ai-research-survey

scan.json (32571B)

---

 {
   "paper": {
     "title": "Red Teaming the Mind of the Machine: A Systematic Evaluation of Prompt Injection and Jailbreak Vulnerabilities in LLMs",
     "authors": ["Chetan Pathade"],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2505.04806",
     "doi": "10.48550/arXiv.2505.04806"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Tested 1,400+ adversarial prompts against GPT-4, Claude 2, Mistral 7B, and Vicuna, reporting attack success rates of 87.2%, 82.5%, 71.3%, and 69.4% respectively. Roleplay-based attacks achieved the highest ASR (89.6%), and prompts successful on one model transferred to others at rates exceeding 50%. Defense frameworks (PromptShield, Palisade, Signed-Prompt) were tested but specific coverage numbers are not reported. The paper categorizes failure modes into partial refusals (34%), hidden compliance (22%), no output (18%), and misleading responses (15%).",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, code archive, or any link to source code is provided anywhere in the paper. The semi-automated red-teaming script using LangChain is described but not released."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The dataset of 1,400+ adversarial prompts is described as curated from public sources but no download link, archive, or data release is provided. The paper does not even include example prompts."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or environment specification is provided. The paper mentions LangChain, Sentence-BERT, and Hugging Face Inference but provides no version or dependency details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The methodology section describes the pipeline at a high level but lacks sufficient detail for independent replication."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are reported as single point estimates (e.g., '87.2% ASR', '64.1% generalizability'). No confidence intervals, error bars, or uncertainty measures appear anywhere in the paper."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes comparative claims (e.g., 'GPT-4 demonstrated the highest vulnerability') solely by comparing raw percentages. No statistical significance tests are reported for any comparison."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "Only raw ASR percentages are reported. No formal effect sizes (Cohen's d, odds ratios) or contextual baseline comparisons are provided to indicate the magnitude of differences between models or attack types."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper states '1,400+ adversarial prompts' were used but provides no justification for this number, no power analysis, and no discussion of whether this sample is sufficient for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported for any metric. Results appear to be from single runs with no indication of result stability."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Four models are compared against each other (GPT-4, Claude 2, Mistral 7B, Vicuna), providing cross-model baselines. Defense frameworks (PromptShield, Palisade, Signed-Prompt) are also tested as baseline defenses."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "Claude 2 (July 2023) was substantially outdated by 2025 when Claude 3/3.5 were available. Vicuna-13B is similarly dated. GPT-4 March 2024 is more recent but GPT-4 Turbo/GPT-4o existed. The models do not represent the state of the art at time of publication."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "This is a vulnerability evaluation study, not a system with removable components. The attack categories serve as experimental conditions rather than ablatable system components."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Four metrics are used: Attack Success Rate (ASR), Prompt Generalizability, Time-to-Bypass, and Failure Mode Classification (Section III.C)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All output scoring is automated using keyword spotting, GPT-based meta-evaluation, and Sentence-BERT semantic distance (Section III.D). No human evaluation of model outputs is reported."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "All 1,400+ prompts appear to have been tested against all models with no train/test split. The defense evaluation used 'a subset of successful jailbreaks' but selection criteria are not described."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by model (Table I), attack category (Section IV.B: roleplay 89.6%, logic traps 81.4%, encoding 76.2%, multi-turn 68.7%), scenario (Section IV.C: political 85.5%, legal 79.4%, etc.), and failure mode (Table II)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section IV.E provides a taxonomy of five failure modes: partial refusals (34%), hidden compliance (22%), no output (18%), misleading responses (15%). Table II lists common triggers for each mode."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Multi-turn attacks yielded lower effectiveness (68.7%). Malicious code requests had a 58.3% success rate, lower than other categories. Models blocked many direct malware requests. Prompts exceeding 150 tokens showed a dip in success."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims about categorizing 1,400+ prompts, analyzing success against four LLMs, examining generalizability, and proposing mitigation strategies are all addressed in the paper body, though the evidence quality is uneven."