ai-research-survey

scan.json (30444B)

---

 {
   "paper": {
     "title": "Safeguarding Vision-Language Models Against Patched Visual Prompt Injectors",
     "authors": [
       "Jiachen Sun",
       "Changsheng Wang",
       "Jiongxiao Wang",
       "Yiwei Zhang",
       "Chaowei Xiao"
     ],
     "year": 2024,
     "venue": "arXiv.org",
     "arxiv_id": "2405.10529",
     "doi": "10.48550/arXiv.2405.10529"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval", "theoretical"],
   "key_findings": "SmoothVLM applies randomized pixel masking and majority voting to defend VLMs against adversarial patch-based visual prompt injection. The defense reduces attack success rates to 0–5% on LLaVA-1.5 and miniGPT4 while recovering 67.3–95% of benign image context. The paper identifies a 'q-instability' property of adversarial patches—sensitivity to pixel-wise masking—that persists even under adaptive (EOT) attacks, and provides a formal probability guarantee for defense success.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository URL, GitHub link, or archive is provided anywhere in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The 300 adversarial examples used for evaluation are not released. The source images are not identified or made available."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions A100 GPU, openai/clip-vit-base-patch32, Vicuna-30B, LLaVA-v1.5-13b, and miniGPT4, but provides no requirements.txt, Dockerfile, or detailed environment setup with library versions."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts for replicating experiments are provided."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All ASR and distortion rate results are reported as point estimates in figures (Figures 2, 3, 5–9) with no confidence intervals, error bars, or uncertainty bounds."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims SmoothVLM 'significantly' reduces ASR and 'significantly outperforms existing defense strategies' but provides no statistical significance tests (no p-values, t-tests, or bootstrap tests)."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports absolute ASR values (from 100% baseline down to 0–5%) and distortion rates with specific percentages. The abstract states 'lowers the attack success rate to a range between 0% and 5.0%' and '67.3% to 95.0% context recovery,' providing baseline-relative context."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "300 adversarial examples are used for evaluation (§3.2 and §4.1) with no justification for why this number was chosen and no power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance, or spread measures are reported across experimental runs. Results appear to be from single evaluations over the 300-example set."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The undefended VLM (100% ASR) serves as the baseline. Three perturbation methods (mask, swap, replace) are compared. However, no competing defense methods from the literature (e.g., DiffPure) are included as baselines."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims to 'significantly outperform existing defense strategies' (abstract) but includes no comparison against any competing defense method. DiffPure (Nie et al., 2022), PatchCleanser (Xiang et al., 2022), and other methods are mentioned in related work but never evaluated against."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper systematically varies perturbation type (mask, swap, replace), perturbation percentage q ∈ {5, 10, 15, 20}, and number of samples N ∈ {2, 4, 6, 8, 10}, effectively ablating the key design choices of SmoothVLM (Figures 5–9)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Two metrics are used: Attack Success Rate (ASR) for defense effectiveness (§4.1) and distortion rate for visual prompt recovery / context preservation (§4.2)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation of defense outputs. Attack success is judged by an oracle LLM (Vicuna-30B), and context recovery is also measured via Vicuna-30B similarity scores."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The 300 adversarial examples serve as the evaluation set, but there is no description of a separate dev/validation set used for tuning hyperparameters (q and N). The same examples appear to be used for both exploration and reporting."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by attack method (JIP vs VAE), perturbation type (mask, swap, replace), VLM (LLaVA-1.5 vs miniGPT4), and across different q and N values in Figures 5–9."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 discusses failure modes: vulnerability to ℓp-based attacks. Section 4.2 notes that small q=5% 'is insufficient to eliminate the concealed harmful context.' The paper also shows swap perturbation is less effective."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that swap perturbation has 'significantly higher' ASR than mask and replace (§4.1), that q=5% with low N has high distortion rates (§4.2), and that the defense fails against ℓp attacks (§6)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": false,
         "justification": "The abstract claims SmoothVLM 'significantly outperforms existing defense strategies, achieving state-of-the-art results in both detection accuracy and model performance retention.' However, no competing defense methods are compared against in the experiments. The ASR and recovery numbers are supported by the figures, but the state-of-the-art claim is unsubstantiated."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper's main causal claim—that random pixel masking disrupts adversarial patches—is supported by controlled experiments varying q and N (Figures 2, 5), theoretical analysis (Proposition 4, Appendix A), and adaptive attack experiments (Figure 3, §3.3). The ablation-style design isolates the effect of perturbation type and rate."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims protection for 'Vision-Language Models' generally, but evaluation is limited to two VLMs (LLaVA-1.5 and miniGPT4) with one image size (224×224). The paper does not bound its claims to these specific models."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper argues q-instability arises from VLM next-token prediction characteristics (§3.3) but does not consider alternative explanations such as the adversarial examples being inherently fragile regardless of model architecture, or whether the oracle LLM's judgment is reliable."