seeds."
     },
     {
       "flag": "Small synthetic evaluation dataset",
       "detail": "The evaluation uses only 120 user instructions (360 pairs), all synthetically generated. No analysis of whether these represent realistic multi-agent usage patterns or whether results would hold on organic interactions."
     },
     {
       "flag": "Defense evaluation uses only handcrafted attacks",
       "detail": "The paper acknowledges in Section 7 that 'algorithmically generated prompts can bypass such defenses,' yet the defense evaluation (Section 6) uses only the authors' handcrafted attack prompt. The 0% success rate for Marking + LLM Tagging may not generalize to adaptive adversaries."
     },
     {
       "flag": "Broad claims from narrow evaluation",
       "detail": "Only GPT-4o and GPT-3.5 Turbo are tested in one simulated MAS architecture, but claims extend to 'multi-agent systems' broadly. Preliminary Claude tests mentioned but incomplete."
     },
     {
       "flag": "No artifacts released",
       "detail": "Despite the paper publishing the full functional attack prompt in Appendix A, no code, data, or evaluation framework is released. The experimental simulation is not reproducible from the paper alone."
     },
     {
       "flag": "Construct validity of simulated MAS",
       "detail": "The simulated multi-agent application (tool-reader → strategist → summarizer → editor → writer) may not reflect production MAS architectures. Real systems may have safety layers, monitoring, or different communication patterns not captured in the simulation."
     }
   ],
   "cited_papers": [
     {
       "title": "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "arxiv_id": "2302.12173",
       "relevance": "Foundational work on indirect prompt injection in LLM applications, which this paper extends to multi-agent systems."
     },
     {
       "title": "Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications",
       "authors": ["Stav Cohen", "Ron Bitton", "Ben Nassi"],
       "year": 2024,
       "arxiv_id": "2403.02817",
       "relevance": "Introduced self-propagating AI worm concept for single-agent LLMs via email; closely related attack vector to Prompt Infection."
     },
     {
       "title": "Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast",
       "authors": ["Xiangming Gu", "Xiaosen Zheng", "Tianyu Pang", "Chao Du", "Qian Liu", "Ye Wang", "Jing Jiang", "Min Lin"],
       "year": 2024,
       "arxiv_id": "2402.08567",
       "relevance": "Demonstrates exponential jailbreak propagation through multimodal MAS agents via adversarial images."
     },
     {
       "title": "Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification",
       "authors": ["Boyang Zhang", "Yicong Tan", "Yun Shen", "Ahmed Salem", "Michael Backes", "Savvas Zannettou", "Yang Zhang"],
       "year": 2024,
       "arxiv_id": "2407.20859",
       "relevance": "Studies prompt injection attacks in MAS without self-replication; directly compared to Prompt Infection in this paper."
     },
     {
       "title": "Ignore Previous Prompt: Attack Techniques For Language Models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Foundational work demonstrating prompt injection vulnerabilities in GPT-3, establishing the attack class studied here."
     },
     {
       "title": "Defending Against Indirect Prompt Injection Attacks With Spotlighting",
       "authors": ["Keegan Hines", "Gary Lopez", "Matthew Hall", "Federico Zarfati", "Yonatan Zunger", "Emre Kiciman"],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Proposes Marking and Delimiting Data defenses used as baselines in this paper's defense evaluation."
     },
     {
       "title": "StruQ: Defending Against Prompt Injection with Structured Queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Proposes a finetuning-based defense against prompt injection, representing the class of model-level defenses not applicable to black-box models."
     },
     {
       "title": "AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation",
       "authors": ["Qingyun Wu", "Gagan Bansal", "Jieyu Zhang", "Yiran Wu", "Beibin Li", "Erkang Zhu", "Li Jiang", "Xiaoyun Zhang", "Shaokun Zhang", "Jiale Liu", "Ahmed Hassan Awadallah", "Ryen W. White", "Doug Burger", "Chi Wang"],
       "year": 2023,
       "arxiv_id": "2308.08155",
       "relevance": "Major multi-agent framework whose adoption motivates the security research in this paper."
     },
     {
       "title": "Generative Agents: Interactive Simulacra of Human Behavior",
       "authors": ["Joon Sung Park", "Joseph C. O'Brien", "Carrie J. Cai", "Meredith Ringel Morris", "Percy Liang", "Michael S. Bernstein"],
       "year": 2023,
       "arxiv_id": "2304.03442",
       "relevance": "Introduces the memory retrieval system (importance + recency + relevance) exploited by Prompt Infection in the social simulation experiments."
     },
     {
       "title": "Formalizing and Benchmarking Prompt Injection Attacks and Defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "arxiv_id": "2310.12815",
       "relevance": "Provides formal framework and benchmark for prompt injection attacks and defenses in single-agent systems."
     },
     {
       "title": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically",
       "authors": ["Anay Mehrotra", "Manolis Zampetakis", "Paul Kassianik", "Blaine Nelson", "Hyrum Anderson", "Yaron Singer", "Amin Karbasi"],
       "year": 2024,
       "arxiv_id": "2312.02119",
       "relevance": "Demonstrates automated generation of adversarial prompts that could bypass the defenses proposed in this paper."
     },
     {
       "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "relevance": "Demonstrates universal adversarial attacks on aligned LLMs; cited as evidence that findings may generalize across models."
     },
     {
       "title": "PsySafe: A Comprehensive Framework for Psychological-based Attack, Defense, and Evaluation of Multi-agent System Safety",
       "authors": ["Zaibin Zhang", "Yongting Zhang", "Lijun Li", "Hongzhi Gao", "Lijun Wang", "Huchuan Lu", "Feng Zhao", "Yu Qiao", "Jing Shao"],
       "year": 2024,
       "arxiv_id": "2401.11880",
       "relevance": "Examines psychological manipulation attacks in MAS, complementary security research on agent safety."
     }
   ]
 }