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes implicit causal claims: 'model scale and alignment tuning complexity both contribute to attack surface depth' (Section IV.A), 'roleplay dynamics bypass filters by deflecting responsibility' (Section IV.B). These causal attributions are not supported by controlled experiments — the study is observational with no causal identification strategy."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims a 'Systematic Evaluation' of LLMs broadly, and the conclusion states 'prompt injection remains an open frontier in LLM safety' and 'current LLM safety mechanisms are insufficiently robust.' These generalizations go well beyond the four specific models tested with specific model snapshots."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations for the results are discussed. The high GPT-4 ASR could be an artifact of the scoring methodology, prompt selection, or the specific model snapshot — none of these alternatives are considered."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "ASR is measured via keyword spotting, GPT-based meta-evaluation, and Sentence-BERT distance from refusal templates, then presented as 'vulnerability.' The gap between this automated proxy and actual harmful model behavior is never discussed. The validity of the hybrid scoring method is not established."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'GPT-4 (OpenAI, March 2024 snapshot)' and 'Claude 2 (Anthropic, July 2023 API version)' but does not provide precise version identifiers (e.g., 'gpt-4-0314' or specific API version strings). Mistral 7B and Vicuna-13B are given without checkpoint hashes or specific releases."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "No actual adversarial prompt text is provided anywhere in the paper. Attack categories are described in natural language (e.g., 'roleplay dynamics,' 'logic traps') but no concrete prompt examples are shown. The reader cannot reconstruct any prompt sent to the models."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No temperature, top-p, max tokens, or other inference parameters are reported for any of the four models tested. Section III.B mentions 'system context initialized per the model's recommended safety guidelines' without specifying what those settings were."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": false,
         "justification": "A 'semi-automated red-teaming script using the LangChain framework' is mentioned (Section III.D), but the pipeline is described only at a high level. No workflow diagrams, code snippets, retry logic, or detailed tool descriptions are provided."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper says prompts were 'manually validated, categorized into attack types, and annotated for content sensitivity' but provides no filtering criteria, inter-annotator agreement, or counts at each processing stage. How many prompts were collected initially vs. retained is not stated."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section VII 'Limitations and Future Work' provides a dedicated discussion of study limitations including static model checkpoints, evolving attack tactics, and cultural/linguistic coverage gaps."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations section mentions specific threats: 'Our evaluation used static model checkpoints and may not account for updates or real-time moderation layers applied in production APIs' and 'cultural and linguistic diversity in prompts remains underrepresented.' These are specific to this study rather than purely generic."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "While limitations are mentioned, the paper does not explicitly state what the results do NOT show. The conclusion still generalizes broadly ('prompt injection is not an edge-case anomaly but a fundamental issue in current-generation LLMs') without bounding this to the four tested models."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data is released. The 1,400+ adversarial prompts, model outputs, and scoring results are not available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "Sources are listed (GitHub, JailbreakChat, Reddit, Discord, JailbreakBench, PromptBench) but the collection procedure lacks detail: no query terms, no time windows, no counts per source, no inclusion/exclusion criteria for selecting prompts from these sources."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "The prompt selection process from multiple public sources is described only at the source level. How prompts were identified, selected, and deduplicated across these sources is not documented. Selection bias toward certain types of prompts or communities is not discussed."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline from raw prompt collection to final ASR computation has undocumented gaps. No numbers are provided at each stage (e.g., how many prompts collected per source, how many passed manual validation, how many were tested per model)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": false,
         "answer": false,
         "justification": "The author is identified as an 'Independent Researcher' with no institutional affiliation. This appears to be clearly unfunded independent work."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The author's affiliation is listed as 'Independent Researcher, San Jose, CA, USA' with a CMU alumni email. The author has no disclosed affiliation with any of the evaluated model providers."
