ai-research-survey

scan.json (31764B)

---

 {
   "paper": {
     "title": "RedVisor: Reasoning-Aware Prompt Injection Defense via Zero-Copy KV Cache Reuse",
     "authors": [
       "Mingrui Liu",
       "Sixiao Zhang",
       "Cheng Long",
       "Kwok-Yan Lam"
     ],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2602.01795"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "RedVisor proposes a two-phase defense against prompt injection: a lightweight adapter generates reasoning about potential injections (Phase 1), then the frozen backbone generates a safe response conditioned on that reasoning (Phase 2). The architecture enables zero-copy KV cache reuse, halving latency compared to decoupled detection pipelines. Across Llama-3-8B, Mistral-7B, and Qwen-2.5-7B, RedVisor achieves near-zero attack success rates on five injection types while preserving backbone utility (WinRate within 1.5pp of raw backbone) and maintaining robustness against adaptive GCG attacks.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "An anonymous repository URL is provided: https://anonymous.4open.science/r/RedVisor-82E2 (footnote, Section 1)."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "All evaluation benchmarks are publicly available: Alpaca-Farm, AgentDojo, NQ-simplified, and Alpaca-Cleaned for training. The augmentation pipeline to construct the attack dataset is described in Algorithm 2 and the code repository is provided."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 4×NVIDIA A100-40GB GPUs and names specific model versions, but provides no requirements.txt, Dockerfile, or library version specifications (e.g., PyTorch, vLLM, NLTK versions)."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "The paper provides algorithmic pseudocode (Algorithms 1-2) and hyperparameters, but no step-by-step reproduction instructions (e.g., commands to run, README with setup steps). The anonymous repository may contain these, but the paper itself does not."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 2-10 and Figure 3-4 are reported as point estimates with no confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims RedVisor 'outperforms state-of-the-art defenses' (Abstract, Section 7) but provides no statistical significance tests. All comparative claims are based solely on comparing raw numbers."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Tables provide baseline context alongside method results (e.g., None ASR 0.58 vs RedVisor 0.00 for Llama-3 Naive in Table 3). Section 7.6 reports specific utility numbers (85.78% vs 87.27% WinRate). Section 7.7 states '>2× faster.' Raw numbers with baselines allow magnitude assessment."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "Sample sizes are stated (208 Alpaca-Farm samples, 949 AgentDojo samples, 1000 NQ queries) but no justification is given for why these sizes are adequate for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance across seeds, or spread measures are reported for any experiment. All results appear to be single-run numbers."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Six baselines are compared: PromptArmor, PromptLocate, DataFilter (detection-based) and Sandwich Defense, StruQ, SecAlign (prevention-based). See Section 7.2 and Tables 2-8."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "All baselines are from 2023-2025: PromptLocate (2025), DataFilter (2025), SecAlign (2025), StruQ (2025), PromptArmor (2025), Sandwich Defense (2023). These represent the current state of the art."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.8 and Table 9 present ablation studies removing the Gate (RV_w/o Gate) and FFN (RV_w/o FFN) components, plus a None baseline (reasoning only). Results show FFN is critical for complex attacks."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Multiple metrics are used: ROUGE-L F1 and Embedding Similarity for detection, Attack Success Rate for prevention, WinRate (AlpacaEval 2.0) for utility, and total latency/throughput for efficiency (Section 7.1.2)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is performed. Utility is measured via AlpacaEval 2.0 with Qwen3-Max as an LLM judge (Section 7.6). Detection and prevention metrics are fully automated."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section E.2 explicitly states: 'Note that while we test on Alpaca-Farm, the training is performed strictly on the standard Alpaca train set to ensure zero data leakage.' AgentDojo and NQ-simplified are also separate evaluation benchmarks."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by attack type (Naive, Ignore, Escape, Completion, Multi-round), by benchmark (Alpaca-Farm, AgentDojo, NQ-simplified), and by backbone model (Llama-3, Mistral, Qwen). See Tables 2-8."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "While aggregate results show degraded performance on complex attacks (Completion and Multi-round ASR 2-7%), no qualitative failure case analysis is provided. Section G.4 discusses adaptive attack degradation in aggregate terms but shows no specific failure examples."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "Every experiment and configuration shows RedVisor outperforming or matching baselines. The ablation shows expected component contributions (all help). No approaches that failed or configurations that were tried and abandoned are reported."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims superior detection accuracy (supported by Tables 2, 5-6), lower ASR (Tables 3, 7-8), negligible utility loss (Figure 3), and better throughput (Figure 4). All claims are substantiated by experimental results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims from the ablation study (Section 7.8) use controlled single-variable manipulation: removing Gate or FFN while keeping everything else constant. Table 1's preliminary study also controls for the reasoning variable. These designs are adequate for the causal claims made."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims a 'universal framework' (Section 1) but tests only on 7-8B parameter models. No experiments with larger models (13B, 70B) or different model families. The title implies broad applicability without bounding to the tested scale."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations for the results are discussed. For example, the paper does not consider whether the improvement comes primarily from the additional compute of the reasoning phase rather than the adapter architecture, or whether the synthetic attack patterns are too easy to detect."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The measurements closely match the claims: ASR directly measures attack success, ROUGE-L measures localization accuracy, WinRate measures utility, and latency measures efficiency. The paper's claims stay at the granularity of these measurements without inflating to broader security guarantees."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Main backbone models are precisely specified: Llama-3-8B-Instruct, Mistral-7B-v0.3-Instruct, Qwen-2.5-7B-Instruct (Section 7.3). The judger (Qwen3-Max) and AgentDojo backbone (GPT-4o) lack snapshot dates but are peripheral to the main evaluation."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full system instructions for Phase 1 are provided in Appendix A.2. The user input format with XML tags is shown in Appendix A.1. Reasoning templates for all five attack categories are provided verbatim in Appendix C.2."