ai-research-survey

scan.json (28250B)

---

 {
   "paper": {
     "title": "PromptArmor: Simple yet Effective Prompt Injection Defenses",
     "authors": [
       "Tianneng Shi",
       "Kaijie Zhu",
       "Zhun Wang",
       "Yuqi Jia",
       "Will Cai",
       "Weida Liang",
       "Haonan Wang",
       "Hend Alzahrani",
       "Joshua Lu",
       "Kenji Kawaguchi",
       "Basel Alomair",
       "Xuandong Zhao",
       "William Yang Wang",
       "Neil Gong",
       "Wenbo Guo",
       "Dawn Song"
     ],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2507.15219",
     "doi": "10.48550/arXiv.2507.15219"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "PromptArmor, a prompting-based guardrail that uses an off-the-shelf LLM to detect and remove injected prompts, achieves FPR and FNR below 1% on AgentDojo with GPT-4o, GPT-4.1, or o4-mini, reducing attack success rate to near zero. Larger guardrail models perform better, with Qwen3-32B matching GPT-4.1 performance, while reasoning helps mid-sized models but cannot compensate for insufficient model capacity. The defense remains effective against adaptive fuzzing-based attacks (AgentVigil), and a memorization test suggests the guardrail LLM has not simply memorized the benchmark data.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No source code repository URL is provided anywhere in the paper. No GitHub link, Zenodo archive, or other code release is mentioned."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation uses AgentDojo (Debenedetti et al., 2024), a publicly available benchmark. The paper does not collect or modify any proprietary data."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or environment specification is provided. The paper mentions model names and temperature=0 but no software dependencies or environment setup details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The paper describes the method conceptually but does not include runnable scripts or detailed reproduction steps."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1 and 3 and Figure 3 are reported as point estimates with no confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used. Claims that PromptArmor outperforms baselines are based on comparing raw numbers in Table 1 without any formal testing."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Results are reported with baseline context: ASR drops from 54.53% (no defense) to 0.00% (PromptArmor-GPT-4.1), and UA improves from 64.27% to 76.35% (o4-mini). The magnitude of improvement is clear from the tables."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "AgentDojo provides 629 adversarial scenarios but no justification is given for whether this sample size is adequate for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Temperature is set to 0 for determinism, and only single-run results are reported. No variance, standard deviation, or spread measure across multiple runs is provided."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Six baseline defenses are compared in Table 1: Deberta, DataSentinel, MELON, Repeat Prompt, Delimiter, and Tool Filter, plus an undefended baseline."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include recent works: DataSentinel (Liu et al., 2025), MELON (Zhu et al., 2025), and Deberta (ProtectAI, 2024). These are state-of-the-art defenses."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 ablates the prompting strategy (with vs without definition for GPT-3.5). Section 4.3 systematically varies model size and reasoning capability across the Qwen3 family."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Four metrics are reported: FPR, FNR, UA (Utility under Attack), and ASR (Attack Success Rate)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is conducted. All evaluation is automated through AgentDojo's programmatic success criteria."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No separation of development and test data is described. The prompting strategy appears to have been designed and evaluated on the same AgentDojo scenarios. It is unclear whether any subset was used for prompt development."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": false,
         "justification": "Table 1 reports averages across the four attack types and combined ASR. No per-agent-type (banking, slack, travel, workspace) or per-attack-type breakdowns are provided despite AgentDojo having these categories."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 shows GPT-3.5 without definition has 60.24% FNR. Section 4.3 discusses Qwen3-0.6B's extreme trade-off between FPR and FNR. These are explicit failure modes of the approach."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "GPT-3.5 without the definition prompt has very high FNR (60.24%). Qwen3-0.6B cannot achieve reasonable security and utility simultaneously regardless of reasoning mode. Naïve prompting is shown to be ineffective."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of FPR/FNR below 1% are supported by Table 1 (GPT-4o: 0.07/0.23%, GPT-4.1: 0.56/0.13%, o4-mini: 0.34/0.47%). ASR below 1% is supported (GPT-4.1: 0.00%, GPT-4o: 0.47%, o4-mini: 0.08%). Robustness against adaptive attacks is supported by Table 3."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The primary causal claim is that PromptArmor reduces ASR. This is tested via controlled comparison: same benchmark, same backend LLM (GPT-4.1), same attack scenarios, with vs without PromptArmor. The ablations (Section 4.2-4.3) use controlled single-variable manipulation."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Effective Prompt Injection Defenses' and the paper recommends PromptArmor 'as a standard baseline for evaluating new defenses,' but all results are on a single benchmark (AgentDojo). The paper does not bound its claims to this benchmark or discuss generalization to other prompt injection scenarios."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.4 directly addresses the alternative explanation that effectiveness comes from memorization of AgentDojo data, using a memorization test on GPT-4.1 and the argument that GPT-3.5 (predating AgentDojo) also works."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures FPR, FNR, ASR, and UA directly on the benchmark's formal evaluation criteria. These metrics directly measure the claimed defense capability — detecting and removing injected prompts — without framing them as proxies for a broader outcome."