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funder is identified; this appears to be unfunded independent research."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial disclosure is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This is a red-teaming study testing adversarial prompt effectiveness against safety mechanisms, not evaluating model knowledge on benchmarks. Training data contamination of jailbreak prompts is not the same concern."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This is a red-teaming study testing defense mechanisms rather than model knowledge on benchmarks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "This is a red-teaming study testing defense mechanisms rather than model knowledge on benchmarks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study. All testing is automated prompt injection against LLM APIs."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study tests LLM responses to adversarial prompts."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference costs are reported despite testing 1,400+ prompts across four models including paid APIs (GPT-4, Claude 2). Total API costs are not mentioned."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No computational budget is stated. The paper does not report GPU hours for local inference (Mistral, Vicuna), API costs, or total experiment runtime."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds, temperature sensitivity, or stochastic variation across runs. LLM outputs are stochastic but no sensitivity analysis is reported."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not state how many times each prompt was tested against each model. It is unclear whether results are from single runs or averaged across multiple attempts."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported for the scoring methodology (keyword thresholds, Sentence-BERT distance thresholds) or inference settings."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The hybrid scoring method (keyword spotting + GPT meta-evaluation + Sentence-BERT) is presented without justification for this specific configuration or comparison to alternatives."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Multiple comparisons are made across 4 models, 4+ attack categories, and 4+ scenarios, but no statistical tests are performed at all, let alone corrections for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors curated the adversarial prompt dataset and designed the scoring methodology, then evaluated attack success using that same methodology. The potential for self-comparison bias in prompt selection and scoring is not discussed."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No compute budget is reported, so performance cannot be assessed as a function of compute. Time-to-Bypass is reported but not in relation to computational cost."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether its ASR metric (scored via keyword spotting, GPT evaluation, and BERT distance) actually measures what it claims — true model vulnerability. The construct validity of the automated harm detection pipeline is unexamined."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "GPT-4 and Claude 2 are tested via API with production moderation layers, while Mistral and Vicuna run via local Hugging Face inference without those layers. This infrastructure difference could confound model comparisons but is not discussed."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The adversarial prompts are sourced from public repositories that models may have encountered during training. A model trained on JailbreakChat prompts might have learned to resist those specific attacks, biasing ASR downward. This temporal issue is not discussed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. The system prompts initialized per 'recommended safety guidelines' could interact with prompt effectiveness in ways not controlled for."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Prompts drawn from the same forums or repositories likely share structural patterns, but independence of test examples is not discussed. Duplicates or near-duplicates across sources could inflate sample size."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or decontamination method is applied. The paper does not check whether models have seen the specific adversarial prompts during training."
       }
     }
   },
   "claims": [
     {
       "claim": "GPT-4 has the highest vulnerability with an ASR of 87.2%, followed by Claude 2 (82.5%), Mistral 7B (71.3%), and Vicuna (69.4%).",
       "evidence": "Table I in Section IV.A reports model-wise ASR metrics. However, no error bars, confidence intervals, or statistical tests support these specific numbers.",
       "supported": "weak"
     },
     {
       "claim": "Roleplay-based prompt injections achieve the highest attack success rate at 89.6%, followed by logic traps (81.4%), encoding tricks (76.2%), and multi-turn dialogues (68.7%).",
       "evidence": "Section IV.B describes attack category performance with percentages. No statistical tests, variance measures, or per-model breakdowns for these category-level rates are provided.",
       "supported": "weak"
     },
     {
       "claim": "Jailbreak prompts that succeed on GPT-4 transfer to Claude 2 in 64.1% of cases and to Vicuna in 59.7% of cases.",
       "evidence": "Table I and Section IV.D provide transferability percentages. The transferability matrix (Figure 4) is referenced but no detailed cross-model analysis or statistical significance is provided.",
       "supported": "weak"
     },
     {
       "claim": "Political content prompts succeeded 85.5% of the time, the highest among scenario-specific domains.",
       "evidence": "Section IV.C lists scenario-specific ASR: political 85.5%, legal 79.4%, explicit 76.1%, malicious code 58.3%. No breakdown by model or statistical analysis accompanies these numbers.",
       "supported": "weak"
     },
     {
       "claim": "Prompts in the 101–150 token range achieve the highest success rate (80.3%), suggesting a 'sweet spot' for adversarial prompts.",
       "evidence": "Section IV.F reports this finding with reference to Figure 5. No statistical analysis of the relationship between prompt length and success, and no confound analysis (e.g., attack type correlation with length).",
       "supported": "weak"
     },
     {
       "claim": "Current defense frameworks have limited coverage against evolved jailbreak attacks.",
       "evidence": "Section III.E describes testing against PromptShield, Palisade, and Signed-Prompt, but specific defense bypass rates or coverage numbers are not reported in the results section.",
       "supported": "unsupported"
     }
   ],
   "red_flags": [
     {
       "flag": "No uncertainty quantification",
       "detail": "All results are single point estimates with no error bars, confidence intervals, standard deviations, or statistical tests. With 1,400+ prompts and stochastic LLM outputs, the absence of any variance measurement undermines the precision of all reported numbers."
