ai-research-survey

scan.json (31248B)

---

 {
   "paper": {
     "title": "Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction",
     "authors": [
       "Yulin Chen",
       "Haoran Li",
       "Yuan Sui",
       "Yue Liu",
       "Yufei He",
       "Yangqiu Song",
       "Bryan Hooi"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2504.20472",
     "doi": "10.48550/arXiv.2504.20472"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository URL is provided in the paper. No GitHub link, Zenodo archive, or any other code release is mentioned."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available datasets: AlpacaFarm [12], SQuAD [32], TriviaQA [20], and the injected datasets Inj-SQuAD and Inj-TriviaQA from [8]. All datasets are either standard public benchmarks or previously published."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Appendix A mentions 'PyTorch 2.1.0' and 'single NVIDIA H100 GPU' with some generation settings, but no requirements.txt, Dockerfile, Python version, CUDA version, or other library versions are provided. Not enough detail to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. The methodology is described but without actionable reproduction steps."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1-9 are reported as point estimates (percentages) with no confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims their method 'outperforms' baselines based solely on comparing numerical values in tables. No statistical significance tests (p-values, t-tests, etc.) are reported."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports specific percentage improvements with baseline context, e.g., 'surpasses the baselines by at least 19.71% across all attacks and models' (Section 4.3.1), and Table 4 provides full baseline accuracy values for utility comparison."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "Dataset sizes are stated (208 for AlpacaFarm, 900 each for Inj-SQuAD and Inj-TriviaQA) but no justification is given for why these sizes are adequate for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or any spread measure is reported. Although do_sample is set to false (greedy decoding, Appendix A), making results deterministic, the paper does not discuss this as a reason for omitting variance or report any sensitivity analysis."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Extensive baselines are included: four prompt-engineering defenses (Sandwich, Instructional, Reminder, Spotlight) and one fine-tuning defense (StruQ), plus a no-defense baseline. Described in Section 4.2."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include recent work: StruQ [6] (2024), Spotlight [16] (2024), and the datasets from [8] (2025). The baselines represent the current state of the art in prompt injection defense."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.4 includes two ablation studies: (1) impact of window size K on defense performance and utility (Figure 2), and (2) impact of removing in-context learning examples from the guideline prompt (Figure 3)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Two evaluation metrics are used: Attack Success Rate (ASR) for security and Accuracy for utility, evaluated on QA tasks (SQuAD, TriviaQA) and sentiment analysis (SST2)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is included. All evaluations are automated: ASR is measured by checking if the response contains the injected instruction's answer, and accuracy is measured against golden answers."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No explicit separation between development and test data is described. The prompt template and in-context examples appear to have been designed without a held-out validation set, and it is unclear whether any tuning decisions were made on the same datasets used for final evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by attack type (Naive, Ignore, Escape, Fakecom, Combined), by model, and by dataset (AlpacaFarm, Inj-SQuAD, Inj-TriviaQA) across all main tables."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The case study in Section 4.5 and Appendix C presents three cases, all showing successful defense. No failure cases are analyzed despite non-zero ASR values in several conditions (e.g., 7.00% on Inj-TriviaQA)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The ablation study in Figure 3 shows that removing in-context learning examples causes significant performance degradation on Qwen2-7B-Instruct (TriviaQA drops to 33.33%, SST drops to 23.17%), demonstrating a condition where the method fails."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims the method 'outperforms prompt-engineering-based baselines and is comparable to fine-tuning methods, reducing the ASR to 0% in some scenarios' — supported by Tables 1-3 showing 0% ASR in multiple cells. The claim of 'minimal impact on overall utility' is supported by Table 4."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper's ablation studies (Section 4.4) use controlled single-variable manipulation: removing in-context examples while keeping everything else constant demonstrates their causal contribution. The window size ablation similarly isolates one variable."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Defending against Prompt Injection Attacks' broadly, but the method is tested on only 5 prompt-engineering attacks and 2 gradient-based attacks. The paper does not discuss attacks that could bypass the method (e.g., attacks that manipulate the tagging format, or adversarially crafted outputs that mimic the expected structure)."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations for the results are discussed. The paper does not consider why the method works beyond the stated reasoning, does not include a threats-to-validity section, and does not address potential confounding factors."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper directly measures what it claims: ASR measures attack success (whether the defense prevents the model from following injected instructions), and accuracy measures utility. No proxy gap exists between measurements and claims."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are identified by family names (e.g., 'Llama3-8B-Instruct', 'GPT-3.5-Turbo', 'GPT-4o-mini') without specific version snapshots or API dates. GPT-3.5-Turbo and GPT-4o-mini behavior changes across versions, and no snapshot date is provided."