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "Attack success is determined by an oracle LLM (Vicuna-30B) judging semantic similarity between model output and target adversarial content. The paper does not discuss limitations of this proxy or validate that Vicuna-30B's judgments align with actual attack success as perceived by humans."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "LLaVA-v1.5-13b is specified (§3.2), miniGPT4 is named (though no version suffix), Vicuna-30B is specified as the oracle, and openai/clip-vit-base-patch32 is specified as the attack model. The primary models have sufficient specificity."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The textual prompts used with the VLMs are not provided. The paper uses notation '[xadv, ∅]' where ∅ appears to denote an empty or default prompt, but the actual text sent to the VLMs is not disclosed."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Key hyperparameters are reported: image size 224×224, perturbation percentages q ∈ {5, 10, 15, 20}, number of samples N ∈ {2, 4, 6, 8, 10}, 8000 optimization iterations for attacks, patch size parameters m×n (§3.1)."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. SmoothVLM is a defense wrapper that applies random perturbation and majority voting, not an agentic system."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper states '300 adversarial examples' were used and 'ensure that the attacks successfully launch on the images' (§3.2, §4.1), but does not describe the source of the base images, how they were selected, or the full pipeline from source images to adversarial examples."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 is titled 'Limitations' and provides substantive discussion of the defense's scope and known weaknesses."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 identifies specific threats: 'defense mechanism primarily addresses patch-based visual prompt injections and remains vulnerable to ℓp based adversarial attacks' and 'potential risk that our SmoothVLM may fail under stronger attacks beyond our threat model.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 explicitly states SmoothVLM only addresses patch-based attacks with ℓ0 constraints and acknowledges vulnerability to ℓp attacks. The authors frame the work as 'an initial step toward establishing certified robustness in VLMs.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Neither the source images nor the generated adversarial examples are available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 300 adversarial examples were generated using JIP and VAE optimization methods, but the source/origin of the base images is not described. The attack optimization process is documented (§3.1) but the input data pipeline is not."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "No human participants, but the selection of base images for adversarial example generation is not described. The source dataset or image selection criteria are not mentioned."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The adversarial optimization process is described (JIP and VAE methods in §3.1), but the full pipeline from source images to final evaluation results has gaps: image source unknown, filtering criteria for the 300 examples not fully specified beyond 'ensure successful attack.'"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding sources, grants, or sponsorship are mentioned anywhere in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: University of Michigan Ann Arbor, Michigan State University, and University of Wisconsin Madison. No commercial product is being evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, making it impossible to assess funder independence."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates a defense mechanism against adversarial attacks, not a pre-trained model's capability on a knowledge benchmark. Contamination is not a relevant concern."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests a non-parametric defense against adversarial patches, not model knowledge on a benchmark. Train/test overlap is not applicable."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The adversarial examples are crafted specifically for the evaluation; benchmark contamination in the traditional sense does not apply."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 reports defense inference time: 'less than 1 minute under N=10' using Vicuna-30B, compared to 30 minutes per adversarial example for the JIP attack on one A100. This makes the defense '30x faster than the fastest attack method.'"
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 and §3.3 state: JIP optimization takes ~30 minutes on one A100, EOT training takes ~50 minutes for 8000 epochs on one A100. The defense requires N=10–20 VLM inference calls, compared to 100,000 for classic randomized smoothing."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No results across multiple random seeds are reported. The random masking in SmoothVLM involves stochasticity, but seed sensitivity is not analyzed."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of complete evaluation runs is not stated. 300 adversarial examples are evaluated, and N samples per input are drawn, but it is unclear whether the full evaluation was repeated multiple times."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "The paper explores q and N values systematically but does not report a hyperparameter search budget or describe how the final recommended settings were determined."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports results across all tested configurations (q ∈ {5, 10, 15, 20}, N ∈ {2, 4, 6, 8, 10}) in Figures 5–9 rather than cherry-picking a single best configuration."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed at all, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own defense without acknowledging potential evaluation bias. No independent evaluation or discussion of author-evaluation bias is present."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 explicitly discusses the compute cost of attack (30 min) vs defense (<1 min) and compares SmoothVLM's 10–20 runs per input against classic randomized smoothing's 100,000 runs."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the ASR metric (determined by Vicuna-30B oracle) validly measures defense success, or whether the 300 adversarial examples are representative of real-world visual prompt injection threats."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved in the evaluation. SmoothVLM is a direct defense wrapper, not a scaffold."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Adversarial examples are crafted specifically for the target models; temporal leakage is not a meaningful concern for defense evaluation."