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Appendix E.2 reports: AdamW optimizer, learning rate 1e-4, batch size 128, early stopping, validation every 100 steps, adapter architecture details (hidden dims, head counts, GateNet dimensions d=512, inner d=64). Training runs 10 epochs on 4×A100-40GB."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "RedVisor is a two-phase inference mechanism with an adapter, not an agentic scaffold. For AgentDojo, GPT-4o is used as a third-party backbone agent (black box), and RedVisor acts as a sidecar detector."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2.1 describes NLTK sentence segmentation with indexed labels. Section 6.2 details the spaCy intent extraction pipeline. Algorithm 2 formalizes the full dataset construction. Appendix D.1 describes NQ-simplified retrieval via LangChain with BAAI/bge-small-en embeddings."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "The Impact Statement includes a 'Limitations and Over-Reliance' subsection stating 'no defense is impenetrable' and that 'RedVisor should be deployed as part of a defense-in-depth strategy, not as a standalone guarantee of safety.'"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The limitations are generic: 'no defense is impenetrable' and warning against over-reliance. No specific threats such as the synthetic nature of attacks, limited model scale, or the gap between template-based attacks and real-world adversaries are discussed."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what was not tested: no mention of larger models being out of scope, no acknowledgment that only English-language attacks were tested, no discussion of real-world (non-synthetic) injection scenarios being excluded."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Only aggregate metrics are reported in tables and figures. No per-example predictions, raw model outputs, or individual detection results are made available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 and Algorithm 2 describe the full dataset construction pipeline. Appendix D.1 details how each benchmark was configured, including the NQ-simplified retrieval setup (1000 queries, top-10 documents). Attack payloads use random UUIDs (Appendix E.1)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from standard public benchmarks (Alpaca-Farm, AgentDojo, NQ-simplified)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Algorithm 2 formalizes the complete pipeline from clean data through injection generation to reasoning synthesis. Section 6.2 details the intent extraction and template application stages. Appendix C provides all templates and construction details."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding information, acknowledgments section, or grant numbers are mentioned anywhere in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All authors are listed as affiliated with Nanyang Technological University, Singapore. They are not evaluating their own commercial product."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so the independence of funders from outcomes cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interest declaration is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense mechanism against prompt injection attacks, not a pre-trained model's capability on benchmarks. The backbone models are frozen and used as-is; the evaluation measures defense effectiveness, not model knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the paper evaluates a defense tool rather than model knowledge. Contamination of model training data is not relevant to the defense evaluation."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the evaluation measures whether the adapter can detect injections and guide safe responses, not whether the backbone has memorized benchmark answers."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All experiments use automated benchmarks and LLM-based evaluation."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.7 and Figure 4 report total latency for processing 1,000 RAG queries across all methods. Section 5.3 provides theoretical complexity analysis showing RedVisor halves TTFT. The paper demonstrates >2× speedup over decoupled pipelines."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper states training was on 4×NVIDIA A100-40GB GPUs for 10 epochs, but does not report total GPU hours, wall-clock training time, or total compute cost."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. All results appear to be from single training runs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. Results are presented without indicating whether they are from single or multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Fixed hyperparameters are reported (lr=1e-4, batch=128) but no search budget, search method, or number of configurations tried is mentioned."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses early stopping on validation loss but does not explain how the reported hyperparameters (learning rate, batch size, adapter dimensions) were selected."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical significance tests are performed, so the question of correcting for multiple comparisons does not arise."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors re-implement DataFilter and SecAlign baselines ('As the official code is unavailable, we reproduce the method' — Appendix D.3) without acknowledging the systematic bias of author-implemented baselines documented by Lucic et al. (2018)."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "While latency is compared in Figure 4, performance is not reported as a function of compute budget. No compute-normalized comparisons are made, and the additional compute cost of the reasoning phase is not controlled for."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether synthetic template-based attacks on Alpaca-Farm/NQ-simplified adequately represent real-world prompt injection threats, or whether ASR on UUID payloads measures real-world defense effectiveness."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "For Alpaca-Farm and NQ-simplified, all methods use the same frozen backbone models. For AgentDojo, all methods use GPT-4o as the backbone agent (Appendix D.1). The backbone is controlled across all comparisons."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The backbone models (Llama-3, Mistral, Qwen) were likely trained on data including Alpaca-family datasets, but this temporal overlap is not discussed. No training cutoff dates for the backbone models are stated."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup inadvertently leaks information about whether an attack is present (e.g., through formatting cues introduced by the injection synthesis pipeline)."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Appendix E.2 explicitly addresses train/test separation: 'the training is performed strictly on the standard Alpaca train set to ensure zero data leakage.' Attack payloads use random UUIDs unseen during training (Appendix E.1)."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No formal leakage detection methods (canary strings, membership inference, n-gram overlap analysis) are applied. The use of random UUID payloads prevents payload memorization but is not a systematic leakage detection method."
