ai-research-survey

scan.json (35984B)

---

 {
   "paper": {
     "title": "Prompt Injection Vulnerability of Consensus Generating Applications in Digital Democracy",
     "authors": [
       "Jairo Gudiño-Rosero",
       "Clément Contet",
       "Umberto Grandi",
       "César A. Hidalgo"
     ],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2508.04281",
     "doi": "10.48550/arXiv.2508.04281"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Default LLMs (LLaMA 3.1 8B, GPT-4.1 Nano, Apertus 8B) are broadly vulnerable to prompt injection in consensus generation tasks, with ASR of 26–39% across policy domains. Vulnerability is asymmetric across political parties, with conservative/unionist parties showing 41–80% ASR. Rational, instruction-like rhetorical strategies (imperative orders, impossibility of agreement) are most effective (35–52% ASR) compared to emotional appeals or fabricated statistics (25–32%). A defense pipeline combining injection detection (GPT-OSS-SafeGuard), structured opinion representations, and GSPO reduces ASR to near zero for non-ambiguous consensus outcomes.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, GitHub link, or code archive is provided anywhere in the paper. No mention of code availability."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses data from Tessler et al. (2024) and Stammbach et al. (2024). The 40 injection text variants are listed in Appendix A tables, but the processed datasets (35,521 consensus pairs, adversarial prompts, BERT classifications) are not released."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, conda environment, or library versions are provided. The paper mentions using vLLM, TRL, Unsloth, and spaCy but does not specify versions."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or runnable scripts are provided."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "All ASR values are reported with 95% confidence intervals estimated via bootstrapping with 5,000 iterations. Stated throughout results and figure captions: 'All ASR values and their 95% confidence intervals are estimated via bootstrapping with 5,000 iterations.'"
       },
       "significance_tests": {
         "applies": true,
         "answer": true,
         "justification": "Bootstrap confidence intervals are used for all comparisons across parties, policy clusters, and rhetorical strategies. While formal hypothesis tests (t-tests, etc.) are not named, the 95% bootstrap CIs provide equivalent inferential power for the claims made."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "ASR values are reported as percentages with full context (e.g., '26% and 39%' for policy clusters, '41% to nearly 80%' for conservative parties vs 'below 27%' for others). The reduction from baseline ASR to post-defense ASR is reported (e.g., '1.8%–11.8%' after filtering, '0%–1.9%' after GSPO)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "62 out of 301 policy questions were randomly sampled for the test set with no justification for why 62 was sufficient. No power analysis is discussed. The total of 35,521 consensus pairs is large but the underlying question diversity is limited to 62 questions."
       },
       "variance_reported": {
         "applies": true,
         "answer": true,
         "justification": "Variance is captured via bootstrap 95% CIs across all main results (Figures 4, 9, 10, 12–16). The bootstrapping procedure over 5,000 iterations provides spread measures for all reported statistics."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Multiple baselines are included: (1) attack-free consensus as vulnerability baseline, (2) DPO+GSPO as a defense baseline (Appendix L), (3) Deliberative Alignment as another defense baseline (Appendix M). Defense pipeline stages are also compared against each other (Appendix K)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Defense baselines include DPO (Rafailov 2023), Deliberative Alignment (Guan 2024), and the full pipeline uses GPT-OSS-SafeGuard (Agarwal 2025) and GSPO (Zheng 2025). These represent current state-of-the-art defense strategies."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Appendix K decomposes defense pipeline performance by stage: detection+filtering alone, then structured representations, then GSPO. Each stage's contribution to ASR reduction is separately measured (filtering: 1.8–11.8% ASR; GSPO: 0–1.9% ASR)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Primary metric is ASR from 3×3 confusion matrices. Additional metrics include: over-refusal rate (Appendix N, 1.2–3.7% after GSPO), injection detection rates for three detectors (Appendix F/Figure 8), BERT classifier F1/accuracy (Appendix B), and ASR computed on reduced 2×2 matrices excluding ambiguous outcomes."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated. Consensus statement valence is classified entirely by a fine-tuned BERT model (F1=0.98). No human judges evaluated the quality, fairness, or valence of generated consensus statements."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3: 'we treat the random sample of 62 policy questions analyzed in the previous section as our test set, and use the remaining prompts associated with 239 policy questions as our training set.' Explicit train/test separation by policy question."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by 8 public policy clusters (Figure 4 top), 15 UK political parties (Figure 4 right), party×cluster intersections (Figure 4 heatmap), 5 rhetorical strategies (Figure 10), ignore/completion framing, support/criticism framing, and 3 LLM models (Appendix H)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Systematic failure patterns are discussed: conservative/unionist parties show ASR up to 80%, ambiguous outcomes inflate ASR dramatically when included (Appendix K), machine-readable attacks remain unaddressed, and adaptive attackers may evade detection (citing Nasr et al. 2026). Section 6 explicitly states 'more sophisticated future attacks will likely reveal additional vulnerabilities.'"
