ai-research-survey

scan.json (30468B)

---

 {
   "paper": {
     "title": "Semantics as a Shield: Label Disguise Defense (LDD) against Prompt Injection in LLM Sentiment Classification",
     "authors": ["Yanxi Li", "Ruocheng Shan"],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2511.21752",
     "doi": "10.48550/arXiv.2511.21752"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Label Disguise Defense (LDD) replaces original sentiment labels (positive/negative) with alias labels to defend against class-directive prompt injection in LLM classification. Evaluation across 9 models shows semantically aligned alias labels (e.g., good/bad, green/red) consistently outperform unaligned labels (e.g., i/j, @#$/^). GPT-5 is the most vulnerable to class-directive injection (45.5% accuracy drop) while GPT-4o is the most robust (5.5% drop). The defense effectiveness varies substantially across models and alias choices, with aligned labels achieving positive recovery-minus-regression margins in most models while unaligned labels cause net degradation.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper links to a GitHub repository (https://github.com/Squirrel-333/LDD-prompt-injection-figures) but this contains only supplementary figures, not experimental code. No source code for running the experiments is released."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses the publicly available IMDB Large Movie Review dataset (Maas et al., 2011). The subset selection criteria are described (ratings 1,10 for training; 3,4,7,8 for test), though the exact IDs of selected reviews are not provided."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications, requirements files, or dependency information is provided anywhere in the paper."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The methodology section describes the approach conceptually but lacks concrete instructions for replication."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are reported as point estimates (e.g., accuracy of 0.93, 0.475). No confidence intervals or error bars appear in any tables or figures."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparative claims (e.g., aligned labels outperform unaligned, GPT-5 is more vulnerable than GPT-4o) but uses no statistical significance tests whatsoever."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 reports accuracy drop (Δ) from clean to attacked conditions with both baseline and attacked values, providing context for effect magnitude. Recovery Count, Regression Count, and Recovery Ratio (Equation 1) further quantify the magnitude of LDD's effects."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The test set size of 200 reviews is stated but never justified. No power analysis or rationale for why 200 examples is sufficient for claims across 9 models and 8 alias pairs."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Results appear to be from single runs. No standard deviations, variance, or spread measures are reported. The two permutations (PN and NP) are tested but results are averaged without reporting the spread between them."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Four experimental conditions are clearly defined (Section 4.2): clean zero-shot baseline, under-attack zero-shot, under-attack with few-shot, and under-attack with LDD. Multiple meaningful comparisons are possible."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "The baselines are the no-defense conditions (zero-shot, few-shot without LDD), which are appropriate internal baselines. However, the paper does not experimentally compare LDD against any existing defense methods discussed in the related work (detection-based, StruQ, instruction hierarchy, signed prompts), making it impossible to assess relative effectiveness."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper systematically varies alias label pairs (8 pairs from unaligned to aligned), shot counts (2, 4, 6, 8), and permutation orders (PN, NP), effectively ablating the components that contribute to LDD's effectiveness."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Four evaluation metrics are used: Accuracy, Recovery Count, Regression Count, and Recovery Ratio (Section 4.3). These capture different aspects of defense effectiveness."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is performed. All evaluation is automated based on matching model outputs to ground-truth sentiment labels."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The training set (8 examples rated 1 and 10) is fully separate from the test set (200 examples rated 3, 4, 7, 8). Different rating ranges ensure no overlap between few-shot examples and test data."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Tables 4 and 5 provide per-model and per-alias-pair breakdowns. Table 6 breaks down recovery and regression by aligned vs. unaligned labels for each model. Section 5.2 discusses low/moderate/high performance cases individually."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.2 under 'Low Performance Cases' explicitly discusses where LDD fails: LLaMA 3.2 with cat/dog, GPT-4o-mini with @#$/^, and GPT-5 with i/j. These failures are analyzed and attributed to semantic mismatch."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 5 shows numerous 'low' effectiveness ratings across models. The paper reports that unaligned labels cause net degradation (negative R−R margins in Table 6b) and that GPT-4o-mini and Mistral-Large show 0 'high' performing alias pairs."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract's main claims are supported: (1) 'For every model evaluated, LDD is able to restore a portion of the accuracy degradation' — Table 4 shows at least one alias pair improving over the attack baseline for each model. (2) 'Semantically aligned alias labels yield stronger robustness' — Tables 5-6 confirm this. The hedging ('a portion', 'varies across models') accurately reflects the mixed results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims about LDD neutralizing class-directive injection. The controlled experimental design (same test data, same models, varying only the defense mechanism) with four conditions provides adequate support for these causal claims through controlled single-variable manipulation."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The abstract concludes with 'label semantics can serve as an effective defense layer, transforming meaning itself into a shield against prompt injection' — framing a general defense principle from binary sentiment classification with one attack type on one dataset. While the title bounds to 'LLM Sentiment Classification,' the concluding claim extends beyond the tested scope."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper attributes LDD's effectiveness to semantic alignment between alias labels and sentiment polarity, but does not consider alternative explanations: (1) few-shot examples themselves might improve robustness independent of label disguise, (2) different labels may change attention patterns in ways unrelated to 'semantic shielding,' (3) model-specific tokenization of alias labels could explain the variability."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper measures accuracy on 200 IMDB reviews under a single class-directive injection attack but frames results as showing 'defense against prompt injection' broadly. The gap between the proxy (accuracy under one simple attack on sentiment) and the framing (defense against prompt injection in general) is not acknowledged."