ai-research-survey

scan.json (31350B)

---

 {
   "paper": {
     "title": "ReasAlign: Reasoning Enhanced Safety Alignment against Prompt Injection Attack",
     "authors": [
       "Hao Li",
       "Yankai Yang",
       "G. Edward Suh",
       "Ning Zhang",
       "Chaowei Xiao"
     ],
     "year": 2026,
     "venue": "arXiv.org",
     "arxiv_id": "2601.10173",
     "doi": "10.48550/arXiv.2601.10173"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "ReasAlign incorporates structured reasoning steps into LLM safety alignment to defend against indirect prompt injection attacks while preserving utility. On CyberSecEval2, ReasAlign achieves 94.6% utility and 3.6% ASR, far outperforming Meta SecAlign (56.4% utility, 74.4% ASR). Ablation studies show that the reasoning mechanism is the primary driver of security improvement, reducing ASR from 21.8% to 3.6% on CySE compared to direct-answer supervision. The approach generalizes across general knowledge, instruction-following, and agentic workflow benchmarks on both Llama-3.1-8B and Qwen2.5-14B.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states: 'Our code and experimental results could be found at https://github.com/leolee99/ReasAlign.'"
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "All evaluation benchmarks (MMLU, MMLU-Pro, IFEval, BBH, AlpacaEval2, SEP, CyberSecEval2, InjecAgent, AgentDojo) are publicly available standard datasets. Training data sources (SQuADv2, TaskTracker, BeaverTails) are also public."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Section 5.1 lists the base model (Llama-3.1-8B-Instruct) and training hyperparameters, but no library versions, requirements.txt, Dockerfile, or detailed environment specifications are provided."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "While code is released at a GitHub URL and implementation details are in Section 5.1, the paper contains no step-by-step reproduction instructions or 'Reproducing Results' section."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Figures 3, 4, and Tables 1-2 are reported as point estimates with no confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used anywhere. Claims like 'ReasAlign outperforms Meta SecAlign' are based solely on comparing raw numbers without any statistical testing."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper consistently reports absolute differences with baseline context, e.g., 'reduces the ASR from 43.6% to just 3.6% on CySE' and 'utility gap between ReasAlign and Meta SecAlign widens significantly, reaching 38.2% on CySE.' Baseline values are provided alongside improvements."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is provided for sample sizes. The paper uses standard benchmarks without discussing whether the benchmark sizes are adequate for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance, or multi-run statistics are reported. Results appear to be from single runs with no spread measures."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 describes three baselines: undefended Llama-3.1-8B-Instruct, SecAlign, and Meta-SecAlign-8B. All are compared across all benchmarks."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Meta SecAlign (Chen et al., 2025) is identified as the state-of-the-art defense model. SecAlign (Chen et al., 2024b) is also recent. These represent the strongest known defenses at the time of writing."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.5 ablates the reasoning module (with vs. without reasoning, Table 1). Section 5.6 ablates the node scaling parameter N from 1 to 5 (Figure 5)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Two primary metrics are used throughout: Utility (task completion/correctness) and Attack Success Rate (ASR). Both are reported for every benchmark."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated. Utility is assessed by a GPT-4o-mini judge for instruction-following tasks, and by benchmark-defined metrics for general knowledge and agentic tasks. No human evaluation is performed."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The model is trained on synthesized data from SQuADv2/TaskTracker/BeaverTails and evaluated on entirely separate benchmarks (MMLU, CySE, SEP, InjecAgent, AgentDojo), providing clear train/test separation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down across three evaluation dimensions (general knowledge: 4 benchmarks in Figure 3; instruction following: utility and security in Figure 4; agentic workflows: Table 2), with per-benchmark numbers throughout."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The case studies (Figures 1, 6) show ReasAlign succeeding where Meta SecAlign fails. No cases where ReasAlign itself fails are shown or analyzed."