ai-research-survey

scan.json (29201B)

---

 {
   "paper": {
     "title": "The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents",
     "authors": [
       "Feiran Jia",
       "Tong Wu",
       "Xin Qin",
       "Anna Squicciarini"
     ],
     "year": 2024,
     "venue": "Annual Meeting of the Association for Computational Linguistics",
     "arxiv_id": "2412.16682",
     "doi": "10.48550/arXiv.2412.16682"
   },
   "scan_version": 3,
   "active_modules": [
     "experimental_rigor",
     "data_leakage"
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "Task Shield reduces attack success rate to 2.07% on GPT-4o against the strongest indirect prompt injection attack (Important Instructions) while maintaining 69.79% task utility, significantly outperforming four baseline defenses on the AgentDojo benchmark. The approach reframes agent security from detecting harmful content to enforcing task alignment, verifying that every agent action contributes to user-specified goals. Results are consistent across GPT-4o and GPT-4o-mini, though evaluation is limited to a single benchmark and model family with single-run experiments.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL or code archive is provided for the Task Shield implementation. The paper references the AgentDojo benchmark repository but does not release its own code."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation uses the publicly available AgentDojo benchmark (released under MIT License at https://github.com/ethz-spylab/agentdojo). Baseline results are also drawn from AgentDojo's published data."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Specific model versions are stated (Appendix C.2) and temperature=0.0 is mentioned, but no requirements.txt, Dockerfile, or environment specification is provided for reproducing the Task Shield framework."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The paper describes the algorithm (Algorithm 1) and prompts (Appendix D) but does not provide runnable scripts or a README with reproduction commands."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1-3 are point estimates (percentages) with no confidence intervals, error bars, or uncertainty measures."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "Claims of outperformance (e.g., Task Shield vs. baselines) are based on comparing raw percentages without any statistical significance tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Tables 1-2 report both absolute values for Task Shield and baselines (e.g., ASR 2.07% vs. 47.69% no-defense, utility 69.79% vs. 50.08%), providing sufficient context to assess effect magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'one trial per task' (Section 5) with no justification for this sample size or discussion of power analysis. No rationale is given for why a single trial is sufficient."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 5 states 'one trial per task' — single-run results with no variance, standard deviation, or any spread measure reported."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Four baseline defenses are compared: Data Delimiting, PI Detector, Repeat Prompt (Prompt Sandwiching), and Tool Filter (Section 5.1, Table 2)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "All baselines are from 2024 papers: Struq (Chen et al., 2024), Palisade (Kokkula et al., 2024), Learn Prompting (2024), and AgentDojo's Tool Filter (Debenedetti et al., 2024)."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "Task Shield has three components (instruction extraction, alignment check, feedback generation) but no ablation study is conducted to measure individual component contributions."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three evaluation metrics are used: Clean Utility (CU), Utility under Attack (U), and Attack Success Rate (ASR), as defined in Section 5.1."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated through the AgentDojo benchmark. No human evaluation of Task Shield's outputs or decisions is performed."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss any development/test split. It is unclear whether the prompts and threshold ε were designed or tuned using the same AgentDojo tasks used for final evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Tables 1-3 provide per-suite breakdowns across Travel, Workspace, Banking, and Slack task suites, in addition to overall results."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No qualitative error analysis or examples of where Task Shield fails are provided. The Limitations section mentions potential failure modes (weaker models, adaptive attacks) abstractly but does not examine specific failure cases."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "Every comparison shows Task Shield performing well. No experiments that didn't work, ablations that hurt performance, or abandoned approaches are reported."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 2.07% ASR and 69.79% utility on GPT-4o, which match Table 2's Overall column for Task Shield under Important Instructions attack. The claim of 'significantly outperforming existing defenses' is supported by the comparative data."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The primary causal claim is that Task Shield reduces ASR. The experimental design—same model, same benchmark, same attack, with and without the defense—constitutes controlled single-variable manipulation adequate for this causal claim."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Defend Against Indirect Prompt Injection in LLM Agents' broadly, but results are limited to one benchmark (AgentDojo), one model family (GPT), and three attack types. The Limitations section acknowledges this but the title and framing are broader than what was tested."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations for the results are discussed. For example, the paper does not consider whether the low ASR could be due to the specific attack formulations in AgentDojo rather than Task Shield's general effectiveness."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures ASR and utility directly on benchmark tasks. These are the same metrics used by the benchmark and directly map to the paper's claims about defense effectiveness and utility preservation. No proxy gap exists."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C.2 states exact model versions: 'gpt-4o-2024-05-13', 'gpt-4o-mini-2024-07-18', and 'gpt-3.5-turbo-0125'."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt texts are provided in Appendix D: task extraction prompt (Figure 4), content checker prompt (Figure 5), tool call checker prompt (Figure 6), and feedback prompts (Figure 7)."