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The full system prompt including the algorithm description and output structure is provided in Section 3.2. Two complete in-context learning examples are provided in Appendix D. The complete input format with tagging scheme is also shown."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A reports: do_sample=false, max_new_tokens=256, max_length=8192, K=32 (words per line). Hardware is specified as single NVIDIA H100 GPU with PyTorch 2.1.0."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The method is a direct prompting approach with post-processing filtering."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "The data preprocessing is thoroughly documented in Section 3.2 (Tagging and Splitting): data content is split into lines of maximum K=32 words, each prefixed with '[L X]' tags, and organized into Instruction Area and Data Area sections."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations section. The paper goes from the ablation study (Section 4.4) and case study (Section 4.5) directly to Related Work (Section 5) and Conclusion (Section 6) without discussing limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed anywhere in the paper, neither specific nor generic."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper does not discuss what the results do NOT show, what types of attacks might bypass the defense, or what settings are excluded from the claims."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (model outputs, per-example results) is released. Only aggregated metrics in tables are provided."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes the datasets: AlpacaFarm with simple questions (208 samples) following [6]'s setup, and Inj-SQuAD/Inj-TriviaQA (900 samples each) from [8] with phishing, advertisement, and propaganda injection goals."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All datasets are standard benchmarks (AlpacaFarm, SQuAD, TriviaQA) or previously published injection datasets."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from input to evaluation is documented: data content is split and tagged (Section 3.2), processed through the LLM with the defense prompt, filtered by tag matching, and evaluated against golden answers or injection targets."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding sources are disclosed. There is no acknowledgments section listing grants, corporate sponsors, or funding agencies."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: National University of Singapore and The Hong Kong University of Science and Technology. The authors are not affiliated with the companies whose models are evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Cannot be assessed since no funding information is disclosed. Without knowing the funding source, independence cannot be verified."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests prompt injection defenses, not model knowledge on benchmarks. The primary evaluation (ASR) measures whether the defense prevents the model from following injected instructions, not the model's pre-trained knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates defense mechanisms against prompt injection attacks, not model capability on benchmark tasks. Train/test overlap is not relevant to the core claims."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defenses rather than model knowledge. The QA utility evaluation is secondary and contamination would not affect the defense effectiveness claims."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or API costs are reported. The method adds overhead through longer prompts (tagging, in-context examples) and post-processing filtering, but this is not quantified."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Only 'single NVIDIA H100 GPU' is mentioned (Appendix A). No total GPU hours, wall-clock time, or API costs are provided."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Results are not reported across multiple random seeds. Appendix A states do_sample=false (greedy decoding), making results deterministic, but this is not framed as a seed sensitivity analysis."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is not explicitly stated. While greedy decoding implies single deterministic runs, this is not discussed."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. The window size K=32 and the prompt design appear to be chosen without systematic search. The ablation over window sizes (Figure 2) is done on the evaluation data, not a separate validation set."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "While the ablation study (Figure 2) shows performance across window sizes 8-128, the selection of K=32 is not justified through a proper validation/test split. Configuration selection appears to be done on the same data used for final evaluation."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparisons across 5+ attack methods, 8 models, and 3 datasets without any statistical tests or multiple comparison corrections."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement their own versions of baselines (prompt-engineering defenses) and compare against their own method without acknowledging potential self-comparison bias. No independent evaluation or discussion of this bias."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of compute differences between methods. The proposed method requires longer prompts (with tagging and ICL examples) and post-processing filtering compared to simpler baselines. StruQ requires fine-tuning. These compute differences are not analyzed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the ASR metric and the chosen attack benchmarks adequately measure real-world prompt injection defense effectiveness. The representativeness of the 5 prompt-engineering and 2 gradient-based attacks is not examined."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The method is a direct prompting approach."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. The utility evaluation uses SQuAD (2016) and TriviaQA (2017), which predate all tested models' training data. Model familiarity with QA answers could inflate utility accuracy numbers, but this is not addressed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. The evaluation setup provides QA context to the model alongside the question, and no analysis of whether the evaluation format leaks information is provided."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. No analysis of whether evaluation examples share structural similarities or whether the datasets have dependencies."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is applied."