     },
     {
       "flag": "No data or code released",
       "detail": "Neither the 1,400+ adversarial prompts, the model outputs, the scoring results, nor the evaluation code are released. The study is completely non-reproducible and non-verifiable."
     },
     {
       "flag": "No actual prompts shown",
       "detail": "Despite testing 1,400+ prompts, not a single actual prompt example appears in the paper. This makes it impossible to assess the quality of the dataset, the appropriateness of the categorization, or the validity of the reported ASR."
     },
     {
       "flag": "Unvalidated scoring methodology",
       "detail": "The hybrid scoring method (keyword spotting + GPT-based meta-evaluation + Sentence-BERT distance) is never validated against human judgments. There is no inter-rater agreement, no false positive/negative analysis, and no discussion of scoring threshold sensitivity."
     },
     {
       "flag": "Counterintuitive results without explanation",
       "detail": "GPT-4 reportedly has higher vulnerability (87.2%) than open-source models without robust safety layers (Mistral 71.3%, Vicuna 69.4%). This counterintuitive finding is attributed to GPT-4's 'powerful but permissive instruction-following nature' without rigorous analysis. The scoring methodology itself could produce this pattern."
     },
     {
       "flag": "Infrastructure confound in model comparison",
       "detail": "GPT-4 and Claude 2 are tested via APIs with production moderation layers, while Mistral 7B and Vicuna use local Hugging Face inference without such layers. This fundamental difference in testing infrastructure is not controlled for or discussed."
     },
     {
       "flag": "Outdated model selection",
       "detail": "Claude 2 (July 2023) was substantially outdated by the 2025 publication date when Claude 3/3.5 were available. Results on deprecated models have limited relevance to current LLM safety."
     },
     {
       "flag": "Suspiciously clean numbers",
       "detail": "All key metrics are reported to exactly one decimal place with no variance. The ASR figures (87.2%, 82.5%, 71.3%, 69.4%) and transferability rates appear too clean for a study with 1,400+ prompts across stochastic models."
     },
     {
       "flag": "Missing figures",
       "detail": "Section IV states 'The figures, included in the appendix or digital supplement, visually illustrate comparative vulnerability trends.' Figures 1-6 are captioned but described as separate from the main text, raising questions about whether the visualizations were actually produced."
     },
     {
       "flag": "Defense evaluation without specific results",
       "detail": "Section III.E describes testing jailbreaks against PromptShield, Palisade, and Signed-Prompt defense frameworks, but the results section never reports specific defense bypass rates or coverage metrics."
     }
   ],
   "cited_papers": [
     {
       "title": "Prompt Injection attack against LLM-integrated Applications",
       "authors": ["Yi Liu", "Gelei Deng", "Yuekang Li", "Kailong Wang", "Zihao Wang", "Xiaofeng Wang", "Tianwei Zhang", "Yepang Liu", "Haoyu Wang", "Yan Zheng", "Yang Liu"],
       "arxiv_id": "2306.05499",
       "relevance": "Foundational work on prompt injection attacks against LLM-integrated applications, directly relevant to AI security."
     },
     {
       "title": "Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study",
       "authors": ["Yi Liu", "Gelei Deng", "Zhengzi Xu", "Yuekang Li"],
       "arxiv_id": "2305.13860",
       "relevance": "Empirical evaluation of jailbreak strategies against ChatGPT, directly comparable methodology to this paper."