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are referred to by marketing names: 'GPT-4o', 'GPT-4.1', 'o4-mini', 'GPT-3.5-Turbo', 'Qwen3-0.6B/8B/32B'. No API snapshot dates or exact version identifiers are provided."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Figure 2 provides the actual system and user message format used for the guardrail LLM. Section 4.2 describes the enhanced prompt for GPT-3.5 (adding a definition of prompt injection), though the exact definition text is not reproduced."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Temperature is explicitly set to 0 for all models, stated in both Sections 4.1 ('temperature set to 0 to ensure reproducibility') and the PromptArmor implementation details."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The PromptArmor pipeline is fully described in Section 3.1 and Figure 2: prompt guardrail LLM → detect injection → extract injected content → fuzzy matching removal → pass sanitized data to backend LLM."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes how AgentDojo constructs adversarial scenarios by combining user tasks with injection tasks (97 user tasks × injection tasks = 629 scenarios). The fuzzy matching removal technique for sanitization is described in Section 3.1."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "The paper has no dedicated Limitations or Threats to Validity section. The paper structure goes directly from evaluation results to Related Work to Conclusion."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No specific threats to validity are discussed anywhere in the paper."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what PromptArmor does NOT defend against, what attack types are excluded, or what settings the results do not apply to. It recommends adoption 'as a standard baseline' without bounding this recommendation."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Only aggregate results are reported in Tables 1-3 and Figure 3. No per-scenario results, detection outputs, or raw data are provided for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes AgentDojo's structure: 4 agent types with 16-40 user tasks each, injection points in environment state, 4 attack types, and 629 total adversarial scenarios."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The evaluation uses a standard benchmark (AgentDojo)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation pipeline is documented: AgentDojo generates scenarios → PromptArmor preprocesses tool-call results → agent executes with sanitized data → AgentDojo compares environment state to ground truth."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: UC Berkeley, UC Santa Barbara, Duke University, National University of Singapore, KACST, University of Washington. No authors are affiliated with OpenAI or other model providers being evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence of the funder cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates are stated for any of the models used (GPT-4o, GPT-4.1, o4-mini, GPT-3.5-Turbo, Qwen3 family)."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.4 directly investigates whether GPT-4.1 has memorized AgentDojo data using the memorization test from Staab et al. (2023). Average similarity was 0.34, with only 3.5% above the 0.6 threshold."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.4 addresses contamination: GPT-3.5 (released before AgentDojo) still works, suggesting effectiveness is not from memorization. A formal memorization test on GPT-4.1 shows low similarity scores."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or token consumption is reported despite PromptArmor requiring an additional LLM call for every data sample the agent processes."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, API costs, or hardware details are stated for any experiment."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "All experiments use temperature=0 for determinism. No results across multiple seeds or stochastic runs are reported."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is not explicitly stated. Temperature=0 implies single deterministic runs, but this is not confirmed."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. The prompt design process and how the final prompt was selected are not described."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper shows multiple guardrail LLM configurations but does not explain how the prompting strategy was developed or whether it was tuned on AgentDojo scenarios."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement PromptArmor and compare it against published baselines. No acknowledgment of author-evaluation bias or the possibility that their implementation of baselines may underperform."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "PromptArmor requires an additional LLM call per data sample, which could significantly increase cost. No analysis of the cost-performance tradeoff relative to baselines is provided."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AgentDojo's attack scenarios and evaluation criteria are representative of real-world prompt injection threats. The paper uses AgentDojo without questioning its construct validity."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "The backend LLM is held constant (GPT-4.1) across all experiments in Table 1, isolating the guardrail LLM as the variable. The agent scaffold (AgentDojo environment) is also held constant."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.4 addresses temporal concerns: GPT-3.5 was released before AgentDojo and still shows effectiveness, arguing against memorization as the explanation for performance."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the AgentDojo evaluation setup provides features or context to the guardrail LLM that would not be available in real deployment."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AgentDojo's 629 scenarios are structurally independent or share templates, attack patterns, or injection styles that could inflate performance estimates."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.4 applies the Staab et al. (2023) memorization test: splitting data samples into prefix-suffix pairs, prompting GPT-4.1 with the prefix, and measuring edit-distance similarity to the suffix. Average similarity was 0.34, with only 3.5% above the 0.6 memorization threshold."
