ai-research-survey

scan.json (35365B)

---

 {
   "paper": {
     "title": "Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution",
     "authors": [
       "Meysam Alizadeh",
       "Zeynab Samei",
       "Daria Stetsenko",
       "Fabrizio Gilardi"
     ],
     "year": 2025,
     "venue": "arXiv (preprint, under review)",
     "arxiv_id": "2506.01055",
     "doi": "10.48550/arXiv.2506.01055"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Prompt injection attacks targeting data exfiltration cause a 15–50% utility drop across 6 LLMs tested on AgentDojo's banking suite, with average attack success rates around 20%. Most LLMs resist leaking passwords due to safety alignment but remain vulnerable to disclosing other personal data; password leakage increases when requested alongside additional sensitive fields. Some defenses (prompt injection detector, prompt sandwiching) reduce ASR to zero on the original 16 tasks, but no defense fully prevents leakage across an expanded 48-task evaluation.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'All results are based on AgentDojo which has a Github repository' and 'We will release our new synthetic dataset upon acceptance of the paper.' The extended attack code and synthetic dataset are not yet released. A promise of future release counts as NO."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The underlying AgentDojo framework is public, but the paper's novel contributions—32 additional synthetic banking tasks, expanded injection tasks, and generalized injection templates—are not yet released. 'We will release our new synthetic dataset upon acceptance of the paper' (NeurIPS checklist, Q5)."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or environment specification is provided. The paper mentions using model APIs but provides no dependency or environment details beyond model names."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The paper describes methods at a conceptual level and references AgentDojo's repository, but does not include commands, scripts, or a README for reproducing the experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports 95% confidence intervals in Tables 6 and 7, computed using statsmodels.stats.proportion.proportion_confint (NeurIPS checklist, Q7). Figures 4 and 7 reference these tables for CI values."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No formal significance tests (t-tests, chi-squared, bootstrap tests) are reported. The paper makes comparative claims (e.g., 'the Important message variant outperforming prior approaches') based on numerical comparison with confidence intervals but no explicit hypothesis tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are reported as absolute percentage differences with baseline context throughout: '15%–50% drop in utility' (Section 1), 'additional 2.5% boost' for Max attack (Section 4.3), 'accurate name knowledge increases attack success by 4.1%' (Table 3)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is given for the sample sizes. The original 16 AgentDojo tasks are inherited from the benchmark, and the 32 additional synthetic tasks are added without power analysis or justification for why 48 total is sufficient."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance or standard deviation across experimental runs is reported. The 95% CIs in Tables 6-7 are binomial proportion confidence intervals (from proportion_confint), not measures of run-to-run variance. It appears each scenario was run once per model."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Multiple baselines are included: 4 attack types from prior work (Important message, Ignore previous instruction, InjecAgent, TODO) compared in Figure 5 and Table 1. Defense evaluation compares no-defense baseline against 4 defense strategies (Section 4.2)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Both models and defense methods are contemporary. Models include GPT-4o, Claude 3.5 Sonnet, and Llama-4 (2024-2025 era). Defenses include recent methods from AgentDojo (2024), ProtectAI's BERT classifier, and TaskShield."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 presents an ablation study on attack components: comparing 4 attack phrasings, evaluating the effect of attacker knowledge (correct vs. incorrect user/model names), and an adaptive Max strategy. Table 3 quantifies each factor's contribution."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three evaluation metrics are used (Section 3.4): Benign Utility, Utility Under Attack, and Targeted Attack Success Rate (ASR). These are consistently reported throughout."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is included. All evaluation is automated through AgentDojo's framework, which programmatically checks whether data was leaked and whether the user task was completed. No human review of model outputs is described."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No explicit train/test separation is described. The paper notes that 'early experiments revealed that LLMs respond inconsistently depending on the nature of the requested data' (Section 4.1), suggesting iterative design based on observed results without a held-out evaluation set."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Extensive per-category breakdowns are provided: per-model results (Figures 2-3), per-injection-task results (Figure 3), per-defense results (Figure 4), per-task-category results (Figures 6, 14), and per-sensitivity-level results (Figures 13, 16-18)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Failure cases are discussed throughout. Table 2 shows examples of LLM refusals to disclose passwords. The paper discusses when attacks fail (Only Password injection has 0% ASR on most models), when defenses fail (no defense achieves 0% on 48 tasks), and model-specific vulnerabilities."