       },
       "feature_leakage_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The defense processes adversarial images at inference time; feature leakage between train/test is not applicable to this non-parametric defense."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether the 300 adversarial examples are independent of each other or whether they share structural similarities (e.g., same base images, similar optimization trajectories)."
       },
       "leakage_detection_method": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable to adversarial defense evaluation where test examples are specifically crafted, not drawn from a pre-existing dataset."
       }
     }
   },
   "claims": [
     {
       "claim": "SmoothVLM reduces the attack success rate to 0–5% on LLaVA-1.5 and miniGPT4.",
       "evidence": "Figures 5 and 8 show ASR across q ∈ {5, 10, 15, 20} and N ∈ {2, 4, 6, 8, 10} for both JIP and VAE attacks on both VLMs. With sufficient q and N, ASR consistently drops below 5%.",
       "supported": "moderate"
     },
     {
       "claim": "SmoothVLM achieves 67.3% to 95.0% context recovery of benign images.",
       "evidence": "Figures 6 and 9 show distortion rates for various q and N. Recovery rates improve with higher q and N. The specific range is stated in the abstract and supported by the figures.",
       "supported": "moderate"
     },
     {
       "claim": "Patched adversarial prompts exhibit visual q-instability — sensitivity to pixel-wise randomization.",
       "evidence": "Figure 2 demonstrates ASR drops substantially when q% of pixels in the adversarial patch are randomly perturbed with mask, swap, or replace operations on 300 verified adversarial examples (§3.2).",
       "supported": "strong"
     },
     {
       "claim": "Adaptive attacks (Expectation over Transformation) are ineffective at breaking the q-instability.",
       "evidence": "Figure 3 shows EOT attack ASR remains low after masking, and the right subplot shows the optimization loss fails to reach the success threshold (0.4) with masking. However, only one adaptive attack formulation was tested (§3.3).",
       "supported": "moderate"
     },
     {
       "claim": "SmoothVLM is more than 30x faster than the fastest attack method.",
       "evidence": "Section 4.3 states defense takes <1 minute with N=10 using Vicuna-30B, while JIP attack optimization requires ~30 minutes per example on one A100.",
       "supported": "strong"
     },
     {
       "claim": "SmoothVLM significantly outperforms existing defense strategies, achieving state-of-the-art results.",
       "evidence": "Stated in abstract and contributions, but no competing defense methods are evaluated or compared against in the experiments.",
       "supported": "unsupported"
     }
   ],
   "red_flags": [
     {
       "flag": "Missing baseline comparisons",
       "detail": "The abstract and contributions claim SmoothVLM 'significantly outperforms existing defense strategies' and achieves 'state-of-the-art,' but no competing defense methods (DiffPure, PatchCleanser, etc.) are included in the evaluation. The only baseline is the undefended model."
     },
     {
       "flag": "No error bars or uncertainty quantification",
       "detail": "All ASR and distortion results are reported as point estimates without confidence intervals, error bars, or variance across runs. With random masking as a core component, result variability should be quantified."
     },
     {
       "flag": "Unvalidated oracle metric",
       "detail": "Attack success is determined by Vicuna-30B as an oracle LLM judge (§3.2, §4). The validity of this proxy is not assessed against human judgment, and no inter-rater agreement is reported."
     },
     {
       "flag": "Undisclosed image sources",
       "detail": "The 300 base images used for adversarial example generation are never identified. Their source, selection criteria, and characteristics are unknown, making it impossible to assess whether the evaluation is representative."
     },
     {
       "flag": "Unjustified sample size",
       "detail": "300 adversarial examples are used with no justification for this number. Without power analysis or variance estimates, it is unclear whether 300 is sufficient for the claims being made."
     },
     {
       "flag": "Claims outrun evidence",
       "detail": "The paper tests on two VLMs (LLaVA-1.5, miniGPT4) with 224×224 images but the title and claims address 'Vision-Language Models' generally. The generalization to other VLMs, image sizes, or attack types is unsubstantiated."
     }
   ],
   "cited_papers": [
     {
       "title": "GPT-4 Technical Report",
       "authors": ["Josh Achiam", "Steven Adler", "Sandhini Agarwal"],
       "year": 2023,
       "arxiv_id": "2303.08774",
       "relevance": "Foundational LLM whose multimodal capabilities motivate VLM security research."
     },
     {
       "title": "SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks",
       "authors": ["Alexander Robey", "Eric Wong", "Hamed Hassani", "George J Pappas"],
       "year": 2023,
       "arxiv_id": "2310.03684",
       "relevance": "Direct precursor defense method for text-based LLM jailbreaks that SmoothVLM adapts to the visual domain."
