ai-research-survey

scan.json (25692B)

---

 {
   "paper": {
     "title": "Prompt Injection Attacks on Large Language Models: A Survey of Attack Methods, Root Causes, and Defense Strategies",
     "authors": [
       "Tongcheng Geng",
       "Zhiyuan Xu",
       "Yubin Qu",
       "W. Eric Wong"
     ],
     "year": 2025,
     "venue": "Computers, Materials & Continua (CMC)",
     "doi": "10.32604/cmc.2025.074081"
   },
   "scan_version": 2,
   "active_modules": ["survey_methodology"],
   "methodology_tags": ["meta-analysis"],
   "key_findings": "This systematic review synthesizes 128 studies (2022-2025) on prompt injection attacks against LLMs, classifying 26 attack methods across three dimensions (vector, objective, implementation) and 37 defense mechanisms across three categories (input preprocessing, system architecture, model-level). The review identifies a co-evolutionary arms race where defenses lag behind attacks, with attacks achieving >90% success rates against unprotected systems while defenses show varying effectiveness (60-80% detection for input filtering, up to 95% for architectural defenses against known patterns). Root causes are attributed to philosophical dilemmas (value alignment), technical flaws (attention mechanism vulnerabilities, autoregressive constraints), and training deficiencies (catastrophic forgetting, reward hacking).",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository or analysis scripts are provided. The paper states 'Availability of Data and Materials: Not applicable.'"
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "Despite describing a data extraction form (Table 3) with 23 fields applied to 128 papers, the extracted dataset is not released. 'Availability of Data and Materials: Not applicable.'"
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No computational environment is specified. The survey could have released its analysis environment or tools but did not."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No reproduction instructions are provided. While the search strings and databases are documented (Section 2.3), there is no package or instructions to reproduce the full analysis pipeline."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": false,
         "answer": false,
         "justification": "This is a systematic literature review that does not conduct its own experiments. The quantitative claims (e.g., defense effectiveness percentages) are synthesized from individual studies, not from the authors' own statistical analysis."
       },
       "significance_tests": {
         "applies": false,
         "answer": false,
         "justification": "The paper is a qualitative synthesis survey; it does not run its own experiments requiring significance testing."
       },
       "effect_sizes_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are conducted by the authors. Effect sizes reported are from individual reviewed studies."
       },
       "sample_size_justified": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper with no experiments of its own. The final corpus size (128 papers) results from systematic search rather than sample size calculation."
       },
       "variance_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments conducted; variance reporting is not applicable to a literature survey."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Section 1 explicitly compares against four prior surveys: Peng et al. [21], Rababah et al. [22], Mathew [23], and Kumar et al. [24], identifying specific gaps each survey has."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "All four baseline surveys are from 2024, making them contemporary and relevant comparisons."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper with no system components to ablate."
       },
       "multiple_metrics": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are conducted by the authors; evaluation metrics are not applicable."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "No system outputs are generated that would require human evaluation."
       },
       "held_out_test_set": {
         "applies": false,
         "answer": false,
         "justification": "No experiments conducted; held-out test sets are not applicable."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by attack vector type (direct, indirect, multimodal), attack objective, technical implementation, and defense category (input preprocessing, system architecture, model-level) across multiple tables (Tables 4, 5, 6, 7, 8, 9)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Sections 5.4.1 and 5.4.3 discuss defense limitations including 15-30% false positive rates, 40-60% bypass rates for prompt engineering, and limited generalization to novel attacks. Section 6.2.2 discusses evaluation framework gaps."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that current defenses are insufficient: 'input filtering suffers from 15%–30% false positive rates,' 'prompt engineering lacks formal security guarantees with 40%–60% bypass rates,' and 'significant gaps persist against novel attack vectors' (Section 7.2)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims about >90% attack success rates, 60-80% detection rates, 95% protection for architectural defenses, and 37 defense approaches are all supported in the body. Table 7 provides quantitative evidence for defense effectiveness, and Table 6 catalogs 37 defense studies."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "Section 7.2 claims 'more capable models exhibit higher vulnerability to text-based attacks (Pearson correlation coefficient 0.6635, p < 0.001)' and frames this as a 'counterintuitive finding' implying causation, but this is correlational analysis with no methodology details provided (what models, what data points, how was capability measured). The root cause analysis (Section 4) makes causal attributions from literature synthesis without systematic causal evidence."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The survey clearly states its scope: 128 peer-reviewed studies from 2022-2025, English language, using defined search strings across nine databases (Section 2.3). IC/EC criteria (Table 1) bound the review to prompt injection specifically."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper presents its synthesis (e.g., that root causes lie in philosophical, technical, and training dimensions) as definitive without considering alternative frameworks or acknowledging that the patterns identified could be artifacts of the literature's own biases."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper measures coverage of published literature and frames this as representing 'the field's' state, without discussing the gap between reviewed papers and the actual state of prompt injection research (e.g., unpublished industry work, classified research, non-English publications)."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper that does not use any AI models for its analysis."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not use prompting."