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results are reported: the 'Only Password' injection has 0% ASR on most models (Figure 3b); GPT-3.5 Turbo unexpectedly performs better under attack (Figure 2a); defenses that achieved 0% ASR on 16 tasks fail on 48 tasks (Section 4.4); and the discrepancy with AgentDojo's original findings about defense utility improvement."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims are supported: '15%–50% drop in utility' matches Figure 2a; 'average ASR around 20%' matches Figure 2b; 'some defenses reduce ASR to zero' matches Figure 4b; 'average ASR is around 15%' for 48 tasks matches Figure 6b. All quantitative claims in the abstract have corresponding results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims about prompt injection causing data leakage. The experimental design uses controlled injection of specific prompts into specific tasks, measuring the effect on ASR. The ablation study (Section 4.3) isolates individual attack components. This controlled-manipulation design is adequate for the causal claims made."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Claims are generally bounded to the tested setting. The title specifies 'LLM Agents During Task Execution,' and results are reported per-model and per-task-category. The limitations acknowledge the work 'does not capture the full range of adversarial scenarios' and that results are 'sensitive to variations in dataset characteristics and model architectures.'"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "Alternative explanations for the results are not substantively discussed. The paper attributes password resistance to 'safety alignments' and task-type effects to semantic similarity, but does not systematically consider confounds such as model size, training data composition, RLHF intensity, or prompt formatting effects on the observed ASR differences across models."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures data exfiltration directly: ASR checks whether specific personal data was actually leaked via the email tool. The measurement (was data sent to attacker email?) directly matches the claimed outcome (data exfiltration risk). No proxy gap exists."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are identified by marketing names only: 'Claude 3.5 Sonnet', 'GPT-3.5 Turbo', 'GPT-4 Turbo', 'GPT-4o', 'Llama-3 (70B)', 'Llama-4 (17B)' (Section 4). No API snapshot dates, version IDs (e.g., gpt-4o-2024-05-13), or access dates are provided. Model behavior changes across versions."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full system prompts are provided in Appendix A.2: Figure 10 (default prompt), Figure 11 (Claude-specific), Figure 12 (Llama-specific). Injection prompt templates with full text are in Table 1. Synthetic benchmark creation prompts are in Figures 8-9."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameters are reported for any model API calls. Temperature, top-p, max tokens, and other generation parameters are not mentioned anywhere in the paper."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The AgentDojo framework is described in Section 3.2, including its environment (tools, state), task structure, and evaluation pipeline. The banking suite's 11 tools and task structure are described. AgentDojo is a public framework with open-source code, enabling full scaffold inspection."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The synthetic dataset creation process (Section 3.5) describes a 'multi-step process' using 4 LLMs, with prompts in Figures 8-9. However, the aggregation and curation steps ('These structured outputs were aggregated and curated') lack detail—no filtering criteria, no counts of items generated vs. retained, no inter-annotator agreement on curation decisions."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "The conclusion contains a substantive limitations paragraph: 'This study has several limitations. While it approximates real-world conditions, it does not capture the full range of adversarial scenarios. Attackers with domain-specific expertise or operating under alternative threat models may exploit vulnerabilities not addressed in this analysis.'"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "The limitations are mostly generic rather than specific to this study. 'Does not capture the full range of adversarial scenarios' and 'results are sensitive to variations in dataset characteristics and model architectures' apply to virtually any benchmark study. No specific threats are identified (e.g., AgentDojo's synthetic environment may not reflect real banking agent behavior, different API versions could yield different results)."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit list of what the results do NOT show. The limitations paragraph mentions general caveats but does not state specific scope boundaries such as: results do not extend to non-English prompts, multi-turn attacks, production deployments, or models beyond those tested. Future work mentions are vague ('other sensitive domains')."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Raw experimental data (model outputs, tool call traces, per-task results) are not available. Only aggregated results in figures and tables are presented. The synthetic dataset is also not released ('upon acceptance')."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Data collection is described: AgentDojo's banking suite provides the base 16 tasks and 11 tools (Section 3.2), synthetic dataset creation uses 4 LLMs with documented prompts (Section 3.5, Figures 8-9), and injection task design is detailed in Tables 1-2 and Figure 15."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper evaluates LLM agents on synthetic tasks. Data sources are AgentDojo (a standard benchmark) and LLM-generated synthetic data."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline from raw LLM-generated outputs to the final 32 synthetic tasks is not fully documented. The paper states outputs were 'aggregated and curated' but does not specify filtering criteria, how many candidate tasks were generated vs. retained, or what curation decisions were made. Table 5 shows the final 48 tasks but the reduction pipeline is opaque."