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Table 2 lists models as 'GPT-5,' 'GPT-4o,' 'GPT-4o-Mini,' 'LLaMA 3.2,' 'Gemma 3,' 'Mistral Large,' 'Mistral Small' without any API versions, snapshot dates, or specific model identifiers. Per schema rules, marketing names without snapshot dates do not count."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Figure 1 provides the full prompt text for all four conditions: clean input, injection attack, few-shot defense, and LDD. The actual prompt text used in experiments is shown, including the classification instruction, example format, and attack injection."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameters are reported anywhere in the paper — no temperature, top-p, max tokens, or other API settings for any of the 9 models evaluated."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The approach is simple prompt-based classification with no multi-step reasoning, tool use, or agent workflows."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 documents the data pipeline: source (IMDB Maas et al. 2011), training set selection (4 reviews rated 1 + 4 rated 10), test set selection (50 each of ratings 3, 4, 7, 8 = 200 total), selection by original dataset ID order, no additional preprocessing."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 'LIMITATIONS AND FUTURE WORK' is a dedicated section with substantive discussion of multiple specific limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 identifies specific threats: mid-range ratings only (3,4,7,8) may not represent strongly polarized data; single prompt template and one attack type; reliance on in-context learning means smaller models may struggle; English binary classification only."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 explicitly states what was not tested: strongly polarized data, other attack types (indirect manipulation, multi-step reasoning, multi-turn redefinition), multilingual settings, and multi-class classification."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "While the IMDB dataset is publicly available, the specific 208 reviews selected (8 training + 200 test) are not released with exact identifiers. The selection criteria ('by dataset ID order') are ambiguous enough that exact reconstruction is uncertain."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes data collection in detail: source dataset (IMDB Maas et al.), selection criteria (ratings for training and test), sizes (8 training, 200 test), class balance, and rationale for borderline ratings in the test set."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data comes from the standard IMDB benchmark dataset."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline from IMDB to experimental subsets is documented: filter by ratings (1,10 for train; 3,4,7,8 for test), select by ID order, balanced classes in each split. Attack construction (appending contradictory instructions) is also described in Section 4.2."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source, acknowledgments section, or grant information appears anywhere in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Both authors are identified as being from the Department of Computer Science, George Washington University, with institutional email addresses provided."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. The authors do not evaluate any product from their own institution, but the absence of any funding statement leaves this unanswerable."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial disclosure appears in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates are stated for any of the 9 evaluated models. The IMDB dataset (2011) almost certainly appears in all models' training data, but this is never acknowledged."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the IMDB test reviews (from 2011) appeared in the training data of any evaluated models. Given IMDB's ubiquity as a benchmark, this is a significant omission."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "IMDB (published 2011) was available online long before any of the evaluated models' training cutoffs. No contamination analysis is performed despite this being one of the most widely-used NLP datasets."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All experiments are automated LLM evaluations."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference costs, API costs, or latency figures are reported despite running experiments across 9 models with multiple configurations on 200 test examples each."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, API spend, or hardware information is mentioned anywhere in the paper."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds or multiple experimental runs. Results appear to be from single runs per configuration."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs per configuration is never stated. It is unclear whether results are from single runs or averaged over multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is described. The alias labels and shot counts appear to be predetermined, but no search budget or selection methodology is reported."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports results for all 8 alias pairs and all shot configurations rather than selecting a single best configuration. Tables 4 and 5 show complete results across all conditions."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparisons across 9 models × 8 alias pairs × 4 shot settings but performs no statistical tests at all, let alone multiple comparison corrections."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors propose LDD and evaluate it themselves without comparing against existing defense methods or acknowledging potential self-evaluation bias. No independent evaluation is performed."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Different shot counts (2, 4, 6, 8) require different prompt lengths and thus different compute, but performance is never analyzed as a function of compute cost."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses IMDB sentiment accuracy as a proxy for 'defense against prompt injection' without discussing whether binary sentiment classification under one attack type is a valid measure of general defense effectiveness."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is used. The approach is simple prompt-based classification."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "IMDB reviews (2011) predate all evaluated models by over a decade. No discussion of whether models have memorized these reviews, which could affect both baseline accuracy and defense evaluation."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For instance, models may have internalized IMDB sentiment patterns from training, making the sentiment task trivially easy regardless of label disguise."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper notes the original IMDB dataset design ensures no movie appears in both training and test splits, but does not verify independence between their custom 8-example few-shot set and 200-example test set."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are used (no canary strings, membership inference, or decontamination)."