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports slight utility degradation on general knowledge tasks (Figure 3), reduced no-attack utility on SEP (-0.9% vs. direct answer in Table 1), lower utility than base Qwen2.5-14B on AgentDojo (24.9% vs 27.4% in Table 2), and higher token overhead (Section 5.7, Figure 10)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of '94.6% utility and only 3.6% ASR' on CyberSecEval2 and Meta SecAlign's '56.4% utility and 74.4% ASR' are confirmed by Figure 4. The claim of 'best trade-off between security and utility' is supported across all evaluation dimensions."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper claims reasoning improves security. Section 5.5 provides a controlled ablation comparing the same training data with vs. without reasoning steps (Table 1), demonstrating a causal contribution of the reasoning mechanism."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims ReasAlign is 'a robust and practical defense against prompt injection attacks in real-world agentic systems,' but testing is limited to specific benchmarks with two models (Llama-3.1-8B and Qwen2.5-14B). No real-world deployment evaluation is performed."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss alternative explanations such as whether improvements stem from the specific training data composition rather than reasoning, whether GPT-4o-mini's reasoning patterns encode specific heuristics, or whether results would hold against adaptive attackers aware of the defense mechanism."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures utility (task completion correctness) and ASR (whether the model follows injected instructions), which directly correspond to what is claimed. The metrics match the granularity of the claims."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "While 'Llama-3.1-8B-Instruct' and 'Qwen2.5-14B-Instruct' are reasonably specific, 'GPT-4o-mini' is used as both the data generator (Section 4.1) and evaluation judge (Section 5.1) without any snapshot date or API version. GPT-4o-mini behavior changes across versions."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "Figures 7 and 8 provide prompt templates for training data generation with placeholders ({user query}, {context}, etc.). However, the agent evaluation system prompt is only cited (Husain, 2024) but not reproduced, and the GPT-4o-mini judge prompt is not provided. A reader cannot reconstruct every prompt sent to the model."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 reports: batch size 4, 3 epochs, Adam optimizer with weight decay, learning rate 2×10⁻⁵, max input length 8192 tokens, N=3 for test-time scaling."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The structured reasoning pipeline (Section 4.1: problem analysis → reasoning → final answer) and test-time scaling mechanism (Section 4.2: beam search tree with judge model scoring nodes) are described in detail, including the judge training procedure with DPO."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 documents the full data construction pipeline: user queries and context from SQuADv2, injection triggers from TaskTracker, injection instructions from BeaverTails, followed by structured reasoning sampling with GPT-4o-mini."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' section appears after the conclusion, discussing the overhead introduced by reasoning-based approaches."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The limitations section mentions only the overhead issue and a future direction to explore selective reasoning. It does not discuss specific threats such as: GPT-4o-mini serving as both data generator and evaluator, potential overfitting to SQuADv2-style patterns, or vulnerability to adaptive attacks."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. It claims broad applicability to 'real-world agentic systems' without bounding the scope to the specific benchmarks and models tested."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The evaluation benchmarks are publicly available, but the model's raw outputs, synthesized training data, and judge model scores are not released. The Ethics Statement says artifacts 'will be made publicly available' (future tense)."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes the data collection in detail: sources (SQuADv2 for queries/context, TaskTracker for triggers, BeaverTails for injection instructions), synthesis process, and structured reasoning sampling with GPT-4o-mini."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are standard publicly available benchmarks and datasets."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 documents the pipeline from source data collection through injection sample synthesis, structured reasoning sampling, and safety alignment training. Section 4.2 describes the judge training pipeline with paired preference data."