       },
       "hyperparameters_reported": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper with no experiments requiring hyperparameters."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 2.3-2.6 documents the full pipeline: search strings based on PICO framework, nine databases searched, 586 initial studies retrieved with per-database counts, IC/EC criteria (Table 1) applied to reduce to 108, snowballing added 20 to reach 128, and quality assessment checklist (Table 2) applied by two independent authors."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "The paper discusses limitations of the field's defense mechanisms (Section 5.4) and evaluation frameworks (Section 6.2), but has no dedicated section discussing limitations of the survey methodology itself. Potential issues like language bias (English only), database coverage gaps, or inter-rater reliability of the data extraction are not systematically addressed."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No specific threats to the validity of the survey itself are discussed. The paper does not address potential issues such as: whether the search strings missed relevant papers, whether the IC/EC criteria were applied consistently, or whether the quality assessment introduces systematic bias."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 2.1 defines prompt injection attacks formally, Section 2.4 lists explicit IC/EC criteria (Table 1) including English language, January 2022-August 2025 timeframe, and specific focus requirements."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The completed data extraction table (Table 3 describes the form) is not released. 'Availability of Data and Materials: Not applicable.' The raw coded data from 128 papers is not available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 2.3 describes the search strategy in detail: PICO-based search strings, nine specific databases (IEEE Xplore, ACM, Science Direct, Springer Link, Wiley, Elsevier, Google Scholar, DBLP, ArXiv), searched on 04 August 2025, with per-database hit counts."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper sources are academic databases described in the methodology."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 2 documents the full pipeline: 586 initial studies → 108 after IC/EC criteria → 128 after snowballing → quality assessment → data extraction (Table 3) by two independent authors with third-author validation → data synthesis."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Funding is disclosed: '2023 Higher Education Scientific Research Planning Project of China Society of Higher Education (No. 23PG0408),' Jiangsu Province grants, Nantong Science and Technology Project, and others listed in the Funding Statement."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: State Information Center (Beijing), Hohai University, Jiangsu College of Engineering and Technology, and University of Texas at Dallas."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Funders are Chinese academic research grants and university programs with no commercial interest in the survey's outcomes regarding specific attack or defense technologies."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": true,
         "justification": "'Conflicts of Interest: The authors declare no conflicts of interest to report regarding the present study.'"
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This is a survey paper that does not evaluate a pre-trained model's capability on any benchmark."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper; no model evaluation on benchmarks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper; no model evaluation on benchmarks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this systematic literature review."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. 'Ethics Approval: Not applicable.'"
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. (Paper inclusion/exclusion criteria for the literature search are covered under data_preprocessing_documented.)"
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper with no computational method of its own."
       },
       "compute_budget_stated": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper; no computational experiments."
       }
     },
     "survey_methodology": {
       "prisma_or_structured_protocol": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly follows Kitchenham's guidelines [25] for systematic literature reviews. It uses PICO framework for search string formulation (Section 2.3), defines IC/EC criteria (Table 1), applies snowballing per Wohlin's guidelines [32], uses a quality assessment checklist (Table 2), and documents a structured data extraction form (Table 3). Search process is visualized in Fig. 1."
       },
       "quality_assessment_of_sources": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 presents a quality assessment checklist with four criteria areas (Attack Method, Defense Mechanism, Experimental Evaluation, Reproducibility) with 12 sub-criteria. Section 2.4 states: 'The quality assessment checklist was independently applied to all 128 primary studies by two authors. In case of disagreement, discussions were held to reach a consensus.'"
       },
       "publication_bias_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss publication bias. There is no funnel plot, no discussion of negative-result underrepresentation, and no acknowledgment that the literature may skew toward successful attacks. Section 6.2.2 mentions 'Subjectivity and bias in dataset construction' but this concerns evaluation datasets in the reviewed papers, not publication bias in the survey's own source literature."
