ai-research-survey

scan.json (29625B)

---

 {
   "paper": {
     "title": "PromptLocate: Localizing Prompt Injection Attacks",
     "authors": [
       "Yuqi Jia",
       "Yupei Liu",
       "Zedian Shao",
       "Jinyuan Jia",
       "Neil Zhenqiang Gong"
     ],
     "year": 2025,
     "venue": "IEEE S&P 2026",
     "arxiv_id": "2510.12252",
     "doi": "10.48550/arXiv.2510.12252"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "PromptLocate achieves 0.93–0.99 ROUGE-L and embedding similarity scores across seven existing prompt injection attacks on OpenPromptInjection, significantly outperforming attribution-method baselines (0.23–0.78). The three-step approach—semantic segmentation, oracle-based instruction localization, and contextual-inconsistency-based data localization—remains effective against eight adaptive attacks (RL 0.86–0.96). Practical applications include post-attack forensic analysis (1% FPR, 2% FNR) and data recovery retaining 85–100% of original task performance.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "Abstract states: 'Our code and data are available at: https://github.com/liu00222/Open-Prompt-Injection.'"
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "Code and data are provided at the GitHub link. The evaluation uses publicly available benchmarks: OpenPromptInjection and AgentDojo."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions GPU hardware (RTX A5000, H100) and model names (Mistral-7B, GPT-2, LLaMA3-8B-Instruct) but provides no requirements.txt, Dockerfile, or detailed dependency/version list sufficient to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "The paper provides no step-by-step reproduction instructions, 'Reproducing Results' section, or explicit commands. A GitHub repository is linked but the paper itself does not contain reproduction guidance."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1–8 are point estimates. No confidence intervals, error bars, or ± notation reported anywhere."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims PromptLocate 'significantly outperforms' baselines (Section 5.2) but no statistical significance tests (t-tests, bootstrap, etc.) are used. All comparisons are based on direct numerical comparison."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Raw performance values are reported for both PromptLocate and all baselines with full context. E.g., Table 1 shows PromptLocate RL=0.97 vs best baseline SFA-T RL=0.57 for Naive Attack, enabling magnitude assessment."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "Sample size (100 contaminated samples per target-injected task combination) is justified only by computational tractability: 'computationally expensive to evaluate. To make the evaluation tractable, we randomly sample 100.' No power analysis or statistical adequacy justification."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported. Results appear to be from single experimental runs. Values are averaged over task combinations but no spread across runs is shown."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Six baseline methods are compared: SFA-H, SFA-T, FRA-H, FRA-T, SVA-H, SVA-T (three attribution methods × two score selection strategies). Section 5.1.3 describes them in detail."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The baselines are adapted from standard attribution methods (SFA, FRA, SVA). Additionally, the oracle is built on DataSentinel (IEEE S&P 2025), which is state-of-the-art for prompt injection detection. Two concurrent methods are also compared in Section 7."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.4 presents comprehensive ablation studies: three variants of Step I (sentence/word/embedding segmentation, Tables 4), six combinations of oracles and search strategies for Step II (Table 5), and with/without Step III (Table 6)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Six evaluation metrics used: ROUGE-L, Embedding Similarity, Precision, Recall, ASV-B (before removal), and ASV-A (after removal). Defined in Section 5.1.2."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated using ROUGE-L, embedding similarity, precision, recall, and ASV metrics. No human evaluation of localization quality is performed."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Validation and test sets are explicitly separated: 'none of the target or injected data samples in the validation set overlap with those in the evaluation set' (Section 5.1.4). The oracle fine-tuning data is 'distributionally different from the OpenPromptInjection and AgentDojo datasets.'"