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "Appendix C.2 reports temperature=0.0 for Task Shield and 'default configurations for the models' for the agent, but does not specify top-p, max tokens, or other sampling parameters. 'Default configurations' is insufficiently specific."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The Task Shield framework is described in detail in Section 4: three components (instruction extraction, alignment check, feedback generation), Algorithm 1 for core processing, and Section 4.2 describes interaction with the LLM agent system at each message level."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation uses the AgentDojo benchmark in its standard configuration. Section 5.1 and Appendix C.2 describe the setup, including that baseline results come from AgentDojo's published data. No custom preprocessing was applied."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' section appears after the Conclusion, discussing reliance on LLMs, vulnerability to adaptive attacks, and resource constraints limiting evaluation scope."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section identifies specific threats: (1) performance degradation with weaker language models, (2) susceptibility to adaptive attacks that could fool the alignment checker, and (3) experiments restricted to a single benchmark and model family due to cost."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section explicitly states 'restricted our experiments to a single benchmark and a single model family' and identifies vulnerability to adaptive attacks as an unaddressed threat."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (individual task results, model outputs, alignment scores) is released. Only aggregated percentages are reported in the tables."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 describes the benchmark (AgentDojo with four task suites), three attack types, and the evaluation protocol including one trial per task. Model versions are specified in Appendix C.2."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Evaluation is entirely automated using the AgentDojo benchmark."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not document the full pipeline from running experiments to producing the final tables. It is unclear how the aggregated percentages were computed from individual task results, or how edge cases (e.g., partial task completion) were handled."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding sources or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Pennsylvania State University, Princeton University, and California State University, Long Beach. These are academic institutions with no apparent commercial conflict."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. The absence of a funding disclosure statement does not confirm absence of funding."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement appears in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "Model versions are specified (gpt-4o-2024-05-13) but no training data cutoff date is stated. It is unknown whether GPT-4o's training data includes AgentDojo-related content."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether GPT-4o's training data might include AgentDojo tasks or similar content that could inflate utility scores."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "AgentDojo was published in June 2024 (arXiv:2406.13352). GPT-4o-2024-05-13 predates this, but early benchmark versions or related content could have been in training data. No contamination analysis is provided."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. Evaluation is entirely automated using the AgentDojo benchmark."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "Task Shield adds multiple LLM calls per message (instruction extraction + alignment checking). The Limitations section mentions 'high cost of LLM queries' but no quantification of cost, latency, or token overhead is provided."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, API costs, or hardware specifications are reported for the experiments."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 5 states 'one trial per task' — single-run results with no seed sensitivity analysis."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 5 explicitly states 'with one trial per task,' making the number of runs clear."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is described. The threshold ε and prompt designs appear to be fixed without reporting any tuning process or search budget."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of how the Task Shield configuration (prompts, threshold) was selected or whether alternatives were tried."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Multiple comparisons are made across 4 task suites, 5 defense methods, 3 attack types, and 3 models, but no correction for multiple comparisons is applied."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement and evaluate their own defense against baselines whose results come from AgentDojo's published data. No acknowledgment of potential self-comparison bias in their implementation."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Task Shield adds multiple LLM calls per message compared to simpler defenses (e.g., Repeat Prompt adds only prompt text). This compute overhead is not quantified or compared."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AgentDojo's task suites and attack formulations are representative of real-world indirect prompt injection threats. The benchmark is accepted at face value."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "All defense comparisons use the same base model (GPT-4o), isolating the defense mechanism as the variable. The scaffold (defense) IS the thing being tested, and the experimental design keeps other variables constant."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of temporal leakage. GPT-4o (May 2024) predates AgentDojo's publication (June 2024), but earlier versions or related content could have been in training data."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the AgentDojo evaluation setup leaks information that would not be available in real deployment scenarios."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of independence between AgentDojo's task suites or whether tasks within a suite share structural similarities that could bias results."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is applied."
