ai-research-survey

scan.json (33127B)

---

 {
   "paper": {
     "title": "RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injection",
     "authors": [
       "Yuxin Wen",
       "Arman Zharmagambetov",
       "Ivan Evtimov",
       "Narine Kokhlikyan",
       "Tom Goldstein",
       "Kamalika Chaudhuri",
       "Chuan Guo"
     ],
     "year": 2025,
     "venue": "arXiv (Preprint, Under Review)",
     "arxiv_id": "2510.04885",
     "doi": "10.48550/arXiv.2510.04885"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "RL-Hammer, a GRPO-based RL recipe for training prompt injection attackers from scratch, achieves 98% ASR against GPT-4o and 72% against GPT-5 by jointly training on easy and robust target models with soft rewards and no KL regularization. The paper demonstrates that current defenses (Instruction Hierarchy, SecAlign) remain fragile against automated RL-based attacks. Diversity rewards lead to reward-hacking rather than genuinely novel attack strategies. RL-Hammer naturally evades most prompt injection detectors and can fully bypass all tested detectors when trained with a stealthiness reward.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states 'Code is available at https://github.com/facebookresearch/rl-injector' — a concrete GitHub URL is provided."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available benchmarks: InjecAgent (Zhan et al., 2024), AgentDojo (Debenedetti et al., 2024), and AdvBench (Zou et al., 2023). No proprietary data was collected."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions 'a single NVIDIA H200 node' and 'Hugging Face TRL library' with LoRA fine-tuning, but provides no requirements.txt, Dockerfile, or detailed library version listing sufficient to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. The GitHub repository is referenced but the paper itself does not contain commands or a reproduction guide."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1, 3, 4, 5, and 7 are reported as point estimates (e.g., '98.00%') with no confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes many comparative claims (e.g., RL-Hammer vs. GCG, naive GRPO vs. RL-Hammer) based solely on comparing raw ASR numbers without any statistical significance tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "ASR percentages are reported alongside baselines, providing sufficient context to assess magnitude. For example, GPT-4o goes from 0% (baseline) to 98% (RL-Hammer), and the jailbreak comparison shows RL-Hammer at 99% vs Jailbreak-R1 at 47% (Table 4)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The test set is 100 samples from InjecAgent with no justification for why this size is sufficient. No power analysis is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviation, variance, or spread measures are reported for any results. Section 5.2 acknowledges that 'different random seeds can lead the model to settle on distinct strategies,' yet the main results appear to be from single runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 includes four baselines: Default Prompt, Enhanced, Llama-3.1-8B-Instruct (zero-shot), and GCG. Table 4 compares against Jailbreak-R1. Table 3 compares against Default Prompt and Tool Knowledge."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "GCG (Zou et al., 2023) and Jailbreak-R1 (Guo et al., 2025) are contemporary and represent the state of the art in adversarial prompt generation."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 presents four ablation studies: KL coefficient (Figure 1a), joint training (Figure 1b), soft vs. hard reward (Figure 1c), and format reward (Figure 1d). Each isolates a single design choice."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper evaluates ASR as the primary metric, plus diversity metrics (BLEU, BERTScore, embedding distance, LLM judge) in Table 5 and detectability rates across four detectors in Table 7."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated. Attack success is determined by string parsing. Diversity and detectability use automated metrics and LLM judges. No human evaluation of attack quality or realism is conducted."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 states: 'We use the InjecAgent dataset, splitting it into 100 samples for validation, 100 samples for testing, and the remaining 310 samples for training.' The same split approach is used for AgentDojo and AdvBench."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 provides per-target-model breakdowns across 10 models. Results are also broken down by benchmark (InjecAgent, AgentDojo, AdvBench) and by training-time target model."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.2 discusses how diversity rewards lead to reward-hacking rather than genuine diversity, with examples in Table 6. Section 3.1 discusses naive GRPO's failure on robust models. Appendix Table 9 shows degenerate outputs without format reward."