       }
     }
   },
   "claims": [
     {
       "claim": "PromptArmor achieves FPR and FNR below 1% with GPT-4o, GPT-4.1, and o4-mini on AgentDojo",
       "evidence": "Table 1: GPT-4o (0.07% FPR, 0.23% FNR), GPT-4.1 (0.56% FPR, 0.13% FNR), o4-mini (0.34% FPR, 0.47% FNR)",
       "supported": "strong"
     },
     {
       "claim": "After removing injected prompts with PromptArmor, the attack success rate drops to below 1%",
       "evidence": "Table 1: GPT-4.1 achieves 0.00% ASR, GPT-4o 0.47%, o4-mini 0.08%, compared to 54.53% with no defense",
       "supported": "strong"
     },
     {
       "claim": "PromptArmor is robust against adaptive attacks specifically designed to circumvent it",
       "evidence": "Table 3: Against AgentVigil-Adaptive (attacks optimized against PromptArmor), ASR is 0.34% with 0.70% FPR and 2.26% FNR",
       "supported": "moderate"
     },
     {
       "claim": "Larger LLMs generally make PromptArmor more effective, with model capacity being the primary factor",
       "evidence": "Figure 3: Qwen3-0.6B has extreme FPR/FNR trade-offs, Qwen3-8B achieves reasonable balance, Qwen3-32B matches GPT-4.1 performance across all metrics",
       "supported": "strong"
     },
     {
       "claim": "Reasoning capability improves performance especially in mid-sized LLMs but cannot compensate for insufficient model capacity",
       "evidence": "Figure 3: Reasoning reduces Qwen3-8B FNR from 26.59% to 15.78%; for Qwen3-0.6B, reasoning shifts from high FPR to high FNR without resolving the fundamental trade-off",
       "supported": "moderate"
     },
     {
       "claim": "The effectiveness is not due to memorization of AgentDojo data by the guardrail LLM",
       "evidence": "Section 4.4: GPT-3.5 (released before AgentDojo) is effective; memorization test on GPT-4.1 shows average similarity 0.34 and only 3.5% above the 0.6 threshold",
       "supported": "moderate"
     },
     {
       "claim": "PromptArmor challenges the common belief that off-the-shelf LLMs cannot defend against prompt injection attacks",
       "evidence": "Section 1: Prior work (Liu et al., 2024, 2025) claimed this; the authors attribute the misconception to (1) older LLMs and (2) poorly designed prompts. Table 1 demonstrates effectiveness with newer models.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Single benchmark evaluation",
       "detail": "All results are from AgentDojo only. The paper makes broad claims about prompt injection defense effectiveness and recommends adoption 'as a standard baseline' but provides no evidence from other benchmarks, real-world deployments, or diverse attack settings."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper entirely lacks a limitations or threats to validity section, which is unusual for a security paper and prevents readers from understanding the boundaries of the approach."
     },
     {
       "flag": "No uncertainty quantification",
       "detail": "All results are single-run point estimates at temperature=0. No error bars, confidence intervals, or variance measures are reported. Claims of '0.00% ASR' are presented without acknowledging the finite sample (629 scenarios)."