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding acknowledgment, grants, or sponsorship information appears anywhere in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: Washington University in St. Louis, University of Wisconsin–Madison, NVIDIA, and Johns Hopkins University. NVIDIA affiliation is disclosed for G. Edward Suh and Chaowei Xiao."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Two authors (G. Edward Suh, Chaowei Xiao) are affiliated with NVIDIA, which has a commercial interest in LLM security and deployment. No independence statement is provided, and no funding source is disclosed to assess independence."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement appears in the paper. NVIDIA affiliations could represent undisclosed financial interests."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper evaluates Llama-3.1-8B-Instruct on general knowledge benchmarks (MMLU, MMLU-Pro, BBH, IFEval) without stating the model's training data cutoff date."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether MMLU, MMLU-Pro, BBH, or IFEval questions may have appeared in Llama-3.1's pre-training data."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "MMLU (2021) and BBH were published well before Llama-3.1's training. No contamination analysis is performed despite this temporal overlap making contamination plausible."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All evaluation is automated."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The Ethics Statement discusses responsible AI development but not human subjects review."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.7 analyzes token overhead. Figure 10 compares average token cost per sample between ReasAlign and Meta SecAlign across four benchmarks, with discussion of the tradeoff between cost and performance gains."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total GPU hours, training time, or hardware specifications are provided. Training hyperparameters are listed but the total computational budget for training or the hardware used is not stated."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No multi-seed results are reported. All results appear to be from single runs with no analysis of seed sensitivity."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. Results are presented without clarifying whether they represent single runs or averages."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Hyperparameters are stated (Section 5.1) but no search budget, search method, or number of configurations tried is reported."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "The N=3 test-time scaling parameter is justified through the ablation study in Section 5.6 (Figure 5), which shows diminishing returns beyond N=3. The selection is made on a principled basis."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparisons across 9+ benchmarks and multiple methods without performing any statistical tests, let alone applying multiple comparison corrections."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors reproduce Meta SecAlign using its official code for the Qwen experiment, but do not acknowledge the general bias of evaluating their own system. No independent evaluation or acknowledgment of author-evaluation bias."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.7 compares token overhead between ReasAlign and Meta SecAlign (Figure 10). Section 5.6 shows how performance varies with the number of scaling nodes N, directly relating compute cost to performance."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses multiple benchmarks but does not discuss whether they actually measure real-world prompt injection defense effectiveness. No analysis of construct validity for any benchmark."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "All methods are compared on the same base model (Llama-3.1-8B-Instruct). The test-time scaling component is separately ablated (N=1 in Section 5.7 isolates reasoning overhead from scaling). The Qwen2.5-14B experiment uses the same training framework. The scaffold variable is controlled."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether Llama-3.1's training data includes solutions to MMLU, BBH, or other benchmark problems that were publicly available before the model's training cutoff."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For example, the structured input format (user query vs. external data separation) could provide leakage cues."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "While training data (SQuADv2-based) and evaluation benchmarks are from different sources providing implicit independence, this is never explicitly discussed or verified."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention methods (canary strings, membership inference, temporal splits, decontamination) are applied."