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source is disclosed anywhere in the paper. There is no acknowledgments section listing grants, sponsors, or funding agencies."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: University of Zurich (Alizadeh, Stetsenko, Gilardi) and IPM (Samei). The authors are not affiliated with any of the LLM companies whose products are evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. Without a funding statement, this defaults to NO since absence of disclosure is not absence of conflict."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates are stated for any of the 6 models tested. This is relevant because AgentDojo was published in 2024 and could appear in training data for models trained after that date."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AgentDojo's banking tasks, injection templates, or evaluation logic appeared in any model's training data. Given AgentDojo has a public GitHub repository, models trained after mid-2024 could have seen the exact task descriptions and expected behaviors."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "AgentDojo was published in 2024 (arXiv:2406.13352) with public code and data. Models like GPT-4o and Claude 3.5 Sonnet may have been trained on data including AgentDojo contents. This is not discussed, and could affect both utility and ASR measurements if models learned to handle these specific tasks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper evaluates LLM agents on synthetic benchmark tasks."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data is synthetic and experiments involve only LLM API calls."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants or experimental conditions requiring randomization of human subjects."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants or evaluators requiring blinding."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C provides detailed cost estimates: preliminary evaluation costs ~$10 for GPT models, ~$10 for Claude; defense evaluation ~$10; ablation analysis ~$15; expanded evaluation ~$30 for GPT, ~$30 for Claude. Total costs: ~$127.5 for GPT models, ~$40 for Claude."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C states the total computational budget: approximately $127.5 for all GPT model experiments and $40 for Claude 3.5 Sonnet experiments, covering all task suites including both injection and benign evaluations."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. Results appear to be from single runs per scenario. LLM outputs can vary significantly across runs even with identical inputs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs per scenario is never explicitly stated. The paper does not mention whether each task-injection pair was run once or multiple times."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is described. Temperature, top-p, and other generation parameters are neither reported nor tuned. The 4 injection variants were designed manually, not through systematic search."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "All attack variants and defense configurations are reported, not just the best. The 'Max' adaptive attack explicitly selects the best per-task attack and is clearly described (Section 4.3). All defense results are shown side-by-side in Figures 4 and 7."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Many comparisons are made across 6 models × 4 injection types × 4+ defenses × 48 tasks without any multiple comparison correction. No Bonferroni, Holm, or Benjamini-Hochberg correction is applied."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors' own 'Important message' attack outperforms baseline attacks from prior work (Figure 5), but no discussion of self-comparison bias is provided. The authors designed the attack, the evaluation framework extensions, and the synthetic tasks—a setup that could favor their approach."
       },
       "compute_budget_vs_performance": {
         "applies": false,
         "answer": false,
         "justification": "Compute differences across models and defenses are negligible for this type of API-based evaluation. The paper is not comparing methods with different computational requirements."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether AgentDojo's simulated banking environment and synthetic tasks validly represent real-world data exfiltration risk. The gap between a sandboxed evaluation framework with fictional bank data and actual deployed banking agents handling real user data is not examined."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Different system prompts are used for different models (Figures 10-12): GPT models get one prompt, Claude gets a different prompt with chain-of-thought tags, and Llama gets a substantially different prompt with XML-style tags. These prompt differences could confound model comparisons but are not discussed as a potential confounder."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. AgentDojo was published in June 2024 and its tasks could appear in training data for models released after that date. No temporal analysis of when models were trained relative to when benchmark data was published."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. The evaluation setup provides the full system prompt and user task context to the agent, which is realistic, but whether any evaluation artifacts leak answer information is not analyzed."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Not discussed. The 16 original AgentDojo tasks and 32 synthetic tasks may share structural patterns (all are banking-domain, similar tool-call patterns), which could inflate apparent consistency of results."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is used. No canary strings, membership inference tests, or decontamination procedures are applied to check whether models have seen AgentDojo data."