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Emotional appeals and misleading statistics are reported as less effective attack strategies (25–32% ASR vs 35–52% for imperative/impossibility in Figure 10). DPO+GSPO baseline achieves worse defense (3.2–23% ASR, Appendix L) than the full pipeline. Including ambiguous outcomes dramatically worsens defense performance (Appendix K). Over-refusal rate is 1.2–3.7% (Appendix N)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims are supported: 'widespread vulnerability' backed by 26–39% ASR across topics (Section 5.1), 'high ASR for conservative parties' backed by 41–80% (Figure 4a), 'rational instruction-like strategies' most effective backed by Figure 10 (35–52%), 'near-zero ASR' after defense backed by Figure 4b and Appendix K."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims ('prompt injection shifts consensus') are justified by a controlled manipulation design: identical prompts are tested with and without injections, and the resulting valence changes are measured. The study uses a within-subjects design where each prompt serves as its own control, isolating the injection effect."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Claims are reasonably bounded: 'off-the-shelf consensus-generating LLMs' (3 specific models named), 'human-readable prompt injections' (Section 3, excluding machine-readable), UK policy data context. The Swiss SmartVote replication (Appendix J) extends generalizability. Section 1 frames the work as 'a way to outline a few key ingredients for their study' rather than a definitive solution."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Multiple alternative explanations are addressed: baseline LLM performance confound (filtered by majority-rule matching, Section 4.2), order effects (20 random orderings per prompt), BERT classifier accuracy (F1=0.98 validated, Appendix B), adaptive attack evasion (Section 4.3, citing Nasr et al. 2026), and structured representation trade-offs (hallucination, nuance attenuation)."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures valence shift (agree/disagree/ambiguous) via BERT classifier as a proxy for consensus manipulation. This proxy is well-calibrated: the BERT classifier achieves F1=0.98 (Appendix B). The paper acknowledges the proxy's limitations by separately analyzing ambiguous vs non-ambiguous outcomes and noting that 'small perturbations can easily flip intrinsically uncertain cases' (Section 5.2)."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "'LLaMA 3.1 8B Instruct' is specific, but 'GPT-4.1 Nano' and 'GPT-4.1 Mini' lack snapshot dates or API version identifiers. 'DeepSeek-R1' (Appendix M) and 'GPT-4o' (BERT labeling) also lack version specifics. Per schema rules, marketing names without snapshot dates do not count."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt texts are provided: consensus generation prompt in Figure 1a, all 40 injection texts in Appendix A (Tables 1–6), GSPO fine-tuning prompt in Appendix G, DPO+GSPO prompt in Appendix L, GPT-OSS-SafeGuard detection prompt in Appendix F, and political party stance extraction prompt in Appendix E."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Comprehensive hyperparameters reported: GSPO (LoRA r=32, α=64, ε=0.2, β=0.05, temperature=0.7, 4,500 steps, K=6 candidates); DPO (r=8, α=8, dropout=0.1, lr=5e-6, β=0.5, weight decay=0.2); BERT (lr=2e-5, batch=16, 5 epochs, weight decay=0); inference temperature=0.0 for DPO (Appendix L)."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The system is a sequential pipeline (detection → structured representation → GSPO-aligned generation) without tool use, memory, retry logic, or agent loops."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Full pipeline documented: 462 prompts → 301 'Should...?' questions (trade-off questions excluded) → 6,020 variants (20 orderings each) → 62 test questions sampled → BERT opinion classification → 80 adversarial variants per prompt → consensus generation → BERT consensus classification → majority-rule filtering → 35,521 consensus pairs. Counts at each stage with filtering criteria stated."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 ('Conclusion and Future Work') contains substantive limitations discussion: defense limitations with adaptive attacks, inability of empirical evaluations to guarantee long-term robustness, trade-offs of structured representations (nuance attenuation, hallucination), and multiple future research directions addressing identified gaps."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Specific threats discussed: (1) 'structured summaries can attenuate expressive nuance' (Section 4.3), (2) 'LLM-generated justifications may hallucinate or introduce subtle framing effects' (Section 4.3), (3) 'Adaptive attackers may design inputs that evade publicly known detectors' (Section 4.3, citing Nasr et al. 2026), (4) machine-readable attacks 'remain largely unaddressed by detection-based strategies' (Section 4.3), (5) ambiguous outcomes still highly vulnerable (Section 5.2)."