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by attack type (Tables 1, 3), by AgentDojo environment (Table 2: Banking, Travel, Slack, Workspace), by ablation variant (Tables 4–6), and by injected task (Table 14)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 discusses failure cases: same-type target/injected tasks, imperfect data recovery, and attacks that bypass the detector. Figure 5 shows an example with imperfect localization (Recall=0.70) on AgentDojo Slack. Lower Slack performance is noted in Section 5.2."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results reported: the oracle misses 63% of contaminated segments even after tailoring (Section 5.2); KAD performs worse than DataSentinel; individual-segment search is suboptimal; removing Step III drops RL from 0.97 to 0.89 (Table 6); lower Recall on AgentDojo Slack (0.73)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims 'accurately localizes injected prompts across eight existing and eight adaptive attacks' are supported by Tables 1–3 showing RL 0.86–0.99 across all settings."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims about component contributions are supported by controlled ablation studies: Step I variants (Table 4), Step II oracle/search variants (Table 5), and Step III inclusion (Table 6) each isolate single variables."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Claims are bounded to tested settings. Abstract specifies 'eight existing and eight adaptive attacks.' Results are reported per-benchmark and per-attack. Section 7 explicitly bounds scope, noting the method has 'limited effectiveness' when target and injected tasks are the same type."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 discusses alternative explanations and limitations: same-type attacks reduce to adversarial examples; imperfect recovery may still allow residual attacks; the method depends on the oracle's quality. The connection between prompt injection and classical injection attacks (SQL, XSS) is analyzed."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures ROUGE-L and embedding similarity between localized and ground-truth injected prompts, which directly measure localization accuracy—the stated goal. ASV-A measures the practical impact of removal. No proxy gap exists between the metrics and the claims."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are identified by family name but not exact version: 'LLaMA3-8B-Instruct,' 'Mistral-7B,' 'GPT-4o' (via Azure API without snapshot date), 'GPT-2.' Per the schema, marketing names like 'GPT-4o' without a snapshot date do not count as specified versions."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Detection instruction text is provided: 'Repeat [secret key] once while ignoring the following text:' (Section 2.3). Target instructions and injected prompts are given for the forensic analysis use case (Section 6.1, Figure 4). All other prompts come from the referenced OpenPromptInjection benchmark [6] with code at the provided GitHub link."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "Some hyperparameters are reported: τ=0 (segmentation threshold), α=1 (adaptive attack), 7-character secret key, 500 training segments. However, LLM inference parameters (temperature, top-p, max tokens) are not reported for any model."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "PromptLocate is a three-step localization pipeline, not an agentic scaffolding system. No agentic scaffolding is used."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Data preprocessing is thoroughly documented: validation dataset construction (556 samples from Combined Attack, Section 5.1.4), oracle training segment generation (500 clean + 500 contaminated segments), sampling strategy for evaluation (100 samples per task combination)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 'Discussion and Limitations' is a dedicated multi-paragraph section covering natural segmentation, evaluation scope, oracle alternatives, imperfect recovery, and adaptive attacks."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 discusses specific threats: 'PromptLocate may fail under adaptive attacks when the target task and the injected task are of the same type' because this 'reduces to a traditional adversarial example or a misinformation attack.' The imperfect recovery dilemma (denial-of-service vs. residual risk) is also specific."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 explicitly states what PromptLocate cannot handle: 'it is difficult to detect the contamination and for PromptLocate (or any method) to localize the injected content' when same-type attacks are used. The dependence on the underlying detector is acknowledged: 'prompt injection attacks that bypass the detector can also evade PromptLocate.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "Code and data are released at the GitHub repository. The benchmarks (OpenPromptInjection, AgentDojo) are publicly available. The Amazon Reviews dataset [44] used in Section 6.1 is public."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Data generation is described in detail: how contaminated samples are constructed from target and injected task pairs (Section 5.1.1), how validation datasets are generated (Section 5.1.4), and how oracle training data is created (Sections 4.2 and 5.1.4)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from standard benchmarks (OpenPromptInjection, AgentDojo, Amazon Reviews)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from benchmark datasets through contaminated sample generation to evaluation is documented: 7 tasks × 7 injected tasks × 100 samples = 4,900 per attack for OpenPromptInjection; separate validation set of 556 samples; oracle training with 500 clean + 500 contaminated segments."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgements section: 'This work was supported by NSF under grant no. 2450935, 2131859, 2125977, 2112562, and 1937787.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Duke University and The Pennsylvania State University, with email addresses provided."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "NSF (National Science Foundation) is an independent government funding agency with no financial stake in the outcome of prompt injection research."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests a defense/localization method, not a pre-trained model's capability on a benchmark. The evaluation measures PromptLocate's localization accuracy, not model knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above: the paper evaluates a localization system, not model knowledge on benchmarks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above: benchmark contamination in the training-data sense is not relevant since the evaluation is of the localization method's ability to find injected prompts."