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Naive GRPO fails on defended models (Section 3.1, Figure 2b). Training on easy model alone fails to transfer (0% ASR on GPT-4o, Table 1). Diversity rewards are reward-hacked (Section 5.2). Format reward alone leads to overfitting on format compliance over attack success (Section 3.2)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims '98% ASR against GPT-4o' (supported in Table 1) and '72% ASR against GPT-5' (supported). However, the paper claims 'RL-Hammer attains ≥80% ASR on every evaluated target' (Section 4.2), yet Claude-4-Sonnet achieves only 77% even when trained directly on it, contradicting the ≥80% claim."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The ablation studies in Section 5.1 make causal claims (removing KL improves ASR, joint training enables learning on robust models) through controlled single-variable manipulation. Each ablation changes one factor while holding others constant, which is adequate for the causal claims made."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The paper tests on 10 specific target models and 3 benchmarks, and generally frames claims in terms of these tested settings. The title is provocative ('LLMs Are Nails') but the body consistently references specific models and benchmarks."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not consider alternative explanations for its results. For example, it does not discuss whether the high ASR might be partly due to the InjecAgent task design (only two tools, worst-case scenario by their own admission), or whether the string-parsing judge may be over-counting successes."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures ASR (whether the target model executes the attacker-specified action, verified by string parsing) and frames it as attack success rate. The measurement matches the framing with no proxy gap."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Commercial models are referenced by marketing names only: 'GPT-4o', 'GPT-5', 'GPT-5-mini', 'Gemini-2.5-Flash', 'Claude-3.5-Sonnet', 'Claude-4-Sonnet'. No API version strings or snapshot dates are provided. Open-source models are specified (e.g., 'Llama-3.1-8B-Instruct') but still lack exact version hashes."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The attacker prompt is provided in full in Section A.1. The LLM diversity judge prompt is in A.7. The LLM prompt injection judge prompt is in A.8. These are the actual prompts used, not just descriptions."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 reports: '8 rollouts per injection goal with a batch size of 8 injection goals and a learning rate of 1e-5 with 40 epochs.' LoRA is used for fine-tuning. The KL coefficient ablation (β values) is in Section 5.1."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "The RL-Hammer attacker is a standard RL-trained LLM that generates text, not an agentic scaffold. Target models use tool-calling features but are evaluated as black boxes. No agentic scaffolding is central to the method."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes the dataset split: 'We use the InjecAgent dataset, splitting it into 100 samples for validation, 100 samples for testing, and the remaining 310 samples for training.' Similar splits are described for AgentDojo and AdvBench."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 is titled 'CONCLUSION AND LIMITATION' and contains substantive discussion of training cost, query requirements, and potential for detection/banning by model providers."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations section identifies a specific threat: 'Training remains costly, largely due to the large number of queries required to interact with the target model. In practice, excessive adversarial queries may trigger detection and banning by model providers.' This is specific to this study's approach."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. It does not bound the scope to specific deployment contexts, does not discuss what attack scenarios were not tested, and does not clarify that InjecAgent's two-tool setup is a simplification of real-world scenarios (though it mentions AgentDojo is 'more realistic')."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (per-example attack results, model outputs, training logs) is released. Only aggregate ASR numbers are reported in tables."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses three public benchmarks (InjecAgent, AgentDojo, AdvBench) with clear provenance. Dataset splits and usage are described in Section 4.1."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are standard public benchmarks."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from benchmark dataset to final ASR is documented: split into train/val/test → GRPO training with specified rollouts and batch size → attack generation → string-parsing verification → ASR computation. No unexplained data loss or filtering."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No explicit funding acknowledgment section. The work was done during an internship at FAIR at Meta, implying Meta funding, but no formal disclosure is provided."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: University of Maryland and FAIR at Meta. The footnote states 'Work done during an internship at FAIR at Meta.'"