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Explicit scope boundaries: 'we focus on human-readable prompt injections' (Section 3), 'prompt injections as one case of user-level attacks' (Section 1), 'not as a way to provide a definitive solution' (Section 1), defense results 'when restricting attention to non-ambiguous consensus outcomes' (Section 5.2). Future work identifies specific untested configurations (human-in-the-loop, local-to-global aggregation)."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The processed adversarial datasets (35,521 consensus pairs, BERT classifications, consensus outputs) are not released. The source dataset from Tessler et al. (2024) published in Science may be separately available but the authors do not provide a download link for their own data."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes the Tessler et al. 2024 experiment: 1,034 UK participants, groups of ~5, 20-minute deliberation sessions on public policy questions, opinion writing phase data used. The SmartVote validation uses 26,502 comments from Swiss parliamentary candidates (Appendix J, citing Stammbach et al. 2024)."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "The paper references the Tessler et al. (2024) study as the data source but does not describe how the original 1,034 participants were recruited, what channels were used, or whether recruitment could introduce bias. For the SmartVote data, recruitment is only described as 'candidates running for the national parliament in Switzerland.'"
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full pipeline from collection to analysis is documented with counts at each stage: 462 prompts → 301 'Should' questions → 6,020 variants → 62 test/239 train split → BERT classification → 80 adversarial alternatives per prompt → consensus generation → valence classification → majority-rule filtering → 35,521 pairs (17,403 support, 18,049 criticism, 17,761 completion, 17,761 ignore)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 lists funding: ERC grant 101166894 'ADDI', EU LearnData GA 101086712, IAST/ANR grant ANR-17-EURE-0010, European Lighthouse of AI for Sustainability grant 101120237."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All author affiliations are listed: Université de Toulouse, Center for Collective Learning (IAST/TSE), Université Toulouse Capitole, IRIT, Corvinus University of Budapest, University of Manchester. No authors are affiliated with the companies producing the evaluated models (Meta, OpenAI, Apertus consortium)."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Funding is from EU/ERC grants for digital democracy research and AI sustainability. These funders have no financial stake in whether LLMs are found vulnerable or robust to prompt injection attacks."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper. Absence of a disclosure statement does not confirm absence of conflicts."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defenses against prompt injection attacks rather than evaluating model knowledge on a benchmark. The core evaluation measures vulnerability to adversarial manipulation, not pre-trained capability. Per schema guidelines, contamination items are NA for studies that test defenses rather than model knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same rationale: the paper tests attack/defense dynamics, not model knowledge on benchmarks. Train/test overlap in the traditional contamination sense is not applicable."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same rationale: the paper evaluates prompt injection vulnerability, not pre-trained model performance on a knowledge benchmark."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not involve new human participants. It uses secondary data from Tessler et al. (2024) and automated LLM experiments."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No new human participants are involved. The paper analyzes existing data from a prior published study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No new human participants are involved in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No new human participants are recruited for this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No new human participants or experimental conditions involving humans."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants or evaluators involved in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants involved in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference costs, API costs, tokens consumed, or wall-clock times are reported despite generating tens of thousands of consensus statements across multiple models and running extensive bootstrapping analyses."