       }
     }
   },
   "claims": [
     {
       "claim": "LLMs achieve 0% ASR when provided with ground-truth reasoning about injection attempts",
       "evidence": "Table 1 shows Llama-3-8B, Mistral-7B, and Qwen-2.5-7B all achieve 0% ASR across five attack categories on Alpaca-Farm when ground-truth reasoning is appended (Section 1).",
       "supported": "strong"
     },
     {
       "claim": "RedVisor achieves near-zero ASR across diverse attack types and backbones",
       "evidence": "Table 3 shows 0% ASR for Naive, Ignore, and Escape attacks across all three backbones, with 2-7% for complex attacks (Completion, Multi-round). Near-zero ASR (0%) also against GCG adaptive attacks targeting the backbone.",
       "supported": "strong"
     },
     {
       "claim": "RedVisor preserves backbone utility with negligible degradation",
       "evidence": "Figure 3 shows AlpacaEval 2.0 WinRate: Llama-3 85.78% (vs 87.27% raw), Mistral maintained similarly, while StruQ drops to 56.75% on Qwen (Section 7.6).",
       "supported": "strong"
     },
     {
       "claim": "RedVisor processes queries >2× faster than decoupled pipelines",
       "evidence": "Figure 4 shows total latency for 1,000 NQ queries. RedVisor (unified) is approximately half the latency of RedVisor_sep (decoupled variant) across all backbones (Section 7.7).",
       "supported": "strong"
     },
     {
       "claim": "RedVisor outperforms state-of-the-art defenses in detection accuracy",
       "evidence": "Table 2 shows RedVisor achieves ROUGE-L ≥0.97 on atomic attacks and >0.78 on complex attacks, exceeding PromptLocate (0.69-0.97) and PromptArmor (0.12-0.31). Similar patterns in Appendix Tables 5-6.",
       "supported": "moderate"
     },
     {
       "claim": "RedVisor is robust against adaptive GCG attacks targeting the classifier",
       "evidence": "Table 4/10 shows GCG_classifier reduces detection ROUGE-L (0.94→0.82 for Llama-3) but ASR remains low (0.03→0.05). The paper argues adversarial perturbations that evade detection also disrupt the injection's utility (Section G.4).",
       "supported": "moderate"
     },
     {
       "claim": "RedVisor is the first approach to leverage fine-grained reasoning paths to simultaneously detect attacks and guide safe responses",
       "evidence": "Stated in the Abstract as a novelty claim. The related work section (Section 2) distinguishes RedVisor from prior detection-only and prevention-only methods, but the 'first' claim cannot be verified from the paper alone.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "No variance or uncertainty reporting",
       "detail": "All results across Tables 2-10 and Figures 3-4 are point estimates with no error bars, standard deviations, confidence intervals, or indication of multiple runs. It is impossible to assess result stability or determine if reported differences are meaningful."
     },
     {
       "flag": "Synthetic-only attack evaluation",
       "detail": "All attacks are synthetically generated using five template-based categories (Section 6.1). No testing against real-world, human-crafted prompt injections or adversarial red-teaming beyond GCG suffix optimization. The payloads are benign (print UUID), not actual malicious commands."
     },
     {
       "flag": "Limited model scale tested",
       "detail": "Despite claiming a 'universal framework,' only 7-8B parameter models are tested (Llama-3-8B, Mistral-7B, Qwen-2.5-7B). No experiments with larger models (13B, 70B+), leaving scalability claims unsupported."
     },
     {
       "flag": "No statistical significance tests",
       "detail": "Comparative claims ('outperforms state-of-the-art') are made without any statistical tests. Given the absence of variance reporting, it is unclear whether the observed differences are statistically meaningful."