       }
     }
   },
   "claims": [
     {
       "claim": "Prompt injection attacks achieve over 90% success rates against unprotected systems.",
       "evidence": "Section 7.2 states this as a key finding, and Table 7 shows baseline ASRs of 98.1% (GCG on Vicuna), 79% (adversarial prompts), 100% (DistilBERT), and 50-57% (various settings).",
       "supported": "moderate"
     },
     {
       "claim": "Input preprocessing defenses achieve 60%-80% detection rates against known attacks.",
       "evidence": "Abstract and Section 7.1 state this. Table 7 shows defense-reduced ASRs ranging from 0% to 27.82%, suggesting detection rates higher than 60-80%. The 60-80% figure does not appear to come directly from the tabulated data.",
       "supported": "weak"
     },
     {
       "claim": "Advanced architectural defenses demonstrate up to 95% protection against known patterns.",
       "evidence": "Abstract claim. Table 7 shows some defenses achieving near-complete protection (SmoothLLM: 98.1% → 0.8%, Erase-and-Check: 100% → 0%), but these are input preprocessing, not architectural defenses. The 95% figure for architectural defenses is not directly supported by the tabulated data.",
       "supported": "weak"
     },
     {
       "claim": "37 distinct defense approaches were identified across three categories.",
       "evidence": "Table 6 lists 37 entries across input preprocessing, system architecture, and model-level defense categories. This is directly verifiable from the table.",
       "supported": "strong"
     },
     {
       "claim": "More capable models exhibit higher vulnerability to text-based attacks (Pearson r=0.6635, p<0.001).",
       "evidence": "Section 7.2 Key Findings states this as a 'counterintuitive finding,' but no methodology is provided for how this correlation was computed — what models were included, how capability was measured, what vulnerability metric was used.",
       "supported": "weak"
     },
     {
       "claim": "Defense strategies have evolved from passive input preprocessing to comprehensive multi-layered approaches.",
       "evidence": "Table 8 provides a temporal analysis showing the co-evolutionary arms race from 2022-2025 with specific citations at each stage. The progression from basic defenses to system-level architecture is documented across Sections 5.1-5.3.",
       "supported": "strong"
     },
     {
       "claim": "Input filtering suffers from 15%-30% false positive rates and detection drops below 40% for novel attacks.",
       "evidence": "Section 5.4.1 states these figures but provides no specific citations or aggregation methodology for how these ranges were derived.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "Unsourced quantitative claims",
       "detail": "Several key claims in the abstract and conclusions (60-80% detection rates, 95% architectural defense effectiveness, 15-30% FPR for input filtering) do not map clearly to the data presented in the paper's own tables. These appear to be informal aggregations without documented methodology."
     },
     {
       "flag": "Unexplained statistical finding",
       "detail": "The Pearson correlation claim (r=0.6635, p<0.001) for model capability vs. vulnerability appears in Section 7.2 with no methodology: no description of what data points were used, how capability was measured, or how vulnerability was operationalized. This is a significant empirical claim with zero reproducibility information."
     },
     {
       "flag": "No limitations of own methodology",
       "detail": "Despite following Kitchenham's SLR guidelines, the paper has no section discussing limitations of the survey itself — language bias (English only), search engine coverage gaps, potential for inconsistent coding across authors, or whether the quality checklist excluded relevant work."
     },
     {
       "flag": "No replication package",
       "detail": "The paper describes a detailed 23-field data extraction form (Table 3) applied to 128 papers but releases neither the coded data nor the analysis. For a paper advocating reproducibility in the field, this is a significant gap. 'Availability of Data and Materials: Not applicable.'"
     },
     {
       "flag": "Publication bias not addressed",
       "detail": "The survey does not consider that its source literature may systematically over-represent successful attacks and under-represent failed defense attempts or negative results, potentially inflating attack success rates."
     }
   ],
   "cited_papers": [
     {
       "title": "Ignore previous prompt: attack techniques for language models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Foundational paper on direct prompt injection attacks against LLMs."
     },
     {
       "title": "Not what you've signed up for: compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "First systematic description of indirect prompt injection attacks via external data sources."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Introduced the GCG attack for generating universal adversarial suffixes against aligned LLMs."
     },
     {
       "title": "HarmBench: a standardized evaluation framework for automated red teaming and robust refusal",
       "authors": ["Mantas Mazeika", "Long Phan", "Xuwang Yin"],
       "year": 2024,
       "relevance": "Standardized evaluation framework for red teaming LLMs, proposed the R2D2 adversarial training method."
     },
     {
       "title": "Agentdojo: a dynamic environment to evaluate prompt injection attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic"],
       "year": 2024,
       "relevance": "First dynamic security evaluation framework for LLM agents in untrusted data environments."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": ["Edoardo Debenedetti", "Ilia Shumailov", "Tianqi Fan"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "CaMeL framework applying software security design principles to defend against prompt injection."
     },
     {
       "title": "Asleep at the keyboard? assessing the security of github copilot's code contributions",
       "authors": ["Hammond Pearce", "Baleegh Ahmad", "Benjamin Tan", "Brendan Dolan-Gavitt", "Ramesh Karri"],
       "year": 2025,
       "doi": "10.1145/3610721",
       "relevance": "Evaluates security vulnerabilities in LLM-generated code from GitHub Copilot."
     },
     {
       "title": "Jailbroken: how does llm safety training fail?",
       "authors": ["Alexander Wei", "Nika Haghtalab", "Jacob Steinhardt"],
       "year": 2023,
       "relevance": "Identifies two failure modes (competing objectives, mismatched generalization) explaining LLM vulnerability to jailbreaking."
     },
     {
       "title": "InjecAgent: benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "relevance": "Benchmark framework for evaluating indirect prompt injection attacks on tool-integrated LLM agents."
     },
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "First systematic evaluation framework formalizing prompt injection attack strategies and defense methods."
     },
     {
       "title": "StruQ: defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2025,
       "relevance": "Applies control-data separation principles to defend against prompt injection at the API level."
     },
     {
       "title": "Constitutional AI: harmlessness from AI feedback",
       "authors": ["Yuntao Bai", "Saurav Kadavath", "Sandipan Kundu"],
       "year": 2022,
       "arxiv_id": "2212.08073",
       "relevance": "Foundational work on AI safety alignment relevant to understanding prompt injection vulnerability root causes."
     }
   ]
 }