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions models 'capable of running on a single A100 GPU' (Section 4.2) and states 4,500 GSPO gradient steps, but no total GPU hours, API spend, or training time is quantified."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No random seed sensitivity analysis is reported. LLM generation uses temperature 0.7 for GSPO and 0.0 for DPO inference, but results are not reported across multiple seeds."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of LLM generation runs per prompt is not explicitly stated. Each of the 6,020 prompt variants appears to receive one generation, but this is not confirmed. Bootstrap iterations (5,000) are for statistical analysis, not LLM generation runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "For BERT fine-tuning, the paper states 'After several experiments, the highest accuracy was reached with a learning rate of 2e-5, a batch size of 16, 5 epochs' but does not specify the number of configurations tried. GSPO hyperparameters are adopted from Pappone et al. without search."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "BERT hyperparameters were selected as the 'highest accuracy' configuration from 'several experiments' but the selection procedure (validation set, criterion) is not described. k-means with k=8 was selected 'after several tests with 2, 4, 8, 16, 32, 64, 128 and 256 clusters' without stating the selection criterion."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Many comparisons are made across 15 political parties, 8 policy clusters, 5 rhetorical strategies, 3 LLMs, and ignore/completion×support/criticism combinations. No correction for multiple comparisons (Bonferroni, Holm, etc.) is mentioned."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors design the attack taxonomy, implement the defense pipeline, and evaluate both — all within the same team. No independent evaluation is conducted and no acknowledgment of self-comparison bias is present."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "The defense pipeline adds substantial compute (GPT-OSS-SafeGuard detection, structured representation generation via GPT-4.1 Nano, GSPO fine-tuning) but performance is never compared at matched compute budgets against simpler baselines."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses whether valence-shift ASR actually measures consensus manipulation vulnerability. It separately analyzes ambiguous vs non-ambiguous outcomes, acknowledging that 'small perturbations can easily flip intrinsically uncertain cases' (Section 5.2). The BERT classifier is validated (F1=0.98). The majority-rule filtering isolates injection effects from baseline model failures (Section 4.2, Appendix D)."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. Models are evaluated directly on consensus generation without scaffolding."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The Tessler et al. (2024) dataset was published in Science before the training cutoffs of LLaMA 3.1, GPT-4.1 Nano, and Apertus 8B. The opinion texts and policy questions could appear in training data, potentially affecting how models handle these specific topics. This is not discussed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. The prompt format (Figure 1a) explicitly structures the task, and models may have been trained on similar consensus-generation tasks."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 6,020 prompt variants are derived from only 301 unique policy questions (20 orderings each), creating high structural similarity within question groups. This non-independence is not discussed or accounted for in the statistical analysis."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is applied. No canary strings, membership inference, or decontamination procedures are used."
       }
     }
   },
   "claims": [
     {
       "claim": "Default LLMs show widespread vulnerability to prompt injection in consensus generation, with ASR between 26% and 39% across policy domains.",
       "evidence": "Figure 4a shows ASR by policy cluster for LLaMA 3.1 8B Instruct with bootstrap CIs. Appendix H replicates for GPT-4.1 Nano and Apertus 8B (Section 5.1).",
       "supported": "strong"
     },
     {
       "claim": "Conservative and unionist parties show substantially higher vulnerability (41–80% ASR) compared to other parties (<27%).",
       "evidence": "Figure 4a right bar chart and heatmap. Reform UK, Conservative Party, and Ulster/Democratic/Traditional unionists show highest ASR. Replicated across all 3 LLMs (Appendix H, Section 5.1).",
       "supported": "strong"
     },
     {
       "claim": "Imperative Order and Impossibility of Agreement rhetorical strategies are most effective, yielding ASR of 35–52%, compared to 25–32% for emotional language and fabricated statistics.",
       "evidence": "Figure 10 and Appendix I show ASR by rhetorical strategy across all 3 LLMs (Section 5.1).",