       }
     }
   },
   "scan_version": 3,
   "active_modules": [
     "experimental_rigor",
     "data_leakage"
   ],
   "claims": [
     {
       "claim": "The proposed method outperforms all prompt-engineering-based baselines by at least 19.71% ASR reduction in direct prompt injection scenarios.",
       "evidence": "Table 1 shows ASR results on AlpacaFarm across three models and five attacks. The proposed method achieves maximum ASR of 2.88% vs. the best baseline (Spotlight) at 24.04% on Llama3-8B-Instruct Naive attack.",
       "supported": "strong"
     },
     {
       "claim": "The method reduces ASR to 0% in some scenarios.",
       "evidence": "Tables 1-3 show 0.00% ASR in multiple cells: e.g., Llama3-8B-Instruct with Ignore attack (0.00%), Fakecom (0.00%) on AlpacaFarm (Table 1).",
       "supported": "strong"
     },
     {
       "claim": "The method is comparable to or outperforms the fine-tuning defense StruQ, especially on unknown attacks (Fakecom, Combined).",
       "evidence": "Table 1 shows StruQ ASR on Qwen2-7B: Fakecom 16.35%, Combined 30.29%, vs. the proposed method's 1.92% and 1.92%. Tables 2-3 show even larger gaps on indirect attacks where StruQ's ASR reaches 93.33% on Qwen2-7B Fakecom.",
       "supported": "strong"
     },
     {
       "claim": "The method has minimal impact on general model performance.",
       "evidence": "Table 4 shows the method improves QA accuracy in most cases (e.g., Llama3-8B SQuAD from 83.56% to 87.78%) and reduces SST2 accuracy by only 1.53% on average.",
       "supported": "strong"
     },
     {
       "claim": "The method is effective on larger models (70B, 405B parameters) with maximum ASR of 5.77% for direct and 2.22% for indirect attacks.",
       "evidence": "Tables 5-6 show results on Llama3-70B, Llama3.1-70B, and Llama3.1-405B. Maximum ASR is 5.77% (direct, Llama3.1-405B Naive) and 2.22% (indirect, Llama3-70B Naive).",
       "supported": "strong"
     },
     {
       "claim": "The method is effective on closed-source models (GPT-3.5-Turbo, GPT-4o-mini).",
       "evidence": "Tables 7-8 show maximum ASR of 3.77% for direct and 3.89% for indirect attacks on closed-source models.",
       "supported": "strong"
     },
     {
       "claim": "Window size for splitting has no significant impact on defense performance or utility.",
       "evidence": "Figure 2 shows across three models with window sizes 8-128, the difference between best and worst defense performance is only 0.84% for Llama3-8B and 2% for utility.",
       "supported": "moderate"
     },
     {
       "claim": "In-context learning examples are critical for maintaining structured output and model utility.",
       "evidence": "Figure 3 shows that removing ICL examples causes dramatic accuracy drops: Qwen2-7B TriviaQA drops from 78.00% to 33.33%, SST from 94.04% to 23.17%.",
       "supported": "strong"
     }
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "The paper proposes a prompt injection defense that leverages rather than suppresses LLMs' instruction-following ability, by prompting models to generate responses with explicit references to executed instructions and then filtering by reference tags. The method reduces ASR to near-zero across 8 models (7B-405B, open and closed-source), 5 attack types, and 3 datasets, outperforming all prompt-engineering baselines and matching or exceeding the fine-tuning defense StruQ. The approach is particularly effective against unknown attacks (Fakecom, Combined) where StruQ struggles, and maintains or improves QA utility while incurring only ~1.5% average accuracy loss on sentiment analysis.",
   "red_flags": [
     {
       "flag": "No error bars or uncertainty quantification",
       "detail": "All results across 9 tables are reported as single point estimates with no confidence intervals, standard deviations, or significance tests, despite making comparative claims across many conditions."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper lacks any discussion of limitations, threats to validity, or scope boundaries. No consideration of what types of attacks might bypass the defense (e.g., adversarial attacks that manipulate the tagging format or mimic the expected output structure)."
     },
     {
       "flag": "No adaptive attack analysis",
       "detail": "The threat model assumes attackers have no knowledge of the defense system. No evaluation against adaptive attacks where the attacker knows about the tagging and filtering mechanism and specifically crafts attacks to exploit it."
     },
     {
       "flag": "Case studies show only successes",
       "detail": "The three case studies in Section 4.5/Appendix C all demonstrate successful defense. No analysis of the failure cases despite non-zero ASR (up to 7%) in several conditions."