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Meta develops both the defense evaluated (Meta SecAlign) and the attack (RL-Hammer). Meta has commercial interests in LLM safety. The funder is not independent of the outcome, though the paper does show Meta's own defense is vulnerable."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interest declaration is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests defenses against prompt injection attacks, not model knowledge on benchmarks. The evaluation measures whether defenses can be bypassed, not whether models have memorized benchmark answers."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same rationale: the paper evaluates defense robustness against automated attacks, not model capability on benchmark tasks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same rationale: contamination of benchmark knowledge is not the concern when testing attack effectiveness against defense mechanisms."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All experiments are automated attacks against LLM models."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper includes an ethics statement about responsible disclosure of the attack."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, API cost, or per-attack cost is reported. The limitations section acknowledges 'Training remains costly, largely due to the large number of queries required' but does not quantify costs."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'All experiments are conducted on a single NVIDIA H200 node' but does not report total GPU hours, wall-clock training time, or total API spend for querying commercial target models."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 5.2 acknowledges 'different random seeds can lead the model to settle on distinct strategies,' indicating seed sensitivity, but the main ASR results in Tables 1, 3, 4 do not report results across multiple seeds."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs producing the main results is never stated. Results appear to be from single training runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Hyperparameters are reported (learning rate, batch size, epochs) but no search budget, number of configurations tried, or search method is described."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No explanation of how the final hyperparameter configuration was selected. The ablation studies vary individual parameters but do not describe a systematic selection process."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed in the paper, so correction for multiple comparisons does not arise."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own RL-Hammer against baselines without acknowledging self-comparison bias. They also evaluate against their own Meta SecAlign defense without discussing whether their insider knowledge of SecAlign's architecture could influence attack design."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Performance is not reported as a function of compute budget. The training curves in Figure 1 show reward vs. training steps but not wall-clock time or compute cost. Different target models likely require vastly different API query budgets, which is not discussed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether InjecAgent (its primary benchmark) adequately measures real-world prompt injection risk. It briefly notes AgentDojo is 'more realistic and complex' and that InjecAgent represents 'a kind of worst-case testing scenario' with only two tools, but does not analyze construct validity."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Section 4.1 states 'For white-box models, we use prompting to enable tool usage, whereas for all black-box models, we rely on the tool-calling feature.' This means results across models are confounded by different scaffolding approaches, which is not discussed."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether InjecAgent or AdvBench examples may have appeared in the training data of target models. The attacker is trained from scratch, but target models may have been exposed to the benchmark tasks during pre-training or safety training."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For example, the two-tool InjecAgent setup (benign tool + adversary's target tool) is an extreme simplification that may make attacks artificially easier."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether training and test splits from InjecAgent share structural similarities that could inflate results."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is used for the benchmarks."
       }
     }
   },
   "claims": [
     {
       "claim": "RL-Hammer achieves 98% ASR against GPT-4o when jointly trained on Llama-3.1-8B-Instruct and GPT-4o.",
       "evidence": "Table 1 shows 98% ASR on GPT-4o when GPT-4o is the training-time target model. Baseline methods achieve 0-3% on GPT-4o.",
       "supported": "strong"
     },
     {
       "claim": "RL-Hammer achieves 72% ASR against GPT-5 with Instruction Hierarchy defense.",
       "evidence": "Table 1 shows 72% ASR on GPT-5 when jointly trained on GPT-5-mini and GPT-5. Baseline methods achieve 0% on GPT-5.",
       "supported": "strong"
     },
     {
       "claim": "RL-Hammer attains ≥80% ASR on every evaluated target.",
       "evidence": "Table 1 shows best results per target model. However, Claude-4-Sonnet achieves only 77% ASR when trained directly on it, which is below the stated 80% threshold.",
