ai-research-survey

scan.json (29925B)

---

 {
   "paper": {
     "title": "PromptScreen: Efficient Jailbreak Mitigation Using Semantic Linear Classification in a Multi-Staged Pipeline",
     "authors": [
       "Akshaj Prashanth Rao",
       "Advait Singh",
       "Saumya Kumaar Saksena",
       "Dhruv Kumar"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2512.19011"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "PromptScreen proposes a multi-stage defense pipeline against LLM jailbreak and prompt injection attacks, with a lightweight TF-IDF + Linear SVM classifier as its core component. The SVM achieves 93.4% accuracy and 96.5% specificity on a held-out test set drawn from 30,937 labeled prompts, while the full pipeline (SVM + VectorDB + classifier cluster) achieves 0% ASR at 47s average latency versus 450s for ShieldGemma. An ablation study shows character n-gram (2,4) features outperform word-level features under adversarial perturbations, reaching 94.09% accuracy.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 provides a GitHub URL: https://github.com/dronefreak/PromptScreen. The paper states 'the source code is available' at this link."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 states 'Both the corpus and associated preprocessing scripts are included in the open-source release of this work.' The adversarial data also references publicly available datasets (ADV-LLM, gentelbench-v1)."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, conda environment file, or detailed dependency specifications are provided in the paper. Library versions are not listed."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are included in the paper. While code is released, the paper contains no 'Reproducing Results' section or specific commands to run."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Tables 2, 3, and 4 report only point estimates (e.g., 93.40% accuracy) with no confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims the SVM 'outperforms' ShieldGemma and the classifier cluster based solely on comparing raw numbers in Table 2. No statistical significance tests (p-values, t-tests, etc.) are reported for any comparison."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports improvements with baseline context: accuracy from 35.1% (ShieldGemma) to 93.4% (LSVM), latency from ~450s to 47s, and block rate from 50.62% to 96.50% across defense subsets in Tables 2 and 3."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is given for why 30,937 prompts were chosen, why the test set is ~2,000 prompts, or whether this is sufficient for the claims made. No power analysis is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviation, variance across runs, or spread measures are reported anywhere. All results appear to be from single runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 compares the LSVM against ShieldGemma-2B and a classifier cluster. Table 3 compares multiple defense subset configurations. Table 4 compares 8 SVM ablation configurations."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "ShieldGemma (Google, 2024) is a recent production-grade defense. The classifier cluster uses contemporary models (textdetox/xlmr-large-toxicity-classifier-v2, jackhhao/jailbreak-classifier)."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 presents a systematic ablation study over 8 SVM feature configurations (word n-grams, character n-grams, hybrid), isolating the contribution of each representation type. Table 3 also ablates pipeline components."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports accuracy, precision, sensitivity (recall), specificity, negative predictive value, Attack Success Rate, and Time-to-Classify across multiple tables."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation of defense outputs is performed. All evaluation is automated using classification metrics and an LLM-as-a-judge for ASR verification."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 explicitly states: 'A held-out test set of more than 2,000 prompts is reserved exclusively for evaluation of defense configurations and Attack Success Rate. No prompt appears in more than one split.'"
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 provides per-defense breakdowns. Table 3 shows per-configuration defense effectiveness. Table 4 provides per-SVM-configuration breakdowns across all metrics. Table 1 shows dataset composition by category."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss specific examples of misclassified prompts, analyze why certain attacks bypass particular defense stages, or provide qualitative error analysis of the main system."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.1 explicitly reports 'defenses that were implemented but did not meet our robustness or usability requirements,' including the Heuristic Vector Analyzer and Polymorphic Prompt Assembly, with explanations of why they failed."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of 93.4% accuracy, 96.5% specificity, 10× lower latency than ShieldGemma, and improvement from 35.1% to 93.4% are all supported by Tables 2 and 3."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims (e.g., adding SVM to the pipeline reduces ASR) are supported by the ablation design: Table 3 shows defense subsets with and without the SVM, and Section 6 systematically varies one feature representation at a time while holding all else constant."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims 'staged, resource-efficient defenses can robustly secure modern LLM-driven applications' and the conclusion claims 'scalable, resource-efficient protection against prompt-based adversarial behavior,' but results are from one target model (gpt-oss:20b), one curated dataset, English only, and single-turn only. Limitations section acknowledges some bounds but the title and abstract make broader claims."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations for the results, such as whether the dataset characteristics favor TF-IDF+SVM approaches, whether the attack styles are particularly amenable to surface-pattern detection, or whether performance would hold on attacks drawn from different distributions."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures classification accuracy and ASR on a labeled prompt corpus, which directly corresponds to the claimed defense effectiveness. The measurements match the granularity of the claims without proxy gaps."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The target LLM is 'gpt-oss:20b' which is not a widely known model and lacks a snapshot/version date. The attack evaluator is described only as 'Gemini' without any version specification. ShieldGemma-2B is identified by size but not version/snapshot."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "No actual prompt text is provided for the LLM-as-a-judge attack evaluator, the ShieldGemma safety guidelines, or any other prompt-based component. The paper describes what prompts do conceptually but does not reproduce the actual text."