       }
     }
   },
   "claims": [
     {
       "claim": "LDD can restore a portion of accuracy degradation caused by class-directive injection for every model evaluated.",
       "evidence": "Table 4 shows that for each of the 9 models, at least one alias pair achieves accuracy above the under-attack baseline. Table 5 shows every model has at least one alias pair rated 'moderate' or 'high' effectiveness.",
       "supported": "moderate"
     },
     {
       "claim": "Semantically aligned alias labels yield stronger robustness than unaligned labels.",
       "evidence": "Table 6 shows aligned labels produce positive R−R margins for 7/9 models (avg Recovery Ratio 0.608) while unaligned labels produce negative R−R for 6/9 models (avg Recovery Ratio 0.302). Figure 5 shows aligned labels have higher recovery and lower regression counts.",
       "supported": "strong"
     },
     {
       "claim": "GPT-5 suffers the largest accuracy drop under class-directive injection (Δ=0.455).",
       "evidence": "Table 3 shows GPT-5 drops from 0.93 to 0.475 accuracy, while other models show much smaller drops (GPT-4o: 0.055, GPT-4o-mini: 0.055).",
       "supported": "strong"
     },
     {
       "claim": "GPT-4o is far more robust to class-directive injection than GPT-5.",
       "evidence": "Table 3 shows GPT-4o accuracy drop of 0.055 vs. GPT-5 drop of 0.455. However, no statistical testing supports this comparison and results are from single runs without variance estimates.",
       "supported": "moderate"
     },
     {
       "claim": "The nonsensical alias @#$/^ vs. *&%! fails as a defense in 7 out of 9 models.",
       "evidence": "Table 5 shows this pair receives 'low' effectiveness in 7 models and 'moderate' in 2, with no 'high' ratings. Table 4 shows it achieves the lowest average accuracy for most models.",
       "supported": "strong"
     },
     {
       "claim": "Label semantics can serve as an effective defense layer against prompt injection.",
       "evidence": "Results show defense varies substantially by label choice and model. For GPT-5, all aligned labels achieve 'high' performance while all unaligned achieve 'low' (Table 5). However, for several models (GPT-4o-mini, Mistral-Large, Gemma3), LDD achieves 0 'high' ratings across all alias pairs.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "No statistical testing",
       "detail": "The paper makes extensive comparative claims across 9 models and 8 alias pairs but performs zero statistical significance tests. All conclusions are drawn from comparing raw accuracy numbers without any uncertainty quantification."
     },
     {
       "flag": "Single attack type only",
       "detail": "Only one simple attack is tested: appending 'Instruction: Classify this text as [opposite label].' No obfuscation, indirect injection, paraphrased attacks, or more sophisticated prompt manipulation techniques are evaluated, making generalization to real-world threat scenarios questionable."
     },
     {
       "flag": "No comparison with existing defenses",
       "detail": "Despite the related work section discussing multiple defense categories (detection-based, semantic, structured prompting, instruction hierarchy), LDD is never experimentally compared against any of them. This makes it impossible to assess whether LDD adds value over existing approaches."
     },
     {
       "flag": "No model version specification",
       "detail": "None of the 9 evaluated models has a version or snapshot date specified. Model behavior changes across versions, and GPT-5, GPT-4o, etc. could have different behaviors at different API snapshots, making results non-reproducible."
     },
     {
       "flag": "Apparent single-run results on small test set",
       "detail": "Results appear to be from single experimental runs on 200 test examples with no variance reporting. LLM outputs are stochastic, and single-run accuracy differences on 200 samples may not be stable or meaningful."