       }
     }
   },
   "claims": [
     {
       "claim": "ReasAlign achieves 94.6% utility and only 3.6% ASR on CyberSecEval2, far surpassing Meta SecAlign (56.4% utility, 74.4% ASR).",
       "evidence": "Figure 4 shows CySE results under attack: ReasAlign 94.6% utility / 3.6% ASR vs. Meta SecAlign 56.4% utility / 7.3% ASR. The 74.4% ASR cited in the abstract for Meta SecAlign appears to reference the SEP benchmark under attack for the undefended Llama3 model, not Meta SecAlign on CySE. Meta SecAlign achieves 7.3% ASR on CySE per Figure 4.",
       "supported": "moderate"
     },
     {
       "claim": "The reasoning mechanism is the primary driver of security improvement, reducing ASR from 21.8% to 3.6% on CySE.",
       "evidence": "Table 1 (Section 5.5) compares direct-answer supervision vs. reasoning-enhanced ReasAlign on the same training data. ASR drops from 21.8% to 3.6% on CySE and from 66.9% to 1.1% on SEP with reasoning added.",
       "supported": "strong"
     },
     {
       "claim": "ReasAlign maintains utility comparable to the undefended model while significantly improving security.",
       "evidence": "Figure 3 shows general knowledge scores within 0.5% of the base model on average. Figure 4 shows no-attack utility of 96.8% (AlpacaEval2) and 98.0% (SEP) vs. 95.7% and 99.0% for base Llama3. Under attack, utility improves from 78.2% to 94.6% on CySE.",
       "supported": "strong"
     },
     {
       "claim": "Test-time scaling improves both utility and security as the number of nodes increases from 1 to 5.",
       "evidence": "Figure 5 (Section 5.6) on SEP shows under-attack utility improving from 91.6% (N=1) to 96.4% (N=5) and ASR decreasing from 4.6% to 0.9%. Growth rates slow after N=3.",
       "supported": "strong"
     },
     {
       "claim": "ReasAlign generalizes to larger models, reducing ASR on AgentDojo from 14.5% to 2.4% and on InjecAgent from 24.5% to 2.7% with Qwen2.5-14B.",
       "evidence": "Table 2 shows Qwen2.5-14B results: ReasAlign achieves 2.4% ASR on AgentDojo (vs. 14.5% undefended, 8.1% Meta SecAlign) and 2.7% on InjecAgent (vs. 24.6% undefended, 4.3% Meta SecAlign), with slight utility loss (24.9% vs. 27.4% on AgentDojo).",
       "supported": "strong"
     },
     {
       "claim": "ReasAlign achieves the best trade-off between security and utility across all evaluated tasks.",
       "evidence": "Across 7 utility benchmarks and 4 security benchmarks, ReasAlign consistently achieves the lowest or near-lowest ASR while maintaining the highest utility under attack. Some slight utility loss on no-attack settings (e.g., -0.9% on SEP in Table 1).",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or variance across runs",
       "detail": "All results are reported as single point estimates with no confidence intervals, standard deviations, or multi-seed experiments. Given that fine-tuning and test-time scaling involve stochastic elements, the stability of results is unknown."
     },
     {
       "flag": "GPT-4o-mini used as both data generator and evaluator",
       "detail": "GPT-4o-mini generates the structured reasoning training data (Section 4.1) and also serves as the evaluation judge for utility assessment (Section 5.1). This circular dependency could inflate utility scores if the judge model favors patterns similar to those it generated."
     },
     {
       "flag": "Potential abstract ASR discrepancy",
       "detail": "The abstract states Meta SecAlign has '74.4% ASR' on CyberSecEval2, but Figure 4 shows Meta SecAlign achieving 7.3% ASR on CySE. The 74.4% figure appears to come from the undefended Llama3 model on SEP. This should be verified against the source data."
     },
     {
       "flag": "No adaptive attack evaluation",
       "detail": "All attacks are drawn from existing benchmarks. The paper does not evaluate against adaptive attackers who know ReasAlign's defense mechanism (e.g., crafting injections that mimic the structured reasoning format or that are designed to pass the reasoning check)."
     },
     {
       "flag": "NVIDIA affiliation without conflict disclosure",
       "detail": "Two authors are affiliated with NVIDIA, which has commercial interests in LLM security and deployment. No competing interests statement or funding disclosure is provided."
     }
   ],
   "cited_papers": [
     {
       "title": "Struq: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David A. Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Foundational model-level prompt injection defense that introduces structured input separation, serving as a key baseline."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2024,
       "arxiv_id": "2410.05451",
       "relevance": "Direct predecessor using DPO for prompt injection defense; compared as baseline throughout the paper."
     },
     {
       "title": "Meta SecAlign: A secure foundation LLM against prompt injection attacks",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "David Wagner", "Chuan Guo"],
       "year": 2025,
       "arxiv_id": "2507.02735",
       "relevance": "State-of-the-art model-level defense against prompt injection; primary baseline showing over-defense issues."