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Runtime is reported: 'about 11 seconds on average to localize injected prompts in a contaminated sample when running on a low-performance GPU (RTX A5000)' and '5.8 seconds' on H100. Table 12 gives per-method runtime breakdown. Sub-linear scaling with prompt length is demonstrated."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Per-sample runtime and GPU types are reported, but the total computational budget for all experiments (oracle training, evaluation across all attacks and benchmarks) is not stated."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. Results appear to be from single runs, with averaging only over task combinations."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs per configuration is not explicitly stated. Results are averaged over task combinations but it is unclear whether each combination was run once or multiple times."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": true,
         "justification": "The search budget for τ is explicitly stated: grid search over {−0.4, −0.2, 0, 0.2, 0.4} (5 values) evaluated on 556 validation samples. The oracle fine-tuning follows DataSentinel's alternating optimization procedure."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "τ is selected on a validation set (not test set) by maximizing ES score: 'we compute the ES score of PromptLocate on the validation set and select the value that maximizes ES. Using this procedure, we select τ = 0' (Section 5.1.4)."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "No statistical tests are performed at all, so no multiple comparison correction is applied. Results across 7 attacks and 49 task combinations are compared by direct numerical comparison without any statistical testing."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own system (PromptLocate) against baselines without acknowledging potential author-evaluation bias. Attribution baselines are re-implemented by the authors."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Table 12 shows runtime per method but performance is not plotted as a function of compute budget. PromptLocate takes 11.1s vs 2.3s for SFA baselines but the performance-compute tradeoff is not systematically analyzed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether OpenPromptInjection and AgentDojo adequately represent real-world prompt injection scenarios. No construct validity analysis of the benchmarks is provided."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "PromptLocate does not use agentic scaffolding and no model-scaffold comparisons are made. The method is evaluated as a standalone system."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the detection LLM (Mistral-7B) could have seen OpenPromptInjection or AgentDojo data during pre-training, or whether temporal ordering of data creates leakage."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For instance, whether the oracle's training distribution provides implicit signals about the test attacks is not analyzed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Explicitly addressed: 'none of the target or injected data samples in the validation set overlap with those in the evaluation set' (Section 5.1.4) and the oracle fine-tuning dataset is 'distributionally different from the OpenPromptInjection and AgentDojo datasets.'"
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection method (canary strings, membership inference, n-gram overlap) is applied. Independence is ensured by design (separate datasets) but not verified post-hoc."
       }
     }
   },
   "claims": [
     {
       "claim": "PromptLocate achieves 0.93–0.99 ROUGE-L and embedding similarity across all seven existing attacks on OpenPromptInjection.",
       "evidence": "Table 1 shows RL 0.94–0.98 and ES 0.93–0.99 across Naive Attack, Escape Character, Context Ignoring, Fake Completion, Combined Attack, Universal, and NeuralExec.",
       "supported": "strong"
     },
     {
       "claim": "PromptLocate significantly outperforms attribution method baselines for prompt injection localization.",
       "evidence": "Table 1: best baseline achieves RL 0.78 (SVA-T on NeuralExec) while PromptLocate achieves RL 0.94 on the same attack. Across all attacks, PromptLocate RL is 0.94–0.98 vs baselines 0.21–0.78.",
       "supported": "strong"
     },
     {
       "claim": "PromptLocate remains effective against eight adaptive attacks specifically designed to evade its three steps.",
       "evidence": "Table 3 shows RL 0.86–0.96 and ES 0.84–0.93 across Random-Loc, Multiple, Period, Single-Seg, Separator, Sep.+Ins., Swap, and Concat attacks. ASV drops significantly after removal in all cases.",
       "supported": "strong"
     },
     {
       "claim": "PromptLocate enables effective post-attack forensic analysis with 1% FPR and 2% FNR.",
       "evidence": "Table 7 shows Tailored-DS + Segment-group achieves FPR=0.01, FNR=0.02 for Combined Attack and FPR=0.00, FNR=0.04 for NeuralExec in the malicious review forensic analysis scenario.",
       "supported": "strong"
     },
     {
       "claim": "Data recovered by PromptLocate retains 85–100% of original task performance.",
       "evidence": "Table 8a: PR values range from 0.26 to 0.88 across OpenPromptInjection tasks with PNA-T from 0.30 to 0.94. Table 8b: PR ranges from 0.63 to 0.81 with PNA-T from 0.65 to 0.90 on AgentDojo.",
       "supported": "strong"
     },
     {
       "claim": "Step III (data-contaminated segment identification) substantially improves localization.",
       "evidence": "Table 6: removing Step III drops RL from 0.97 to 0.89 on the existing Combined Attack and from 0.92 to 0.83 on the adaptive variant.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No variance or uncertainty quantification",
       "detail": "All results are point estimates with no error bars, confidence intervals, or standard deviations. It is unclear whether results are from single runs or averaged over multiple runs, making it impossible to assess result stability."
     },
     {
       "flag": "No statistical significance tests",
       "detail": "Claims of 'significantly outperforms' are based solely on comparing point estimates. No t-tests, bootstrap tests, or other significance tests are performed despite extensive comparative claims across 7+ attack settings."