       "supported": "strong"
     },
     {
       "claim": "The robustness pipeline (GPT-OSS-SafeGuard + structured representations + GSPO) reduces ASR to near zero across parties and policy clusters for non-ambiguous consensus outcomes.",
       "evidence": "Figure 4b shows post-defense ASR near 0% across nearly all party–cluster combinations. Appendix K decomposes by pipeline stage: filtering brings ASR to 1.8–11.8%, GSPO to 0–1.9% (Section 5.2).",
       "supported": "moderate"
     },
     {
       "claim": "GPT-OSS-SafeGuard detects 99.31% of injection texts and 0% of opinion texts as attacks.",
       "evidence": "Section 4.3 and Figure 8 (Appendix F) compare three detectors. GPT-OSS-SafeGuard outperforms Qwen3Guard and Syntactic Dependency Parsing.",
       "supported": "strong"
     },
     {
       "claim": "Single prompt injection attacks persist even with more than 30 contributors in consensus generation.",
       "evidence": "Appendix J replicates vulnerability analysis using 26,502 SmartVote candidate statements across 374 policy questions, varying group sizes from 5 to 40 (Figure 11). ASR remains above zero even with 30+ contributors.",
       "supported": "moderate"
     },
     {
       "claim": "Over-refusal rates after applying the defense pipeline range between 1.2% and 3.7%.",
       "evidence": "Appendix N, Figure 16 shows over-refusal rates computed from a 3×3 confusion matrix comparing original vs robust LLM in the absence of attacks.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Near-zero defense ASR conditional on excluding ambiguous outcomes",
       "detail": "The headline 'near-zero ASR' defense result is conditional on restricting to non-ambiguous (agree/disagree only) consensus outcomes. Appendix K shows that including ambiguous outcomes leads to 'much higher ASR estimates.' The paper acknowledges this but the abstract and main results emphasize the best-case non-ambiguous scenario."
     },
     {
       "flag": "All evaluation depends on automated BERT classifier",
       "detail": "Every evaluation metric relies on the fine-tuned BERT valence classifier (F1=0.98). No human evaluation of consensus statements is performed. Systematic BERT errors on adversarial/unusual text could propagate throughout all reported ASR values. The classifier was trained on GPT-4o labels, adding another layer of automated judgment."
     },
     {
       "flag": "Self-designed attacks evaluated by self-designed defenses",
       "detail": "The same team designed the attack taxonomy, implemented the defense pipeline, and evaluated both. As the paper itself notes (citing Nasr et al. 2026), 'adaptive attackers may design inputs that evade publicly known detectors.' No independent red-teaming or external evaluation was conducted."
     },
     {
       "flag": "Limited model diversity — only small/nano models tested",
       "detail": "Vulnerability and defense are evaluated only on LLaMA 3.1 8B Instruct, GPT-4.1 Nano, and Apertus 8B — all small models. Results may differ substantially for larger frontier models (GPT-4, Claude, etc.) which are more likely to be deployed in actual digital democracy applications."
     },
     {
       "flag": "No code or data release for verification",
       "detail": "Despite making policy-relevant claims about democratic AI vulnerabilities, no code, processed datasets, or consensus outputs are released. The 35,521 consensus pairs and defense pipeline cannot be independently verified."
     }
   ],
   "cited_papers": [
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["S. Chen", "J. Piet", "C. Sitawarin", "D. Wagner"],
       "year": 2024,
       "relevance": "Core prompt injection defense using structured queries, directly relevant to LLM security against injection attacks."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["S. Chen", "A. Zharmagambetov", "S. Mahloujifar", "K. Chaudhuri", "D. Wagner", "C. Guo"],
       "year": 2025,
       "relevance": "Defense against prompt injection using preference optimization (DPO), benchmarked against in this paper."
     },
     {
       "title": "Defeating Prompt Injections by Design",
       "authors": ["E. Debenedetti", "I. Shumailov", "T. Fan", "J. Hayes", "N. Carlini", "D. Fabian", "C. Kern", "C. Shi", "A. Terzis", "F. Tramèr"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "Design-level defenses against prompt injection, cited as a direction for stronger future guarantees."
     },
     {
       "title": "The attacker moves second: Stronger adaptive attacks bypass defenses against LLM jailbreaks and prompt injections",
       "authors": ["M. Nasr", "N. Carlini", "C. Sitawarin", "S. V. Schulhoff", "J. Hayes"],
       "year": 2026,
       "relevance": "Demonstrates that adaptive attackers can bypass prompt injection defenses, directly motivating this paper's robustness concerns."