     },
     {
       "flag": "No code released",
       "detail": "Despite proposing a prompt-engineering method that would be easy to share, no code repository is provided for reproduction."
     }
   ],
   "cited_papers": [
     {
       "title": "Struq: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Fine-tuning-based prompt injection defense using adversarial training, serves as the primary fine-tuning baseline in this paper."
     },
     {
       "title": "Defending against indirect prompt injection attacks with spotlighting",
       "authors": ["Keegan Hines", "Gary Lopez", "Matthew Hall", "Federico Zarfati", "Yonatan Zunger", "Emre Kiciman"],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Prompt-engineering defense using special tokens to delineate data content, serves as a baseline defense method."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Foundational work on indirect prompt injection attacks targeting LLM-integrated applications."
     },
     {
       "title": "Ignore previous prompt: Attack techniques for language models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Early work on prompt injection attack techniques including the 'ignore' attack method used as a baseline."
     },
     {
       "title": "The instruction hierarchy: Training LLMs to prioritize privileged instructions",
       "authors": ["Eric Wallace", "Kai Xiao", "Reimar Leike", "Lilian Weng", "Johannes Heidecke", "Alex Beutel"],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Fine-tuning approach to teach LLMs to prioritize system-level instructions over user-level ones for prompt injection defense."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "GCG attack method for gradient-based adversarial suffix optimization against LLMs, used as a gradient-based attack baseline."
     },
     {
       "title": "AutoDAN: interpretable gradient-based adversarial attacks on large language models",
       "authors": ["Sicheng Zhu", "Ruiyi Zhang", "Bang An", "Gang Wu", "Joe Barrow", "Zichao Wang", "Furong Huang", "Ani Nenkova", "Tong Sun"],
       "year": 2023,
       "arxiv_id": "2310.15140",
       "relevance": "Gradient-based adversarial attack method for LLMs, used as a gradient-based attack baseline."
     },
     {
       "title": "Aligning LLMs to be robust against prompt injection",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "Chuan Guo"],
       "year": 2024,
       "arxiv_id": "2410.05451",
       "relevance": "Fine-tuning approach to align LLMs against prompt injection, related defense method."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Benchmark for evaluating indirect prompt injection in agentic LLM systems."
     },
     {
       "title": "FATH: Authentication-based test-time defense against indirect prompt injection attacks",
       "authors": ["Jiongxiao Wang", "Fangzhou Wu", "Wendi Li", "Jinsheng Pan", "Edward Suh", "Z Morley Mao", "Muhao Chen", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2410.21492",
       "relevance": "Authentication-based defense mechanism against indirect prompt injection attacks."
     },
     {
       "title": "Can indirect prompt injection attacks be detected and removed?",
       "authors": ["Yulin Chen", "Haoran Li", "Yuan Sui", "Yufei He", "Yue Liu", "Yangqiu Song", "Bryan Hooi"],
       "year": 2025,
       "relevance": "Constructs the Inj-SQuAD and Inj-TriviaQA datasets used for indirect attack evaluation in this paper."
     },
     {
       "title": "MELON: Indirect prompt injection defense via masked re-execution and tool comparison",
       "authors": ["Kaijie Zhu", "Xianjun Yang", "Jindong Wang", "Wenbo Guo", "William Yang Wang"],
       "year": 2025,
       "arxiv_id": "2502.05174",
       "relevance": "Defense method against indirect prompt injection using masked re-execution, related approach."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["Xiaogeng Liu", "Zhiyuan Yu", "Yizhe Zhang", "Ning Zhang", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Universal prompt injection attack leveraging GCG optimization, relevant to the gradient-based attack evaluations."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "The method is a prompt-engineering defense applicable to any LLM application, requiring only prompt changes and output filtering — directly usable by practitioners."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Proposes leveraging instruction-following ability rather than suppressing it, a modest reversal of the dominant defense paradigm, but not a deeply surprising result."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Directly addresses prompt injection attacks which are a major LLM security concern, including phishing, propaganda, and goal hijacking scenarios."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no critique of specific companies or products, straightforward academic contribution."
     },
     "demo_ability": {
       "score": 1,
       "justification": "The full prompt is provided so someone could implement it manually, but no code repository, demo, or installable tool is released."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "From NUS and HKUST — well-known academic institutions but not celebrity AI labs. Tests on popular models (Llama, GPT) adds some recognition."
     }
   }
 }