       "supported": "weak"
     },
     {
       "claim": "Removing KL regularization improves attacker performance and convergence speed.",
       "evidence": "Figure 1a ablation shows β=0 achieves near-perfect rewards while β=0.01 converges to a suboptimal minimum. Section 5.1 provides analysis.",
       "supported": "strong"
     },
     {
       "claim": "Joint training on easy and robust target models overcomes sparse reward and enables high ASR on robust models.",
       "evidence": "Figure 1b shows direct training on the robust model produces near-zero rewards, while joint training achieves high rewards on both models. Section 3.2 describes the transfer mechanism.",
       "supported": "strong"
     },
     {
       "claim": "Diversity rewards lead to reward-hacking rather than genuinely diverse attack strategies.",
       "evidence": "Table 5 shows diversity metrics improve under each reward, but Table 6 demonstrates that the attacker manipulates metrics via superficial changes (case variation, prepended irrelevant text) rather than producing novel strategies.",
       "supported": "strong"
     },
     {
       "claim": "RL-Hammer naturally evades most prompt injection detectors and fully bypasses all four when trained with stealthiness reward.",
       "evidence": "Table 7 shows 0% perplexity detection, 16% Llama-Prompt-Guard, 17% ProtectAI-Guard for base RL-Hammer. With LLM Judge reward, all four detectors drop to 0% while ASR remains at 97%.",
       "supported": "strong"
     },
     {
       "claim": "RL-Hammer achieves 99% ASR on GPT-4o and 97% on Claude-3.5-Sonnet for the AdvBench jailbreak task.",
       "evidence": "Table 4 reports these results. Jailbreak-R1 achieves 47% (GPT-4o) and 3% (Claude-3.5-Sonnet) at 10 attempts for comparison.",
       "supported": "moderate"
     },
     {
       "claim": "RL-Hammer achieves 51% ASR on AgentDojo against GPT-4o, approaching the 63% upper bound of direct benign instruction.",
       "evidence": "Table 3 reports 51% ASR vs 63% upper bound (direct benign instruction) on GPT-4o. However, results are on a 100-sample test set without error bars.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or variance on any results",
       "detail": "All main results (Tables 1, 3, 4, 5, 7) are reported as single point estimates. The paper acknowledges that different seeds lead to different strategies (Section 5.2), meaning reported ASR numbers could vary substantially across runs. For a 100-sample test set, a 98% ASR has a 95% CI of roughly ±2.7pp by binomial approximation, yet no uncertainty is quantified."
     },
     {
       "flag": "≥80% ASR claim contradicted by own results",
       "detail": "Section 4.2 claims 'RL-Hammer attains ≥80% ASR on every evaluated target.' However, Claude-4-Sonnet achieves only 77% ASR even when trained directly on it (Table 1), contradicting the stated threshold."
     },
     {
       "flag": "Meta researchers evaluating Meta's own defense and attack",
       "detail": "Five of seven authors are affiliated with FAIR at Meta. They evaluate RL-Hammer (their attack) against Meta SecAlign (their defense) and commercial competitors. While showing their own defense is vulnerable suggests transparency, insider knowledge of SecAlign's architecture could advantage the attacker design."
     },
     {
       "flag": "No model version pinning for commercial APIs",
       "detail": "All commercial models are referenced by marketing names (GPT-4o, GPT-5, Claude-3.5-Sonnet, Gemini-2.5-Flash) without API version strings or snapshot dates. These models change over time, making results non-reproducible."
     },
     {
       "flag": "Training cost not quantified despite being a stated limitation",
       "detail": "The limitations section acknowledges training is costly and requires many queries to target models, but never quantifies the actual cost (API spend, GPU hours, total queries). This omission prevents assessing the practical threat level of the attack."
     },
     {
       "flag": "InjecAgent worst-case setup may inflate ASR",
       "detail": "The paper acknowledges InjecAgent restricts the agent to only two tools (benign + adversary's target), calling it 'a kind of worst-case testing scenario.' ASR on the more realistic AgentDojo (many tools) drops to 51%, suggesting the headline 98% figure may not reflect real-world conditions."
     }
   ],
   "cited_papers": [
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2024,
       "arxiv_id": "2410.05451",
       "relevance": "Major prompt injection defense via preference optimization, directly evaluated and shown to be breakable by RL-Hammer."
     },
     {
       "title": "The instruction hierarchy: Training LLMs to prioritize privileged instructions",
       "authors": ["Eric Wallace", "Kai Xiao", "Reimar Leike", "Lilian Weng", "Johannes Heidecke", "Alex Beutel"],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Key prompt injection defense mechanism that RL-Hammer demonstrates can be bypassed on GPT models."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Primary benchmark dataset used to evaluate prompt injection attacks on tool-using LLM agents."
     },
     {
       "title": "AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "More realistic multi-tool prompt injection benchmark used for secondary evaluation of RL-Hammer."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "GCG attack method used as a primary baseline and source of the AdvBench jailbreak benchmark."
