ai-research-survey

scan.json (30777B)

---

 {
   "paper": {
     "title": "SecureCAI: Injection-Resilient LLM Assistants for Cybersecurity Operations",
     "authors": [
       "Mohammed Himayath Ali",
       "Mohammed Aqib Abdullah",
       "Mohammed Mudassir Uddin",
       "Shahnawaz Alam"
     ],
     "year": 2026,
     "venue": "arXiv.org",
     "arxiv_id": "2601.07835",
     "doi": "10.48550/arXiv.2601.07835"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "SecureCAI extends Constitutional AI with security-specific principles, DPO-based unlearning, and adaptive constitution evolution for defending LLM-assisted cybersecurity operations against prompt injection. The paper reports a 94.7% reduction in attack success rates (from 80.4% to 4.3%) across six attack categories while claiming 95.1% clean accuracy on security analysis tasks. Ablation studies attribute the largest impact to security-specific constitutional principles (ASR increases 4.4× without them). Generalization to four held-out attack types yields 7.9% average ASR compared to 50.5% for standard CAI.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, code archive, or supplementary materials link is provided anywhere in the paper. The framework is described conceptually but no implementation is released."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The adversarial dataset (51,750 samples from SIEM, PhishTank, VirusTotal, HarmBench, synthetic, BadPrompt per Table 1) is not released. No download links or data archives are provided."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, dependency list, or environment setup details are provided. The base model is described only as '7B params' without naming the specific model or framework."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. The training pipeline (Section 5.2, Figure 3) describes four stages at a conceptual level but lacks sufficient operational detail to reproduce."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 2, 3, 4, and 5 are reported as point estimates without confidence intervals or error bars. No uncertainty quantification is present."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims SecureCAI outperforms all baselines (e.g., 4.3% vs 36.0% ASR) but provides no statistical significance tests — no p-values, t-tests, or bootstrap comparisons. Differences are presented as self-evident from comparing numbers."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Tables 2 and 4 include a '∆Base' and '∆ASR' column showing relative reductions (e.g., -94.7%, +340%). Table 3 provides absolute accuracy figures with full context for comparison. The reader can assess magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The adversarial dataset totals 51,750 samples (Table 1) and clean evaluation uses 15,000 benign samples (Table 3), but no justification is given for why these sizes were chosen. No power analysis is provided."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance, or spread measures are reported across any tables. There is no mention of multiple experimental runs. All results appear to be single-run point estimates."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 compares against four baselines: Base LLM, Standard CAI [2], Input Filtering [7], and Instruction Hierarchy [11]. Table 3 repeats these comparisons for clean accuracy."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include Instruction Hierarchy (Wallace et al., 2024) and Input Filtering (Jain et al., 2023), which are recent and relevant defenses for prompt injection. Standard CAI (Bai et al., 2022) is the foundational method being extended."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Table 4 presents a systematic ablation study removing individual components: adaptive evolution, DPO training, unlearning, security principles, input sanitization, and reducing to Constitutional SL only. Each configuration is evaluated on ASR and CA."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports ASR (Table 2), Clean Accuracy with three sub-metrics (Log F1, Phishing Accuracy, Malware Human Eval in Table 3), and Constitutional Adherence Score (Figure 4)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "Table 3 lists 'Malw.' as 'Human Eval' in the caption, but the human evaluation protocol is never described — no details on number of evaluators, evaluation criteria, inter-rater agreement, or evaluation procedure. The claim of human evaluation cannot be verified."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "Table 2 evaluates on '51,750 adversarial samples' and the training preference pairs also number 51,750 (Table 1, Figure 2). The paper does not describe any train/test split or confirm that evaluation samples are separate from training samples. Table 5 tests on held-out attack types (5,000 each) but this is a separate generalization experiment, not the main evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Tables 2, 3, and 5 all provide per-category breakdowns: six attack categories for ASR, three task categories for clean accuracy, and four unseen attack types for generalization."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "Section 7.3 discusses limitation categories at a high level (computational overhead, novel attack vulnerability, constitution design dependency) but shows no specific failure examples. No qualitative analysis of cases where SecureCAI was breached or misclassified is provided."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "Every experiment shows SecureCAI performing well. The ablation study (Table 4) shows expected degradation when components are removed but reveals no surprises. No configurations that were tried and abandoned are discussed."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 94.7% ASR reduction (supported by Table 2: 80.4%→4.3%), 95.1% accuracy (Table 3), and CAS >0.92 (Figure 4). All are directly supported by reported results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims via ablation (Table 4): 'removal of security-specific constitutional principles has the largest impact, increasing ASR to 18.9%.' The ablation design is adequate — controlled single-variable removal across six configurations."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Injection-Resilient LLM Assistants for Cybersecurity Operations' broadly, but experiments use a single unnamed 7B parameter model. No other model sizes or architectures are tested. Section 7 does not bound claims to the specific model or scale tested."