       }
     }
   },
   "claims": [
     {
       "claim": "LLMs experience a 15–50% drop in absolute utility when under prompt injection attack.",
       "evidence": "Figure 2a shows benign utility vs. utility under attack across 6 models. Most models fall well below the diagonal, with drops ranging from ~15% (GPT-4o) to ~50% (Claude 3.5 Sonnet). Exception: GPT-3.5 Turbo slightly improves under attack.",
       "supported": "strong"
     },
     {
       "claim": "Average targeted attack success rate is around 20%, with Llama-4 (17B) at 40% being a notable outlier.",
       "evidence": "Figure 2b shows ASR vs. benign utility. Most models cluster near 20% ASR. Llama-4 (17B) shows ~40% ASR, substantially higher than other models.",
       "supported": "strong"
     },
     {
       "claim": "Most LLMs resist leaking passwords due to safety alignment, but remain vulnerable to disclosing other personal data.",
       "evidence": "Table 2 shows model refusal examples. Figure 3b shows 'Only Password' injection achieves 0% ASR on all models except Llama-4 (17B), while 'No Password' injection achieves up to 93% ASR on Claude 3.5 Sonnet. Figure 13b shows password leakage rates consistently below overall ASR.",
       "supported": "strong"
     },
     {
       "claim": "Password leakage increases when a password is requested alongside one or two additional personal details.",
       "evidence": "Figure 13a shows password leakage rates increase from 0% (password-only) to non-zero when combined with other data. In 'Password + 2 Sensitive Data', every model except GPT-4 and GPT-3.5 shows some password leakage vulnerability.",
       "supported": "moderate"
     },
     {
       "claim": "Some defense strategies (prompt injection detector, repeat user prompt) can reduce ASR to 0% on the original 16 AgentDojo tasks.",
       "evidence": "Figure 4b and Table 6 show both prompt injection detector and repeat user prompt achieve 0% ASR. Tool filtering achieves 3.1% ASR. These results are for GPT-4o on 16 tasks.",
       "supported": "strong"
     },
     {
       "claim": "No built-in AgentDojo defense fully prevents leakage on the expanded 48-task evaluation.",
       "evidence": "Figure 7b and Table 7 show all defenses have non-zero ASR on 48 tasks: tool filter 1.0%, PI detector 1.5%, repeat prompt 7.3%, delimiting 10.3%. This contrasts with the 0% ASR achieved by some defenses on only 16 tasks.",
       "supported": "strong"
     },
     {
       "claim": "Tasks involving data extraction or authorization workflows exhibit the highest attack success rates.",
       "evidence": "Figure 14b shows Account Information and Profile & Authentication Management task categories have the highest ASR, while Fund Transfer & Payment and Transactions & Insights show lower susceptibility.",
       "supported": "moderate"
     },
     {
       "claim": "The 'Important message' attack outperforms prior injection approaches, and the adaptive Max strategy adds an additional 2.5% improvement.",
       "evidence": "Figure 5 compares 5 attack types on GPT-4o. Important message achieves the highest single-attack ASR, and Max achieves an additional 2.5% boost. However, the improvement is modest and no significance test is reported.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Single-run results without variance",
       "detail": "Results appear to be from single runs per scenario with no seed sensitivity analysis. LLM outputs are stochastic, and the paper's binomial CIs capture sampling uncertainty but not run-to-run variance. This is especially concerning given only 16-48 tasks per evaluation."
     },
     {
       "flag": "Different prompts per model confound comparisons",
       "detail": "Three different system prompts are used across model families (Figures 10-12). Claude gets chain-of-thought tags, Llama gets XML-style function-calling instructions, and GPT models get a simpler prompt. These substantial differences in prompting could confound cross-model ASR and utility comparisons, but are not discussed as a potential confounder."
     },
     {
       "flag": "No hyperparameters reported",
       "detail": "Temperature, top-p, and other generation parameters are not reported for any model API call. These settings significantly affect output variability and could influence both attack success and defense effectiveness."
     },
     {
       "flag": "Misleading NeurIPS checklist response on LLM usage",
       "detail": "Question 16 asks about LLM usage in core methods, and the paper answers NA ('The core method development in this research does not involve LLMs as any important, original, or non-standard components'). However, 4 LLMs were used to generate the synthetic benchmark dataset (Section 3.5), which is a core methodological contribution."