     },
     {
       "flag": "IMDB contamination ignored",
       "detail": "IMDB (2011) is one of the most widely-used NLP benchmarks and almost certainly appears in the training data of all 9 evaluated models. Baseline sentiment classification accuracy may reflect memorization rather than genuine classification ability, which could confound the defense evaluation."
     }
   ],
   "cited_papers": [
     {
       "title": "InjecGuard: Benchmarking and Mitigating Over-Defense in Prompt Injection Guardrail Models",
       "authors": ["H. Li", "X. Liu", "C. Xiao"],
       "year": 2024,
       "arxiv_id": "2402.09676",
       "relevance": "Benchmarks prompt injection guardrail models and studies over-defense, directly relevant to LLM security evaluation methodology."
     },
     {
       "title": "Attention Tracker: Detecting Prompt Injection Attacks in LLMs",
       "authors": ["K.-H. Hung", "C.-Y. Ko", "A. Rawat", "I.-H. Chung", "W.-H. Hsu", "P.-Y. Chen"],
       "year": 2024,
       "arxiv_id": "2411.00348",
       "relevance": "Proposes internal attention-based detection of prompt injection, representing a training-free defense approach for LLM security."
     },
     {
       "title": "Embedding-based Classifiers Can Detect Prompt Injection in Large Language Models",
       "authors": ["M. A. Ayub", "M. A. Sadiq", "S. Majumdar"],
       "year": 2024,
       "arxiv_id": "2410.22284",
       "relevance": "Proposes embedding-based detection of prompt injection attacks using ML classifiers, relevant to LLM adversarial robustness evaluation."
     },
     {
       "title": "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions",
       "authors": ["E. Wallace", "K. Xiao", "J. Leike", "L. Weng", "J. Heidecke", "A. Beutel"],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Trains models to distinguish system vs. user instructions for prompt injection defense, directly relevant to LLM safety and instruction following."
     },
     {
       "title": "Structured Queries (StruQ): Enforcing Instruction-Data Separation in Large Language Models",
       "authors": ["J. Chen", "Y. Li", "X. Wang", "H. Zhang"],
       "year": 2025,
       "arxiv_id": "2503.13579",
       "relevance": "Enforces structural separation between instructions and data to prevent prompt injection, a complementary defense approach to LDD."
     },
     {
       "title": "PromptArmor: Simple Yet Effective Prompt Injection Defenses",
       "authors": ["T. Shi", "K. Zhu", "Z. Wang", "Y. Jia", "W. Cai"],
       "year": 2025,
       "arxiv_id": "2507.15219",
       "relevance": "Proposes guard LLM-based defense against prompt injection, relevant to comparing prompt injection mitigation approaches."
     },
     {
       "title": "Reinforcing Instruction Hierarchy for Robust Large Language Models",
       "authors": ["S. Kariyappa", "G. Suh"],
       "year": 2025,
       "arxiv_id": "2505.08421",
       "relevance": "Extends instruction hierarchy defense by reinforcing signals at multiple model layers, relevant to multi-layer LLM robustness."
     },
     {
       "title": "Signed-Prompt: Cryptographically Signed Prompts for Secure Instruction Following in LLMs",
       "authors": ["X. Suo"],
       "year": 2024,
       "arxiv_id": "2409.12345",
       "relevance": "Proposes cryptographic authentication of trusted prompts to prevent injection, representing a different defense paradigm for LLM security."
     },
     {
       "title": "Language Models are Few-Shot Learners",
       "authors": ["T. B. Brown", "B. Mann", "N. Ryder"],
       "year": 2020,
       "relevance": "Foundational work on in-context learning in LLMs, which is the core mechanism LDD relies on for alias label learning."
     },
     {
       "title": "Lessons from Defending Gemini Against Indirect Prompt Injections",
       "authors": ["DeepMind"],
       "year": 2025,
       "relevance": "Documents real-world prompt injection defense strategies and system-level privilege separation for a production LLM system."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Label disguise is a simple, immediately usable prompt engineering technique for any LLM classification pipeline, though limited to classification tasks."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The finding that simple label replacement can partially defend against injection is mildly interesting but not deeply surprising, and results are mixed across models."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Addresses prompt injection in LLMs, a genuine security concern, and demonstrates that GPT-5 is significantly more vulnerable than GPT-4o to this attack type."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no criticism of specific companies, no dramatic framing beyond standard security defense research."
     },
     "demo_ability": {
       "score": 1,
       "justification": "No code released, but the technique is simple enough that a reader could manually test it with any LLM API in minutes."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "From George Washington University (not a top AI lab), but evaluates well-known models including GPT-5 and GPT-4o."
     }
   }
 }