     },
     {
       "title": "AdvPrompter: Fast adaptive adversarial prompting for LLMs",
       "authors": ["Anselm Paulus", "Arman Zharmagambetov", "Chuan Guo", "Brandon Amos", "Yuandong Tian"],
       "year": 2024,
       "arxiv_id": "2404.16873",
       "relevance": "Prior RL-based adversarial prompting approach that SecAlign was shown to be robust against, but RL-Hammer bypasses."
     },
     {
       "title": "Jailbreak-R1: Exploring the jailbreak capabilities of LLMs via reinforcement learning",
       "authors": ["Weiyang Guo", "Zesheng Shi", "Zhuo Li", "Yequan Wang", "Xuebo Liu", "Wenya Wang", "Fangming Liu", "Min Zhang", "Jing Li"],
       "year": 2025,
       "arxiv_id": "2506.00782",
       "relevance": "State-of-the-art RL-based jailbreak attack that RL-Hammer significantly outperforms on AdvBench."
     },
     {
       "title": "Neural exec: Learning (and learning from) execution triggers for prompt injection attacks",
       "authors": ["Dario Pasquini", "Martin Strohmeier", "Carmela Troncoso"],
       "year": 2024,
       "relevance": "Gradient-based prompt injection attack that SecAlign was previously shown to resist."
     },
     {
       "title": "Meta SecAlign: A secure foundation LLM against prompt injection attacks",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "David Wagner", "Chuan Guo"],
       "year": 2025,
       "arxiv_id": "2507.02735",
       "relevance": "Commercial-grade defense model (Meta SecAlign 8B/70B) that RL-Hammer achieves up to 99% ASR against."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "doi": "10.1145/3605764.3623985",
       "relevance": "Foundational work on indirect prompt injection attacks against LLM-integrated applications."
     },
     {
       "title": "HarmBench: A standardized evaluation framework for automated red teaming and robust refusal",
       "authors": ["Mantas Mazeika", "Long Phan", "Xuwang Yin", "Andy Zou"],
       "year": 2024,
       "relevance": "Standardized red-teaming evaluation framework; the HarmBench-Llama-2-13b-cls judge is used to evaluate jailbreak success."
     },
     {
       "title": "WASP: Benchmarking web agent security against prompt injection attacks",
       "authors": ["Ivan Evtimov", "Arman Zharmagambetov", "Aaron Grattafiori", "Chuan Guo", "Kamalika Chaudhuri"],
       "year": 2025,
       "arxiv_id": "2504.18575",
       "relevance": "Web agent security benchmark for prompt injection attacks from the same research group."
     },
     {
       "title": "Commercial LLM agents are already vulnerable to simple yet dangerous attacks",
       "authors": ["Ang Li", "Yin Zhou", "Vethavikashini Chithrra Raghuram", "Tom Goldstein", "Micah Goldblum"],
       "year": 2025,
       "arxiv_id": "2502.08586",
       "relevance": "Demonstrates vulnerability of commercial LLM agents to simple prompt injection attacks."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Code is released and practitioners can use RL-Hammer to red-team their own LLM agent defenses, but requires significant ML infrastructure to train the attacker."
     },
     "surprise_contrarian": {
       "score": 3,
       "justification": "Directly contradicts the widely-held belief that Instruction Hierarchy and SecAlign provide robust prompt injection defenses, achieving 98% ASR against GPT-4o and 72% against GPT-5."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates a novel, automated attack that bypasses state-of-the-art defenses including GPT-5's Instruction Hierarchy and evades all tested prompt injection detectors."
     },
     "drama_conflict": {
       "score": 2,
       "justification": "Meta researchers showing that both their own SecAlign defense and competitors' defenses (OpenAI, Anthropic, Google) are fragile creates an implicit 'current defenses are an illusion' narrative."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code is publicly released at github.com/facebookresearch/rl-injector, but running it requires RL training infrastructure and API access to target models."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "From FAIR at Meta, attacks GPT-4o/GPT-5 (OpenAI), Claude-3.5/4-Sonnet (Anthropic), and Gemini-2.5-Flash (Google) — all major brand-name models."
     }
   }
 }