       }
     }
   },
   "claims": [
     {
       "claim": "Task Shield reduces attack success rate to 2.07% on GPT-4o against the Important Instructions attack while maintaining 69.79% utility under attack.",
       "evidence": "Table 2, Overall column: Task Shield achieves ASR 2.07% and U 69.79% vs. no-defense ASR 47.69% and U 50.08% on GPT-4o.",
       "supported": "moderate"
     },
     {
       "claim": "Task Shield significantly outperforms all baseline defenses in the security-utility tradeoff.",
       "evidence": "Table 2 and Figure 3 Pareto front analysis show Task Shield in the desirable lower-right region (low ASR, high utility). Next-best baseline (Tool Filter) achieves 6.84% ASR with 56.28% utility.",
       "supported": "moderate"
     },
     {
       "claim": "Task Shield maintains consistent effectiveness across both GPT-4o and GPT-4o-mini architectures.",
       "evidence": "Table 2 shows Task Shield achieving 2.07% ASR on GPT-4o and 2.23% ASR on GPT-4o-mini, with utility roughly matching no-defense baselines for both models.",
       "supported": "moderate"
     },
     {
       "claim": "Task alignment is a novel and orthogonal perspective that reframes agent security from preventing harmful actions to ensuring task alignment.",
       "evidence": "Section 3 formalizes task alignment with definitions of ContributesTo relation and task instruction alignment condition. The framework is distinct from existing rule-based, spotlighting, and authentication approaches.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "Single run per task",
       "detail": "All results are from a single trial per task with no variance reporting. Given the stochastic nature of LLM outputs (even at temperature 0.0 due to batching effects), single-run results may not be stable."
     },
     {
       "flag": "No ablation study",
       "detail": "Task Shield has three distinct components (instruction extraction, alignment check, feedback generation) but no ablation study measures individual component contributions. It is unclear which components drive the defense effectiveness."
     },
     {
       "flag": "Single benchmark and model family",
       "detail": "Evaluation is limited to AgentDojo with GPT-4o/4o-mini/3.5-turbo. Generalization to other benchmarks (e.g., InjecAgent's full suite) and model families (Claude, Llama) is unknown."
     },
     {
       "flag": "No code released",
       "detail": "The Task Shield implementation is not released, making independent verification impossible. While prompts are provided in the appendix, the full pipeline cannot be reproduced."
     },
     {
       "flag": "Cost overhead not quantified",
       "detail": "Task Shield adds multiple LLM calls per message (instruction extraction + alignment checking for every assistant message and tool output). The computational and financial cost overhead is never quantified, despite the Limitations section acknowledging 'high cost of LLM queries.'"
     },
     {
       "flag": "LLM-based defense evaluated on LLM-based attacks",
       "detail": "Using the same model (GPT-4o) for both the Task Shield defense and the agent being defended creates a potential circular dependency. The paper does not discuss whether the defense's effectiveness is model-specific or generalizable."
     }
   ],
   "cited_papers": [
     {
       "title": "Agentdojo: A dynamic environment to evaluate attacks and defenses for llm agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunović", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "arxiv_id": "2406.13352",
       "relevance": "Primary evaluation benchmark for indirect prompt injection attacks and defenses in tool-integrated LLM agents."