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper presents its results as straightforward evidence that SecureCAI works. No alternative explanations are considered — e.g., whether the improvements stem from training data overlap, whether the baselines were implemented at full strength, or whether the adversarial datasets are realistic."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper frames ASR on synthetic adversarial datasets as evidence of resilience in 'operational cybersecurity workflows' and 'Security Operations Centers.' The gap between controlled lab evaluation and real-world SOC deployment is not acknowledged."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The base model is identified only as 'Pre-trained LLM 7B params' in Figure 3. No model name, family, version, or checkpoint is specified. This makes the work impossible to replicate."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The five constitutional principles (Section 4.2.1) are described in natural language, but no actual prompt text, system instructions, or critique-revision templates are provided. The reader cannot reconstruct what was sent to the model."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "DPO β=0.1 is stated in Figure 2 and α=0.01 in Figure 3. However, learning rate, batch size, number of epochs, temperature, optimizer, and other standard training hyperparameters are not reported."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not use agentic scaffolding. SecureCAI is a training/alignment framework, not an agent with tools or multi-step reasoning loops."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "Section 5.1 names data sources (SIEM, PhishTank, VirusTotal, HarmBench) and gives sample counts per category, but does not describe how raw data was cleaned, filtered, or transformed. The adversarial injection process is described only as 'systematic injection of attack payloads' without operational detail."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.3 'Limitations and Failure Modes' provides a dedicated subsection discussing three categories: computational overhead, novel attack vulnerability, and constitution design dependency."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.3 discusses specific threats: 23% inference latency overhead for time-critical applications, 7.9% residual ASR on held-out attacks indicating vulnerability to novel paradigms, and dependence on expert-designed principles that may have gaps. These are specific to this study."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. It does not bound claims to the specific 7B model, the particular attack dataset, or the three security tasks tested. Section 8 mentions future work but does not delineate what current results cannot demonstrate."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data is released. The 51,750 adversarial samples, 18,420 critique-revision pairs, and 15,000 benign samples are not available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 describes data sources: SIEM logs for authentication/network/application events, PhishTank for phishing emails, malware repositories for samples, and HarmBench for direct prompt attacks. Table 1 provides counts per category with variant numbers."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "Section 5.3.3 mentions 'human red-team exercises with security domain experts' and Section 5.1.3 mentions 'human review for a random subset,' but neither describes how these evaluators/experts were recruited, their qualifications, or potential selection bias."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper describes data sources (Section 5.1.1) and final counts (Table 1) but the transformation pipeline between raw artifacts and training-ready preference pairs is not documented with filtering criteria or intermediate counts."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No acknowledgments section, funding statement, or grant numbers appear anywhere in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "Authors list 'Computer Science Department, Cybersecurity and Artificial Intelligence Division' without naming the institution. All four use personal gmail addresses. The actual institutional affiliation is unidentifiable."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. Absence of disclosure is not absence of conflict."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests a defense framework against adversarial attacks rather than evaluating a pre-trained model's knowledge on a benchmark. Contamination in the traditional sense (model memorized benchmark answers) does not apply."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defenses rather than model knowledge. Traditional benchmark contamination criteria do not apply, though the apparent train/test overlap (both 51,750 samples) is flagged as a red flag."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The evaluation tests defense resilience against attacks, not pre-trained model capability on knowledge benchmarks. Contamination criteria are structurally inapplicable."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants as research subjects. Human red-teamers and evaluators are part of the method/evaluation pipeline but are not studied as subjects."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human subjects study. Red-teamers and evaluators participated in a technical evaluation capacity, not as research subjects."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants as research subjects."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants as research subjects."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants as research subjects."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants as research subjects."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants as research subjects."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 7.3 mentions '23% inference latency increase' and Figure 2 notes '+3.2%' for input sanitization, but no absolute latency figures (ms), API costs, or tokens-per-query numbers are provided. Only relative overhead percentages are given."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No GPU hours, training time, hardware specifications, or total compute budget are reported for the four-stage training pipeline."