     },
     {
       "flag": "Missing cost analysis for practical deployment",
       "detail": "PromptArmor requires an additional LLM API call for every data sample processed by the agent, potentially doubling inference costs. No cost, latency, or overhead analysis is provided despite claiming practical applicability."
     },
     {
       "flag": "Unbounded generalization claims",
       "detail": "The paper recommends PromptArmor 'as a standard baseline for evaluating new defenses against prompt injection attacks' based solely on AgentDojo results, without testing on other attack benchmarks or real-world scenarios."
     }
   ],
   "cited_papers": [
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "Primary benchmark used for evaluating prompt injection defenses, provides standardized attack scenarios for LLM agents."
     },
     {
       "title": "SecAlign: Defending Against Prompt Injection with Preference Optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2025,
       "relevance": "Training-based defense using DPO for prompt injection robustness; evaluated on AgentDojo."
     },
     {
       "title": "DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks",
       "authors": ["Yupei Liu", "Yuqi Jia", "Jinyuan Jia", "Dawn Song", "Neil Zhenqiang Gong"],
       "year": 2025,
       "arxiv_id": "2504.11358",
       "relevance": "Detection-based defense using minimax optimization; compared as baseline in the paper."
     },
     {
       "title": "MELON: Indirect Prompt Injection Defense via Masked Re-Execution and Tool Comparison",
       "authors": ["Kaijie Zhu", "Xianjun Yang", "Jindong Wang", "Wenbo Guo", "William Yang Wang"],
       "year": 2025,
       "relevance": "System-level defense using masked re-execution; compared as baseline achieving 3.18% ASR."
     },
     {
       "title": "Defeating Prompt Injections by Design",
       "authors": ["Edoardo Debenedetti", "Ilia Shumailov", "Tianqi Fan", "Jamie Hayes", "Nicholas Carlini"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "System-level defense (CaMeL) using control and data flow management against prompt injection."
     },
     {
       "title": "Progent: Programmable Privilege Control for LLM Agents",
       "authors": ["Tianneng Shi", "Jingxuan He", "Zhun Wang", "Linyu Wu", "Hongwei Li", "Wenbo Guo", "Dawn Song"],
       "year": 2025,
       "arxiv_id": "2504.11703",
       "relevance": "System-level defense using privilege control for LLM agent security."
     },
     {
       "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions",
       "authors": ["Eric Wallace", "Kai Xiao", "Reimar Leike", "Lilian Weng", "Johannes Heidecke", "Alex Beutel"],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Training-based defense establishing instruction priority levels to mitigate prompt injection."
     },
     {
       "title": "StruQ: Defending Against Prompt Injection with Structured Queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Training-based defense using structured queries to separate instructions from data."
     },
     {
       "title": "A Critical Evaluation of Defenses Against Prompt Injection Attacks",
       "authors": ["Yuqi Jia", "Zedian Shao", "Yupei Liu", "Jinyuan Jia", "Dawn Song", "Neil Zhenqiang Gong"],
       "year": 2025,
       "arxiv_id": "2505.18333",
       "relevance": "Systematic evaluation showing training-based defenses degrade instruction-following and remain vulnerable to adaptive attacks."
     },
     {
       "title": "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "relevance": "Benchmark for indirect prompt injection attacks in tool-integrated LLM agents."
     },
     {
       "title": "Formalizing and Benchmarking Prompt Injection Attacks and Defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Formalization and benchmarking of prompt injection attacks and defenses; cited as prior work claiming off-the-shelf LLMs cannot defend against prompt injection."
     },
     {
       "title": "SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering",
       "authors": ["John Yang", "Carlos E Jimenez", "Alexander Wettig", "Kilian Lieret", "Shunyu Yao", "Karthik Narasimhan", "Ofir Press"],
       "year": 2024,
       "relevance": "Key LLM agent for software engineering, representative of the agent paradigm that prompt injection attacks target."
     },
     {
       "title": "IsolateGPT: An Execution Isolation Architecture for LLM-Based Systems",
       "authors": ["Yuhao Wu", "Franziska Roesner", "Tadayoshi Kohno", "Ning Zhang", "Umar Iqbal"],
       "year": 2025,
       "relevance": "System-level defense using execution environment isolation for LLM security."
     }
   ]
 }