     },
     {
       "title": "Visual Adversarial Examples Jailbreak Large Language Models",
       "authors": ["Xiangyu Qi", "Kaixuan Huang", "Ashwinee Panda", "Mengdi Wang", "Prateek Mittal"],
       "year": 2023,
       "arxiv_id": "2306.13213",
       "relevance": "One of two attack methods (VAE) directly evaluated in this paper; demonstrates visual prompt injection on VLMs."
     },
     {
       "title": "Jailbreak in Pieces: Compositional Adversarial Attacks on Multi-Modal Language Models",
       "authors": ["Erfan Shayegani", "Yue Dong", "Nael Abu-Ghazaleh"],
       "year": 2023,
       "arxiv_id": "2307.14539",
       "relevance": "The other attack method (JIP) evaluated in this paper; proposes compositional adversarial attacks on VLMs."
     },
     {
       "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Foundational work on adversarial attacks against aligned LLMs, directly relevant to jailbreak robustness."
     },
     {
       "title": "Jailbreaking Black Box Large Language Models in Twenty Queries",
       "authors": ["Patrick Chao", "Alexander Robey", "Edgar Dobriban", "Hamed Hassani", "George J Pappas", "Eric Wong"],
       "year": 2023,
       "arxiv_id": "2310.08419",
       "relevance": "Demonstrates automated jailbreak discovery for LLMs, contributing to understanding of LLM vulnerabilities."
     },
     {
       "title": "Image Hijacks: Adversarial Images Can Control Generative Models at Runtime",
       "authors": ["Luke Bailey", "Euan Ong", "Stuart Russell", "Scott Emmons"],
       "year": 2023,
       "arxiv_id": "2309.00236",
       "relevance": "Demonstrates that adversarial images can hijack VLM behavior at runtime, directly relevant to visual prompt injection."
     },
     {
       "title": "Visual Instruction Tuning",
       "authors": ["Haotian Liu", "Chunyuan Li", "Qingyang Wu", "Yong Jae Lee"],
       "year": 2024,
       "relevance": "LLaVA model paper — one of two VLMs evaluated as a target in this defense work."
     },
     {
       "title": "MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Models",
       "authors": ["Deyao Zhu", "Jun Chen", "Xiaoqian Shen", "Xiang Li", "Mohamed Elhoseiny"],
       "year": 2023,
       "arxiv_id": "2304.10592",
       "relevance": "Second VLM evaluated as a defense target; combines visual encoders with LLMs for multimodal understanding."
     },
     {
       "title": "Prompt Injection Attack Against LLM-Integrated Applications",
       "authors": ["Yi Liu", "Gelei Deng", "Yuekang Li", "Kailong Wang"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Directly relevant attack methodology for LLM-integrated applications that motivates defenses like SmoothVLM."
     },
     {
       "title": "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Demonstrates indirect prompt injection in real-world LLM applications, broadening the attack surface discussion."
     },
     {
       "title": "DiffPure: Diffusion Models for Adversarial Purification",
       "authors": ["Weili Nie", "Brandon Guo", "Yujia Huang", "Chaowei Xiao", "Arash Vahdat", "Anima Anandkumar"],
       "year": 2022,
       "arxiv_id": "2205.07460",
       "relevance": "Alternative defense approach using diffusion purification against adversarial attacks, discussed as motivation for patch-based threat model."
     },
     {
       "title": "Certified Adversarial Robustness via Randomized Smoothing",
       "authors": ["Jeremy Cohen", "Elan Rosenfeld", "Zico Kolter"],
       "year": 2019,
       "relevance": "Foundational certified defense technique that SmoothVLM builds upon, requiring 100,000 runs vs SmoothVLM's 10–20."
     },
     {
       "title": "Optimization-Based Prompt Injection Attack to LLM-as-a-Judge",
       "authors": ["Jiawen Shi", "Zenghui Yuan", "Yinuo Liu", "Yue Huang", "Pan Zhou", "Lichao Sun", "Neil Zhenqiang Gong"],
       "year": 2024,
       "arxiv_id": "2403.17710",
       "relevance": "Attacks on LLM-as-judge paradigm, relevant to understanding vulnerabilities in automated evaluation used by SmoothVLM."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Proposes a defense mechanism applicable to VLMs in production, though no code release limits immediate adoption."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Extends known randomized smoothing techniques to VLMs; the q-instability finding is incremental rather than paradigm-shifting."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Addresses visual prompt injection attacks that could manipulate VLM outputs in safety-critical applications."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy or dramatic claims; straightforward defense proposal and evaluation."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code repository, demo, or tool released."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "University research teams; paper references well-known models (GPT-4, LLaVA) but is from relatively lesser-known labs."
     }
   }
 }