     },
     {
       "flag": "Re-implemented baselines without bias acknowledgment",
       "detail": "DataFilter and SecAlign baselines are re-implemented by the authors due to unavailable code (Appendix D.3). The systematic bias of author-implemented baselines (Lucic et al. 2018) is not acknowledged."
     }
   ],
   "cited_papers": [
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2025,
       "relevance": "A key baseline for prevention-based prompt injection defense via instruction tuning on injection-augmented datasets."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2025,
       "relevance": "DPO-based alignment defense against prompt injection, key prevention baseline showing utility-safety tradeoff."
     },
     {
       "title": "PromptLocate: Localizing prompt injection attacks",
       "authors": ["Yuting Jia", "Yi Liu", "Zhibo Shao", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2025,
       "arxiv_id": "2510.12252",
       "relevance": "Detection-based defense using iterative binary search for fine-grained injection localization; primary detection baseline."
     },
     {
       "title": "DataSentinel: A game-theoretic detection of prompt injection attacks",
       "authors": ["Yi Liu", "Yuting Jia", "Jinyuan Jia", "Dawn Song", "Neil Zhenqiang Gong"],
       "year": 2025,
       "relevance": "Game-theoretic approach to detecting prompt injection via missing canary signals; used as classifier in PromptLocate."
     },
     {
       "title": "PromptArmor: Simple yet effective prompt injection defenses",
       "authors": ["Tong Shi", "Kairan Zhu", "Zijie Wang", "Yuting Jia", "Wei Cai", "Wenbo Liang", "Han Wang", "Hamza Alzahrani", "Jin Lu", "Kenji Kawaguchi"],
       "year": 2025,
       "arxiv_id": "2507.15219",
       "relevance": "Detection framework using auxiliary LLMs for prompt injection identification; detection baseline."
     },
     {
       "title": "Defending against prompt injection with DataFilter",
       "authors": ["Yupei Wang", "Sizhe Chen", "Reem Alkhudair", "Basel Alomair", "David Wagner"],
       "year": 2025,
       "arxiv_id": "2510.19207",
       "relevance": "Generative defense that rewrites/sanitizes context to remove injections; detection baseline showing hallucination issues."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Foundational work demonstrating indirect prompt injection attacks against real-world LLM applications."
     },
     {
       "title": "Ignore previous prompt: Attack techniques for language models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Early characterization of prompt injection attack techniques against language models."
     },
     {
       "title": "AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "Benchmark for evaluating prompt injection attacks and defenses in autonomous agent workflows; used as evaluation benchmark."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Introduced GCG attack method for optimizing adversarial suffixes; used as adaptive attack in RedVisor evaluation."
     },
     {
       "title": "Neural exec: Learning (and learning from) execution triggers for prompt injection attacks",
       "authors": ["Dario Pasquini", "Martin Strohmeier", "Carmela Troncoso"],
       "year": 2024,
       "relevance": "Learned execution triggers for prompt injection attacks, representing advanced adversarial techniques."
     },
     {
       "title": "Can LLMs separate instructions from data? And what do we even mean by that?",
       "authors": ["Egor Zverev", "Sahar Abdelnabi", "Soroush Tabesh", "Mario Fritz", "Christoph H. Lampert"],
       "year": 2024,
       "arxiv_id": "2403.06833",
       "relevance": "Investigates the fundamental instruction-data separation problem in LLMs relevant to prompt injection."
     },
     {
       "title": "Tensor Trust: Interpretable prompt injection attacks from an online game",
       "authors": ["Sam Toyer", "Olivia Watkins", "Ethan Adrian Mendes", "Justin Svegliato", "Luke Bailey", "Tiffany Wang", "Isaac Ong", "Karim Elmaaroufi", "Pieter Abbeel", "Trevor Darrell"],
       "year": 2023,
       "arxiv_id": "2311.01011",
       "relevance": "Gamified dataset of interpretable prompt injection attacks from human adversaries."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["Xiaogeng Liu", "Zhiyuan Yu", "Yizhe Zhang", "Ning Zhang", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Automated methods for generating universal prompt injection attacks against LLMs."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Practitioners could deploy the adapter on vLLM-served models, but requires training on domain-specific data and adapter integration."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The core insight (models can reject attacks if guided by reasoning) is intuitive rather than surprising; the contribution is engineering, not a paradigm shift."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Addresses the real and growing threat of prompt injection in RAG and agent systems, with demonstrated vulnerabilities in undefended models."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy or conflict; straightforward defense contribution."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Anonymous code repository is provided but requires GPU training to reproduce; no live demo or pip-installable tool."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "Authors are from Nanyang Technological University; not a well-known AI lab and no famous product involvement."
     }
   }
 }