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameters are reported: no SVM C parameter, no TF-IDF min/max_df settings, no VectorDB similarity threshold τ or k values, no temperature or sampling parameters for any LLM, no learning rates for any trained component."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not use agentic scaffolding. The multi-stage defense pipeline is the system being evaluated, not an agent scaffold."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.3.1 provides a detailed 7-step text preprocessing pipeline: lowercasing, emoji-to-text conversion, punctuation stripping, tokenization, alphabetic filtering, stopword removal, and POS-aware WordNet lemmatization."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 8 'Limitations' contains three specific subsections addressing multilingual constraints, multi-turn awareness, and generalization to zero-day attacks."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations are specific to this study: 'preprocessing pipeline is optimized for English-language prompts,' 'pipeline primarily evaluates prompts as isolated, single-turn inputs,' and 'performance is fundamentally bounded by the diversity of its training corpus.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 8 explicitly states what was not tested: multilingual attacks, multi-turn attacks, and truly novel zero-day attack strategies. These are specific scope boundaries."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 states 'Both the corpus and associated preprocessing scripts are included in the open-source release of this work to facilitate continued benchmarking and community evaluation.'"
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 describes data sources in detail: manually curated jailbreaks from prior literature, automated adversarial prompts from ADV-LLM, prompt-injection examples from gentelbench-v1, and benign prompts from public instruction-following datasets."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are public datasets and prior academic literature."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "While the paper describes data sources and final composition (Table 1: 30,937 total), there is no documentation of filtering stages — how many prompts were initially collected from each source, how many were removed by 'rule-based validation and manual verification,' or what the inclusion/exclusion criteria were at each stage."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding sources are mentioned. Section 9 'Acknowledgement' only acknowledges ChatGPT use for grammar improvement."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: BITS Pilani and Trustwise. Email addresses include institutional identifiers."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Cannot assess funder independence because funding is not disclosed. One author is affiliated with 'Trustwise,' which appears to be a commercial entity potentially in the AI trust/safety space, raising questions about financial interest in the outcome."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is present. The Trustwise affiliation is listed but the nature of any financial relationship is not addressed."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates a defense system (SVM + pipeline), not a pre-trained model's capability on a knowledge benchmark. The LLM (gpt-oss:20b) is the downstream target, not the system under evaluation."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defense mechanisms against adversarial prompts, not a pre-trained model's knowledge on a benchmark. Contamination in the traditional sense is not applicable."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates a defense pipeline, not a pre-trained model's benchmark performance. The SVM is trained on the paper's own curated dataset, not a pre-existing benchmark."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All evaluation is on automated prompt classification."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study evaluates automated defense mechanisms on a prompt corpus."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 reports average Time-to-Classify (TTC) for each defense configuration: 47.24s for the SVM-based pipeline, 30.13s for VectorDB+Classifier, and 450.35s for the ShieldGemma configuration."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated — no GPU hours, training time for the SVM or embedding models, hardware specifications, or total API spend for LLM evaluation."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. All results appear to be from single runs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. Results in Tables 2-4 are presented without indicating whether they are from single or multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported for the SVM, TF-IDF vectorizer, VectorDB threshold, or any other component. Section 6 ablates feature representations but not hyperparameters."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper presents the 'baseline' SVM configuration in Table 2 and the char n-gram (2,4) as best in Table 4, but does not explain how or why the baseline configuration was selected, or whether selection was done on validation or test data."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Eight SVM configurations are compared in Table 4 and three defense subsets in Table 3, but no statistical tests are performed at all, let alone corrections for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors do not acknowledge the bias of evaluating their own system. Their SVM is compared against their own implementation/deployment of ShieldGemma and other baselines without discussing whether the baselines were optimally configured."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "While TTC is reported alongside accuracy, performance is not systematically analyzed as a function of compute. The SVM uses far less compute than ShieldGemma but this asymmetry is not formally addressed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether its curated 30,937-prompt corpus validly represents the distribution of real-world jailbreak attacks, or whether accuracy on this corpus translates to real-world defense effectiveness."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates defense pipeline configurations, not model comparisons across different scaffolds. The pipeline IS the system under test."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of temporal relationships between training and test data, or whether the SVM's training corpus temporally overlaps with the held-out test set in ways that could inflate performance."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information (e.g., whether test prompts share templates, sources, or structural patterns with training prompts that enable surface-level matching rather than genuine generalization)."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'No prompt appears in more than one split,' but does not address whether prompts from the same source (e.g., ADV-LLM) in train and test splits share structural templates or are near-duplicates, which would inflate generalization estimates."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is applied (no n-gram overlap analysis, deduplication, or temporal splits)."