     },
     {
       "title": "Automatic and Universal Prompt Injection Attacks against Large Language Models",
       "authors": ["Xiaogeng Liu", "Zhiyuan Yu", "Yizhe Zhang", "Ning Zhang", "Chaowei Xiao"],
       "arxiv_id": "2403.04957",
       "relevance": "Proposes automated prompt injection attack generation, key reference for attack taxonomy and LLM safety."
     },
     {
       "title": "Benchmarking and Defending against Indirect Prompt Injection Attacks on Large Language Models",
       "authors": ["Jingwei Yi", "Yueqi Xie", "Bin Zhu", "Emre Kiciman", "Guangzhong Sun", "Xing Xie", "Fangzhao Wu"],
       "arxiv_id": "2312.14197",
       "relevance": "Benchmark and defense framework for indirect prompt injection, key survey-relevant evaluation methodology."
     },
     {
       "title": "Formalizing and Benchmarking Prompt Injection Attacks and Defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Formal framework for prompt injection attacks and defenses presented at USENIX Security, establishes evaluation standards."
     },
     {
       "title": "SecAlign: Defending Against Prompt Injection with Preference Optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "arxiv_id": "2410.05451",
       "relevance": "Proposes preference optimization-based defense against prompt injection, relevant defense methodology."
     },
     {
       "title": "Defeating Prompt Injections by Design",
       "authors": ["Edoardo Debenedetti", "Ilia Shumailov", "Tianqi Fan", "Jamie Hayes", "Nicholas Carlini", "Daniel Fabian"],
       "arxiv_id": "2503.18813",
       "relevance": "Architectural approach to preventing prompt injection, key reference for defense-by-design strategies."
     },
     {
       "title": "Bypassing Prompt Injection and Jailbreak Detection in LLM Guardrails",
       "authors": ["William Hackett", "Lewis Birch", "Stefan Trawicki", "Neeraj Suri", "Peter Garraghan"],
       "arxiv_id": "2504.11168",
       "relevance": "Demonstrates bypass techniques against guardrail systems, directly relevant to LLM safety evaluation."
     },
     {
       "title": "PromptShield: Deployable Detection for Prompt Injection Attacks",
       "authors": ["Dennis Jacob", "Hend Alzahrani", "Zhanhao Hu", "Basel Alomair", "David Wagner"],
       "arxiv_id": "2501.15145",
       "relevance": "Deployable prompt injection detection framework, one of the defense systems evaluated in this paper."
     },
     {
       "title": "Palisade – Prompt Injection Detection Framework",
       "authors": ["Sahasra Kokkula", "Somanathan R", "Nandavardhan R", "Aashishkumar", "G Divya"],
       "arxiv_id": "2410.21146",
       "relevance": "Prompt injection detection framework evaluated as a defense baseline in this paper."
     },
     {
       "title": "UniGuardian: A Unified Defense for Detecting Prompt Injection, Backdoor Attacks and Adversarial Attacks in Large Language Models",
       "authors": ["Huawei Lin", "Yingjie Lao", "Tong Geng", "Tan Yu", "Weijie Zhao"],
       "arxiv_id": "2502.13141",
       "relevance": "Unified defense framework against multiple LLM attack types including prompt injection."
     },
     {
       "title": "Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)",
       "authors": ["Apurv Verma", "Satyapriya Krishna"],
       "arxiv_id": "2407.14937",
       "year": 2024,
       "relevance": "Threat modeling framework for LLM red-teaming, directly relevant to systematic adversarial evaluation methodology."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "Categorizes attack types and proposes defenses at a conceptual level, but releases no tools, code, data, or actionable artifacts a practitioner could use."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "LLM jailbreak vulnerability is well-established; the GPT-4 > open-source vulnerability ranking is counterintuitive but inadequately supported."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Reports high attack success rates (87%+) on commercial LLMs including GPT-4 and Claude 2, contributing to AI safety concern discourse."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "No controversy or conflict beyond the general 'LLMs are unsafe' framing; no named companies criticized."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, data, demo, or prompts released — nothing for a reader to try."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Solo independent researcher; tests well-known models (GPT-4, Claude) but is not affiliated with a recognized lab."
     }
   }
 }