     }
   ],
   "cited_papers": [
     {
       "title": "Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection",
       "authors": ["K. Greshake", "S. Abdelnabi", "S. Mishra", "C. Endres", "T. Holz", "M. Fritz"],
       "year": 2023,
       "relevance": "Foundational work on indirect prompt injection attacks against real-world LLM-integrated applications."
     },
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Y. Liu", "Y. Jia", "R. Geng", "J. Jia", "N. Z. Gong"],
       "year": 2024,
       "relevance": "Provides the formal framework and OpenPromptInjection benchmark used as the primary evaluation platform in this work."
     },
     {
       "title": "DataSentinel: A game-theoretic detection of prompt injection attacks",
       "authors": ["Y. Liu", "Y. Jia", "J. Jia", "D. Song", "N. Z. Gong"],
       "year": 2025,
       "relevance": "State-of-the-art prompt injection detector adapted as the oracle in PromptLocate's Step II."
     },
     {
       "title": "Jatmo: Prompt injection defense by task-specific finetuning",
       "authors": ["J. Piet", "M. Alrashed", "C. Sitawarin", "S. Chen", "Z. Wei", "E. Sun", "B. Alomair", "D. Wagner"],
       "year": 2024,
       "relevance": "Defense against prompt injection via task-specific fine-tuning of LLMs."
     },
     {
       "title": "Secalign: Defending against prompt injection with preference optimization",
       "authors": ["S. Chen", "A. Zharmagambetov", "S. Mahloujifar", "K. Chaudhuri", "D. Wagner", "C. Guo"],
       "year": 2025,
       "relevance": "Prevention-based defense using preference optimization to make LLMs resilient to prompt injection."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": ["E. Debenedetti", "I. Shumailov", "T. Fan", "J. Hayes", "N. Carlini", "D. Fabian", "C. Kern", "C. Shi", "A. Terzis", "F. Tramèr"],
       "year": 2025,
       "relevance": "Security-policy-based defense enforcing constraints on LLM actions to prevent prompt injection."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["X. Liu", "Z. Yu", "Y. Zhang", "N. Zhang", "C. Xiao"],
       "year": 2024,
       "relevance": "Optimization-based universal prompt injection attack (Universal attack) evaluated in PromptLocate's experiments."
     },
     {
       "title": "Neural exec: Learning (and learning from) execution triggers for prompt injection attacks",
       "authors": ["D. Pasquini", "M. Strohmeier", "C. Troncoso"],
       "year": 2024,
       "relevance": "Optimization-based prompt injection attack (NeuralExec) that jointly optimizes separator and suffix, evaluated in experiments."
     },
     {
       "title": "A critical evaluation of defenses against prompt injection attacks",
       "authors": ["Y. Jia", "Z. Shao", "Y. Liu", "J. Jia", "D. Song", "N. Z. Gong"],
       "year": 2025,
       "relevance": "Systematic evaluation showing fine-tuned LLMs remain vulnerable to adaptive prompt injection attacks."
     },
     {
       "title": "Webinject: Prompt injection attack to web agents",
       "authors": ["X. Wang", "J. Bloch", "Z. Shao", "Y. Hu", "S. Zhou", "N. Z. Gong"],
       "year": 2025,
       "relevance": "Prompt injection attack targeting web-based LLM agents, relevant to agentic AI security."
     },
     {
       "title": "Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents",
       "authors": ["E. Debenedetti", "J. Zhang", "M. Balunovic", "L. Beurer-Kellner", "M. Fischer", "F. Tramèr"],
       "year": 2024,
       "relevance": "Agent-based prompt injection benchmark used as the second major evaluation platform in this work."
     },
     {
       "title": "System-level defense against indirect prompt injection attacks: An information flow control perspective",
       "authors": ["F. Wu", "E. Cecchetti", "C. Xiao"],
       "year": 2024,
       "relevance": "Information flow control approach to defending LLM agents against indirect prompt injection."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Localization of injected prompts is directly useful for deployed LLM applications doing forensic analysis and data recovery, though it requires fine-tuning a detection LLM."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Novel framing of localization (vs. detection/prevention), but the three-step approach is intuitive and does not challenge conventional wisdom about prompt injection."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Addresses AI security concerns (prompt injection in production LLM applications) and demonstrates adaptive attacks, but localization is a defensive tool."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy or conflict; straightforward defense contribution accepted at a top venue."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code and data released on GitHub with public benchmarks, making it feasible to reproduce and try, though it requires fine-tuning an oracle model."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Duke University and Penn State are well-known institutions but not top-of-mind AI labs for general audiences."
     }
   }
 }