     },
     {
       "title": "CyberSecEval 2: A wide-ranging cybersecurity evaluation suite for large language models",
       "authors": ["Manish Bhatt", "Sahana Chennabasappa", "Yue Li"],
       "year": 2024,
       "arxiv_id": "2404.13161",
       "relevance": "Key evaluation benchmark for LLM security including prompt injection tasks in open-ended settings."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "relevance": "Agentic prompt injection benchmark used to evaluate defense effectiveness in tool-integrated LLM agents."
     },
     {
       "title": "AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "Dynamic agent security benchmark providing realistic evaluation of prompt injection attacks and defenses."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": ["Edoardo Debenedetti", "Ilia Shumailov", "Tianqi Fan"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "CaMeL system-level defense using static control/data flow analysis to enforce security against prompt injection."
     },
     {
       "title": "PIGuard: Prompt injection guardrail via mitigating overdefense for free",
       "authors": ["Hao Li", "Xiaogeng Liu", "Ning Zhang", "Chaowei Xiao"],
       "year": 2025,
       "relevance": "External prompt injection guardrail that addresses the overdefense problem, closely related to ReasAlign's motivation."
     },
     {
       "title": "IsolateGPT: An execution isolation architecture for LLM-based agentic systems",
       "authors": ["Yuhao Wu", "Franziska Roesner", "Tadayoshi Kohno", "Ning Zhang", "Umar Iqbal"],
       "year": 2025,
       "relevance": "System-level defense using execution environment isolation for LLM agents, representing an alternative defense paradigm."
     },
     {
       "title": "Progent: Programmable privilege control for LLM agents",
       "authors": ["Tianneng Shi", "Jingxuan He", "Zhun Wang"],
       "year": 2025,
       "arxiv_id": "2504.11703",
       "relevance": "Dynamic policy-based defense for LLM agents with programmable privilege control."
     },
     {
       "title": "DRIFT: Dynamic rule-based defense with injection isolation for securing LLM agents",
       "authors": ["Hao Li", "Xiaogeng Liu", "Hung-Chun Chiu", "Dianqi Li", "Ning Zhang", "Chaowei Xiao"],
       "year": 2025,
       "arxiv_id": "2506.12104",
       "relevance": "Dynamic rule-based system-level defense for LLM agents against prompt injection, from overlapping author group."
     },
     {
       "title": "Are you still on track!? Catching LLM task drift with activations",
       "authors": ["Sahar Abdelnabi", "Aideen Fay", "Giovanni Cherubin", "Ahmed Salem", "Mario Fritz", "Andrew Paverd"],
       "year": 2024,
       "arxiv_id": "2406.00799",
       "relevance": "TaskTracker dataset used as source of injection triggers in ReasAlign's training data construction."
     },
     {
       "title": "Llama Guard: LLM-based input-output safeguard for human-AI conversations",
       "authors": ["Hakan Inan", "Kartikeya Upasani", "Jianfeng Chi"],
       "year": 2023,
       "arxiv_id": "2312.06674",
       "relevance": "LLM-based safety guardrail for AI conversations, representing the external detection-based defense approach."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Practitioners building LLM agents could adopt ReasAlign, and code is released, but the method requires LoRA fine-tuning of base models which limits immediate plug-and-play usability."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The finding that reasoning helps defense is consistent with the broader trend of reasoning improving LLM performance; the over-defense critique of Meta SecAlign is somewhat novel but not deeply contrarian."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Directly addresses prompt injection vulnerabilities in LLM agents and demonstrates that state-of-the-art defenses (Meta SecAlign) have severe utility-security tradeoff issues."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Implicitly challenges Meta's SecAlign defense as impractical due to over-defense, but frames it as incremental improvement rather than confrontation."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Code is released on GitHub but requires fine-tuning LLMs from scratch; no live demo or pip-installable tool."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "NVIDIA co-authorship provides some recognition, but this is not a flagship NVIDIA product release. Uses open-source Llama model."
     }
   }
 }