     },
     {
       "title": "NeuralExec: Learning (and learning from) execution triggers for prompt injection attacks",
       "authors": ["D. Pasquini", "M. Strohmeier", "C. Troncoso"],
       "year": 2024,
       "relevance": "Machine-readable prompt injection attack technique, part of the taxonomy dimension in this paper."
     },
     {
       "title": "Follow my Instruction and Spill the Beans: Scalable data extraction from Retrieval-Augmented Generation Systems",
       "authors": ["Z. Qi", "H. Zhang", "E. Xing", "S. Kakade", "H. Lakkaraju"],
       "year": 2025,
       "relevance": "Data extraction attacks on RAG systems, relevant to LLM security vulnerabilities in deployed applications."
     },
     {
       "title": "Better Privilege Separation for Agents by Restricting Data Types",
       "authors": ["D. Jacob", "E. Alghamdi", "Z. Hu", "B. Alomair", "D. Wagner"],
       "year": 2025,
       "arxiv_id": "2509.25926",
       "relevance": "Defense framework converting untrusted content to curated data types, directly adopted for structured opinion representations in this paper."
     },
     {
       "title": "How Johnny can Persuade LLMs to Jailbreak them: Rethinking Persuasion to challenge AI safety by Humanizing LLMs",
       "authors": ["Y. Zeng", "H. Lin", "J. Zhang", "D. Yang", "R. Jia", "W. Shi"],
       "year": 2024,
       "relevance": "Taxonomy of persuasion strategies for jailbreaking LLMs, directly informing the rhetorical strategy dimension of this paper's attack taxonomy."
     },
     {
       "title": "AI can help humans find common ground in democratic deliberation",
       "authors": ["M. H. Tessler", "M. A. Bakker", "D. Jarrett", "H. Sheahan", "M. J. Chadwick", "R. Koster", "G. Evans"],
       "year": 2024,
       "relevance": "Source dataset and Habermas Machine consensus generation system that this paper tests for prompt injection vulnerability."
     },
     {
       "title": "Deliberative Alignment: Reasoning enables safer language models",
       "authors": ["M. Y. Guan", "M. Joglekar", "E. Wallace", "S. Jain", "B. Barak"],
       "year": 2024,
       "relevance": "Defense baseline using deliberative reasoning for safer LLM outputs, benchmarked against in Appendix M."
     },
     {
       "title": "Direct Preference Optimization: Your language model is secretly a reward model",
       "authors": ["R. Rafailov", "A. Sharma", "E. Mitchell", "C. D. Manning", "S. Ermon", "C. Finn"],
       "year": 2023,
       "relevance": "DPO alignment method used as a defense baseline component in Appendix L."
     },
     {
       "title": "Defending Against Prompt Injection With a Few Defensive Tokens",
       "authors": ["S. Chen", "Y. Wang", "N. Carlini", "C. Sitawarin", "D. Wagner"],
       "year": 2025,
       "relevance": "Defensive token approach to prompt injection defense, part of the broader defense landscape benchmarked against."
     },
     {
       "title": "Opportunities and risks of LLMs for scalable deliberation with Polis",
       "authors": ["C. T. Small", "I. Vendrov", "E. Durmus", "H. Homaei", "E. Barry", "J. Cornebise", "T. Suzman", "D. Ganguli", "C. Megill"],
       "year": 2023,
       "arxiv_id": "2306.11932",
       "relevance": "Study of LLMs for scalable deliberation with Pol.is platform, demonstrating both opportunities and risks of LLMs in digital democracy."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Directly relevant to teams building LLM-powered digital democracy or deliberation tools, with a concrete defense pipeline, but no released code to implement."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "LLM vulnerability to prompt injection is expected; the party-specific asymmetry (conservative parties more vulnerable) is somewhat surprising but not paradigm-shifting."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that democratic deliberation AI systems can be manipulated by single malicious participants, raising concerns about AI in governance."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Touches on political manipulation and democratic integrity but presents findings neutrally without controversy or blame."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or tool is released. Results cannot be reproduced or tried by others."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Uses GPT-4.1 Nano and LLaMA 3.1 (recognizable models) but the paper is from academic labs without major brand recognition."
     }
   }
 }