       }
     }
   },
   "claims": [
     {
       "claim": "The Text Processing + Semantic LSVM achieves 93.4% accuracy and 96.5% specificity on held-out data.",
       "evidence": "Table 2 reports accuracy 0.9340 and specificity 0.9650 for the LSVM module on the held-out test set (Section 5.1).",
       "supported": "moderate"
     },
     {
       "claim": "The full pipeline (SVM + VectorDB + Classifier) achieves 0% ASR, blocking all 1,456 evaluated adversarial attempts.",
       "evidence": "Table 3 shows 0 successful attacks out of 51 attempted (1,405 blocked) for the {SVM, VectorDB, Classifier} configuration. Verified using Gemini as LLM-as-a-judge.",
       "supported": "moderate"
     },
     {
       "claim": "The SVM-based configuration yields over 10× lower latency than ShieldGemma while improving accuracy from 35.1% to 93.4%.",
       "evidence": "Table 3 shows TTC of 47.24s for SVM config vs 450.35s for the ShieldGemma config. Table 2 shows accuracy 0.3513 for ShieldGemma vs 0.9340 for LSVM.",
       "supported": "moderate"
     },
     {
       "claim": "Character n-gram (2,4) TF-IDF features yield the highest SVM accuracy at 94.09% under adversarial perturbations.",
       "evidence": "Table 4 (Section 6) shows char n-gram (2,4) achieving 0.9409 accuracy, the highest among 8 tested configurations on an augmented dataset with leetspeak, homoglyphs, and whitespace perturbations.",
       "supported": "moderate"
     },
     {
       "claim": "Lightweight classical ML defenses can robustly secure modern LLM-driven applications against prompt injection and jailbreak attacks.",
       "evidence": "Supported by results on one target model (gpt-oss:20b) and one curated dataset. Conclusion (Section 7) generalizes to 'modern LLM-powered agents' broadly.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "Potentially unfair baseline comparison",
       "detail": "ShieldGemma shows only 35.1% accuracy and 4.6% specificity, meaning it flags nearly all inputs (including benign) as malicious. This suggests ShieldGemma may be misconfigured, used with an inappropriate threshold, or not designed for this binary classification task. The paper does not investigate or explain why a production-grade defense performs so poorly."
     },
     {
       "flag": "No statistical rigor in comparisons",
       "detail": "All claims of superiority are based on comparing raw point estimates from what appear to be single runs. No confidence intervals, significance tests, or multi-run variance are reported for any experiment."
     },
     {
       "flag": "Zero ASR claim on limited test set",
       "detail": "Claiming 0% ASR sounds definitive but is based on only 51 prompts that passed the defense stack (from ~1,456 tested). This is a property of the specific test corpus, not a guarantee of robustness. The phrasing 'eliminated all attacks' overstates what the evidence shows."
     },
     {
       "flag": "Unknown target model",
       "detail": "The target LLM 'gpt-oss:20b' is not a widely known model and cannot be easily looked up. This makes it difficult to contextualize the ASR results or assess whether the model's own safety measures contributed to the 0% ASR."
     },
     {
       "flag": "Undisclosed potential conflict of interest",
       "detail": "Author Dhruv Kumar is affiliated with 'Trustwise,' which appears to be a commercial entity in AI safety/trust. No competing interests statement is provided, and no funding disclosure explains the relationship."
     },
     {
       "flag": "Hyperparameters and configuration details missing",
       "detail": "Critical parameters — SVM regularization (C), TF-IDF vocabulary settings, VectorDB similarity threshold τ, number of neighbors k, and all LLM temperature/sampling settings — are never reported, undermining reproducibility."
     }
   ],
   "cited_papers": [
     {
       "title": "Prompt Injection Attacks and Defenses in Vision-Language Models",
       "authors": ["B. Greshake", "T. Lode", "R. Greshake"],
       "year": 2024,
       "relevance": "Foundational work on prompt injection as an attack vector against LLM-based systems."