     },
     {
       "flag": "Benchmark contamination risk unaddressed",
       "detail": "AgentDojo was published in June 2024 with public code. Models like GPT-4o, Claude 3.5 Sonnet, and Llama-4 may have been trained on data containing AgentDojo's task descriptions and expected behaviors. This could inflate both utility scores (models learned correct behavior) and deflate ASR (models learned to resist known attacks)."
     }
   ],
   "cited_papers": [
     {
       "title": "AgentDojo: A dynamic environment to evaluate attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunović", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "arxiv_id": "2406.13352",
       "relevance": "Core benchmark framework used in this paper; foundational agentic security evaluation with 97 tasks and 629 security test cases."
     },
     {
       "title": "Defeating prompt injections by design",
       "authors": ["Edoardo Debenedetti", "Ilia Shumailov", "Tianqi Fan"],
       "year": 2025,
       "arxiv_id": "2503.18813",
       "relevance": "CaMeL framework for design-based defenses against prompt injection in LLM agents; identified as future work direction."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2025,
       "arxiv_id": "2410.05451",
       "relevance": "Preference-based defense achieving near-zero injection success while preserving utility; relevant to defense evaluation methodology."
     },
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["Siyuan Chen", "Peter Yong Zhong", "Ruiqi Wang"],
       "year": 2025,
       "arxiv_id": "2502.08966",
       "relevance": "Structure-based defense separating control and data channels, cutting injection success to under 2%."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Benchmark for indirect prompt injection in tool-augmented LLM agents; provides attack templates used as baselines."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Foundational work demonstrating indirect prompt injection attacks on LLM-integrated applications, including data exfiltration."
     },
     {
       "title": "AI agents that matter",
       "authors": ["Sayash Kapoor", "Benedikt Stroebl", "Zachary S Siegel", "Nitya Nadgir", "Arvind Narayanan"],
       "year": 2024,
       "arxiv_id": "2407.01502",
       "relevance": "Critique of AI agent evaluation practices; relevant to methodological quality in agentic AI research."
     },
     {
       "title": "Jatmo: Task-specific fine-tuning for robust prompt injection defense",
       "authors": ["Jonathan Piet", "Yicheng Zhang", "Yang Liu"],
       "year": 2023,
       "arxiv_id": "2309.13756",
       "relevance": "Defense approach using synthetic teacher-generated data to reduce injection rates from 87% to below 0.5%."
     },
     {
       "title": "TaskShield: Runtime verification for task-aligned LLM agents",
       "authors": ["Xinyu Jia", "Yicheng Zhang", "Yang Liu"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Runtime defense strategy enforcing security policies during inference to reduce indirect attacks."
     },
     {
       "title": "Extracting training data from large language models",
       "authors": ["Nicholas Carlini", "Florian Tramer", "Eric Wallace"],
       "year": 2021,
       "relevance": "Foundational work on training data extraction from LLMs; related to the data exfiltration threat studied in this paper."
     },
     {
       "title": "Instruction hierarchy: Enhancing LLM robustness against conflicting instructions",
       "authors": ["Eric Wallace", "Yicheng Zhang", "Yang Liu"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Hierarchical instruction model training LLMs to prioritize high-privilege commands; relevant defense strategy."
     },
     {
       "title": "Can LLMs separate instructions from data? And what do we even mean by that?",
       "authors": ["Egor Zverev", "Sahar Abdelnabi", "Soroush Tabesh", "Mario Fritz", "Christoph H Lampert"],
       "year": 2024,
       "arxiv_id": "2403.06833",
       "relevance": "Fundamental analysis of the instruction-data separation problem underlying prompt injection vulnerabilities."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Security practitioners can apply these attack patterns to test their own LLM agents, and the defense evaluations provide actionable guidance for deploying banking agents."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "That prompt injection works is not surprising, but the finding that passwords are harder to extract alone than when bundled with other data challenges the intuition that requesting more data is harder."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Directly demonstrates that simple, unsophisticated attacks can cause LLM agents to exfiltrate personal banking data, with no defense fully preventing leakage in the expanded evaluation."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "No major controversy or direct challenge to specific companies, though the finding that all tested defenses fail on expanded tasks could generate discussion."
     },
     "demo_ability": {
       "score": 1,
       "justification": "AgentDojo is publicly available and the attack prompts are fully specified, but the extended dataset is not yet released and there is no standalone demo."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Tests well-known models (GPT-4o, Claude 3.5 Sonnet, Llama) but the research lab (University of Zurich) is not a major AI brand."
     }
   }
 }