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. All results appear to be from a single run."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. Results are presented without any indication of how many times experiments were repeated."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "β=0.1 and α=0.01 are stated but no hyperparameter search process, number of configurations tried, or search method is described. The chosen values appear without justification."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The hyperparameter values (β=0.1, α=0.01) are presented without explanation of how they were selected — no validation set results, no sensitivity analysis, no search procedure."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical significance tests are performed at all, so multiple comparison correction is moot."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement both SecureCAI and all baselines (Standard CAI, Input Filtering, Instruction Hierarchy) without acknowledging self-comparison bias. Baseline implementations may systematically underperform."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "SecureCAI adds multiple defense layers (input sanitization, constitutional enforcement, guardrails, output validation) with 23% latency overhead, but performance is not compared against baselines at matched compute budgets."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether synthetic adversarial datasets (including synthetic context overflow attacks and BadPrompt-derived triggers) accurately represent real-world attack scenarios in SOC environments. The gap between lab adversarial datasets and operational threats is not examined."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is involved in the evaluation."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of temporal relationships between training data and evaluation data. The adversarial datasets were presumably generated for this study, but the paper does not clarify temporal ordering."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The preference pairs (51,750) are constructed from the same attack categories and potentially the same samples as the test set. No discussion of whether the evaluation setup leaks information from training."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Training preference pairs number 51,750 (Table 1, Figure 2) and the evaluation also uses 51,750 adversarial samples (Table 2). The paper does not state whether these are independent sets or the same data, which is a critical omission."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is applied. No train/test split verification, decontamination, or independence checks are described."
       }
     }
   },
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Addresses a real SOC deployment scenario for defending LLM assistants against prompt injection, relevant to security practitioners."
     },
     "surprise_contrarian": {
       "score": 0,
       "justification": "Extends CAI with security-specific principles — a natural combination that confirms expectations rather than challenging them."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates high baseline attack success rates (80.4%) on unprotected LLM security assistants, raising concerns about current deployments."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no challenge to specific vendors or established claims."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or tool released. The base model is not even named."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "Unknown authors with personal gmail addresses and unidentifiable institutional affiliation."
     }
   },
   "claims": [
     {
       "claim": "SecureCAI reduces attack success rates by 94.7% compared to baseline models (from 80.4% to 4.3% average ASR).",
       "evidence": "Table 2 shows ASR across six attack categories for five methods. SecureCAI achieves 4.3% average vs 80.4% for base LLM. Per-category ASR ranges from 3.2% to 5.1%.",
       "supported": "moderate"
     },
     {
       "claim": "SecureCAI maintains 95.1% average clean accuracy on benign security analysis tasks, improving over the base LLM (91.5%).",
       "evidence": "Table 3 reports clean accuracy: Log F1 96.8%, Phishing Acc 95.4%, Malware Human Eval 93.2%, averaging 95.1% vs 91.5% for the base LLM.",
       "supported": "weak"
     },
     {
       "claim": "Constitutional adherence scores exceed 0.92 under maximum adversarial pressure.",
       "evidence": "Figure 4 shows CAS curves under increasing adversarial pressure. SecureCAI maintains CAS >0.92 across all pressure levels with only 6.1% degradation from minimum to maximum.",
       "supported": "weak"
     },
     {
       "claim": "Security-specific constitutional principles are the most impactful component, with removal increasing ASR by 340%.",
       "evidence": "Table 4 ablation: removing security principles increases ASR from 4.3% to 18.9% (∆ASR +340%), the largest impact of any single component removal.",
       "supported": "moderate"
     },
     {
       "claim": "SecureCAI generalizes to unseen attack types with 7.9% average ASR vs 50.5% for standard CAI.",
       "evidence": "Table 5 tests four held-out attack categories (multi-turn, encoding obfuscation, semantic camouflage, role-play) each with 5,000 samples. SecureCAI averages 7.9% ASR.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Probable train/test data overlap",
       "detail": "The training set consists of 51,750 preference pairs (Table 1) and the main evaluation in Table 2 also uses exactly 51,750 adversarial samples. The paper never explicitly states these are separate sets, raising serious concerns about evaluating on training data."
     },
     {
       "flag": "Unidentified base model",
       "detail": "The base model is described only as 'Pre-trained LLM 7B params' (Figure 3). No model name, family, or checkpoint is provided. This makes the work completely irreproducible and prevents assessment of whether results transfer to other models."
     },
     {
       "flag": "Clean accuracy improvement is counterintuitive",
       "detail": "SecureCAI achieves 95.1% clean accuracy vs 91.5% for the base LLM (Table 3), meaning the safety framework not only doesn't degrade but actively improves task performance. This is unusual — safety training typically involves some accuracy tradeoff — and is not explained."