     },
     {
       "title": "The instruction hierarchy: Training llms to prioritize privileged instructions",
       "authors": ["Eric Wallace", "Kai Xiao", "Reimar Leike", "Lilian Weng", "Johannes Heidecke", "Alex Beutel"],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Training-time defense establishing instruction privilege hierarchy for LLMs, used as foundational concept in Task Shield's formalization."
     },
     {
       "title": "Struq: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Baseline defense method using data delimiting to isolate tool outputs from injected instructions."
     },
     {
       "title": "Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Foundational work demonstrating indirect prompt injection attacks against real-world LLM-integrated applications."
     },
     {
       "title": "Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Benchmark for indirect prompt injection in tool-integrated LLM agents; one of the three attack types evaluated."
     },
     {
       "title": "Defending against indirect prompt injection attacks with spotlighting",
       "authors": ["Keegan Hines", "Gary Lopez", "Matthew Hall", "Federico Zarfati", "Yonatan Zunger", "Emre Kiciman"],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Defense method using source spotlighting to distinguish trusted from untrusted content in LLM inputs."
     },
     {
       "title": "Fath: Authentication-based test-time defense against indirect prompt injection attacks",
       "authors": ["Jiongxiao Wang", "Fangzhou Wu", "Wendi Li", "Jinsheng Pan", "Edward Suh", "Z. Morley Mao", "Muhao Chen", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2410.21492",
       "relevance": "Test-time defense using hash-based authentication tags to filter harmful responses from indirect prompt injection."
     },
     {
       "title": "Jatmo: Prompt injection defense by task-specific finetuning",
       "authors": ["Julien Piet", "Maha Alrashed", "Chawin Sitawarin", "Sizhe Chen", "Zeming Wei", "Elizabeth Sun", "Basel Alomair", "David Wagner"],
       "year": 2023,
       "arxiv_id": "2312.17673",
       "relevance": "Training-time defense against prompt injection via task-specific model finetuning."
     },
     {
       "title": "Prompt injection attack against llm-integrated applications",
       "authors": ["Yi Liu", "Gelei Deng", "Yuekang Li", "Kailong Wang"],
       "year": 2023,
       "arxiv_id": "2306.05499",
       "relevance": "Early characterization of prompt injection attacks against LLM-integrated applications."
     },
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Formal framework for benchmarking prompt injection attacks and defenses in various scenarios."
     },
     {
       "title": "Palisade – prompt injection detection framework",
       "authors": ["Sahasra Kokkula", "G Divya"],
       "year": 2024,
       "arxiv_id": "2410.21146",
       "relevance": "Prompt injection detection classifier used as a baseline defense in the evaluation."
     },
     {
       "title": "Instructional segment embedding: Improving llm safety with instruction hierarchy",
       "authors": ["Tong Wu", "Shujian Zhang", "Kaiqiang Song", "Silei Xu"],
       "year": 2024,
       "arxiv_id": "2410.09102",
       "relevance": "Training-time defense improving LLM safety through instruction hierarchy embeddings."
     },
     {
       "title": "GuardAgent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning",
       "authors": ["Zhen Xiang", "Linzhi Zheng", "Yanjie Li", "Junyuan Hong"],
       "year": 2024,
       "arxiv_id": "2406.09187",
       "relevance": "Guard agent approach to safeguarding LLM agents using knowledge-enabled reasoning."
     },
     {
       "title": "Ignore previous prompt: Attack techniques for language models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Early work on prompt injection attack techniques; one of the three attack types evaluated in this paper."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Task Shield is a practical test-time defense that could wrap existing LLM agents, but no code is released for immediate use."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The reframing from 'detect harm' to 'enforce task alignment' is a modest conceptual shift but not deeply contrarian."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that without defense, indirect prompt injection succeeds 47.69% of the time on GPT-4o agents, raising real security concerns."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no conflict with other researchers or companies."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code released, no demo available, no pip-installable tool."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Uses GPT-4o (well-known model) but authors are from Penn State, Princeton, and CSULB — not a famous AI lab."
     }
   }
 }