     },
     {
       "title": "Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study",
       "authors": ["Y. Liu", "S. Li", "T. Wang", "P. Zhang", "S. Yan"],
       "year": 2024,
       "arxiv_id": "2305.13860",
       "relevance": "Empirical categorization of jailbreak strategies including role-playing and privilege escalation against ChatGPT."
     },
     {
       "title": "Greedy Coordinate Gradient-Based Search for Universal Adversarial Attacks",
       "authors": ["A. Zou", "Z. Li", "D. Zhou", "Y. Wu", "J. Gu", "Y. Wang"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Introduced universal adversarial suffix attacks (GCG) that bypass safety constraints across multiple LLMs."
     },
     {
       "title": "Iterative Self-Tuning LLMs for Enhanced Jailbreaking Capabilities",
       "authors": ["K. Sun", "H. Yang", "Q. Liu"],
       "year": 2024,
       "arxiv_id": "2410.18469",
       "relevance": "Demonstrates automated iterative refinement of adversarial tokens for near-perfect jailbreak success rates against closed-source models."
     },
     {
       "title": "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically",
       "authors": ["S. Mehrotra", "S. Dathathri", "A. Garg"],
       "year": 2023,
       "arxiv_id": "2312.02119",
       "relevance": "Automated black-box jailbreak method using Tree-of-Thought-style exploration, expanding the attack space without model internals."
     },
     {
       "title": "Emoji Attack: A Method for Misleading Judge LLMs in Safety Risk Detection",
       "authors": ["Y. Wei", "J. Chen", "Z. Li"],
       "year": 2024,
       "arxiv_id": "2411.01077",
       "relevance": "Demonstrates token-manipulation attacks using emoji insertion to mislead safety classifiers."
     },
     {
       "title": "Multi-Turn Jailbreaking Large Language Models via Attention Shifting",
       "authors": ["X. Du", "F. Mo", "M. Wen", "T. Gu", "H. Zheng", "H. Jin", "J. Shi"],
       "year": 2025,
       "relevance": "Shows multi-turn attacks exploiting dialogue history and attention dynamics significantly outperform single-shot jailbreaks."
     },
     {
       "title": "Intention Analysis Makes LLMs a Good Jailbreak Defender",
       "authors": ["Y. Zhang", "X. Wang", "M. Liu"],
       "year": 2024,
       "arxiv_id": "2401.06561",
       "relevance": "Pre-generation intent analysis defense that models user objectives against safety policies to reduce ASR."
     },
     {
       "title": "Attention Tracker: Detecting Prompt Injection Attacks in LLMs",
       "authors": ["S. Hung", "H. Chien", "Y. Lee"],
       "year": 2025,
       "arxiv_id": "2411.00348",
       "relevance": "Model-internal defense using anomalous attention distributions to detect prompt injection without external classifiers."
     },
     {
       "title": "From LLMs to MLLMs to Agents: A Survey of Emerging Security Challenges",
       "authors": ["Y. Mao", "T. Huang", "Z. Liu"],
       "year": 2025,
       "arxiv_id": "2506.15170",
       "relevance": "Survey of security challenges in agentic LLM deployments spanning the full LLM-to-agent spectrum."
     },
     {
       "title": "LLM Security: Vulnerabilities, Attacks, Defenses, and Countermeasures",
       "authors": ["C. Aguilera-Martínez", "F. Berzal"],
       "year": 2025,
       "arxiv_id": "2505.01177",
       "relevance": "Comprehensive survey of LLM security covering vulnerabilities, attack types, and defense mechanisms."
     },
     {
       "title": "Embedding-based classifiers can detect prompt injection attacks",
       "authors": ["M. A. Ayub", "S. Majumdar"],
       "year": 2024,
       "arxiv_id": "2410.22284",
       "relevance": "Demonstrates embedding-based classification as a defense against prompt injection, closely related to the SVM approach in this paper."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Defense framework with released code that could be integrated into LLM application pipelines, though requires adaptation for production use."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Shows a classical ML approach (TF-IDF + SVM) can outperform a neural LLM-based moderator, mildly surprising but not unprecedented."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Directly addresses LLM jailbreak and prompt injection security concerns relevant to deployed systems."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no challenge to specific companies or claims beyond standard benchmarking."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code released on GitHub with dataset; could be tried by practitioners, though no live demo or pip package."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "Authors from BITS Pilani and Trustwise — not a well-known AI lab or widely recognized brand."
     }
   }
 }