     },
     {
       "flag": "No variance or error bars on any results",
       "detail": "All tables report single point estimates with no standard deviations, confidence intervals, or information about multiple runs. The stability of the claimed 4.3% ASR is unknown."
     },
     {
       "flag": "Suspicious institutional affiliation",
       "detail": "All four authors use personal gmail addresses. The affiliation 'Computer Science Department, Cybersecurity and Artificial Intelligence Division' names no institution. This makes it impossible to assess institutional credibility or potential conflicts."
     },
     {
       "flag": "Baseline implementation fairness unverifiable",
       "detail": "All baselines (Standard CAI, Input Filtering, Instruction Hierarchy) are re-implemented by the authors without code release. There is no way to verify these implementations are faithful and competitive, and no acknowledgment of self-comparison bias."
     },
     {
       "flag": "Adversarial pressure metric undefined",
       "detail": "Figure 4 plots CAS against 'adversarial pressure level' ranging 0.0–1.0, described only as 'normalized measure of attack sophistication and intensity.' The operationalization of this metric is never defined, making the figure uninterpretable."
     }
   ],
   "cited_papers": [
     {
       "title": "Constitutional AI: Harmlessness from AI feedback",
       "authors": ["Yuntao Bai", "Saurav Kadavath", "Sandipan Kundu"],
       "year": 2022,
       "arxiv_id": "2212.08073",
       "relevance": "Foundational method for training harmless AI through self-improvement and constitutional principles, which SecureCAI extends."
     },
     {
       "title": "BadPrompt: Backdoor attacks on continuous prompts",
       "authors": ["Xiangrui Cai", "Haidong Xu", "Sihan Xu"],
       "year": 2022,
       "relevance": "Demonstrates backdoor attacks on prompt-based models via adaptive trigger optimization, directly relevant to LLM security."
     },
     {
       "title": "Jailbreaking black box large language models in twenty queries",
       "authors": ["Patrick Chao", "Alexander Robey", "Edgar Dobriban"],
       "year": 2023,
       "arxiv_id": "2310.08419",
       "relevance": "Black-box jailbreak methodology relevant to evaluating LLM safety and adversarial robustness."
     },
     {
       "title": "Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned",
       "authors": ["Deep Ganguli", "Liane Lovitt", "Jackson Kernion"],
       "year": 2023,
       "arxiv_id": "2209.07858",
       "relevance": "Establishes red-teaming methodology for language model safety evaluation, used as reference for adversarial testing."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra"],
       "year": 2023,
       "relevance": "Defines indirect prompt injection taxonomy for LLM-integrated applications, foundational to SecureCAI's threat model."
     },
     {
       "title": "Baseline defenses for adversarial attacks against aligned language models",
       "authors": ["Neel Jain", "Avi Schwarzschild", "Yuxin Wen"],
       "year": 2023,
       "arxiv_id": "2309.00614",
       "relevance": "Evaluates baseline defense methods including perplexity-based filtering against adversarial attacks on LLMs."
     },
     {
       "title": "Prompt injection attack against LLM-integrated applications",
       "authors": ["Yi Liu", "Gelei Deng", "Zhengzi Xu"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Characterizes prompt injection attacks targeting LLM-integrated applications, directly relevant to the attack surface analysis."
     },
     {
       "title": "Ignore previous prompt: Attack techniques for language models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Early taxonomy of prompt injection attack techniques for language models."
     },
     {
       "title": "Direct preference optimization: Your language model is secretly a reward model",
       "authors": ["Rafael Rafailov", "Archit Sharma", "Eric Mitchell"],
       "year": 2023,
       "relevance": "Core training methodology adapted by SecureCAI for security-specific preference learning and unlearning."
     },
     {
       "title": "The instruction hierarchy: Training LLMs to prioritize privileged instructions",
       "authors": ["Eric Wallace", "Kai Xiao", "Reimar Leber"],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Proposes instruction hierarchy for LLM safety, used as a baseline defense in SecureCAI evaluation."
     },
     {
       "title": "Jailbroken: How does LLM safety training fail?",
       "authors": ["Alexander Wei", "Nika Haghtalab", "Jacob Steinhardt"],
       "year": 2023,
       "relevance": "Analyzes failure modes of LLM safety training, relevant to understanding why standard defenses are insufficient."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "J. Zico Kolter"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Demonstrates universal adversarial attacks via gradient-based optimization on aligned LLMs."
     }
   ]
 }