ai-research-survey

scan.json (32083B)

---

 {
   "paper": {
     "title": "TopicAttack: An Indirect Prompt Injection Attack via Topic Transition",
     "authors": ["Yulin Chen", "Haoran Li", "Yuexin Li", "Yue Liu", "Yangqiu Song", "Bryan Hooi"],
     "year": 2025,
     "venue": "Conference on Empirical Methods in Natural Language Processing",
     "arxiv_id": "2507.13686",
     "doi": "10.48550/arXiv.2507.13686"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "TopicAttack achieves >90% attack success rate in most configurations across 10 LLMs (small, large, and closed-source) and 3 datasets, significantly outperforming prior prompt injection methods. The method fabricates multi-turn conversational transitions that gradually shift the topic from benign content toward the injected instruction, reducing injection abruptness. Even under strong fine-tuning-based defenses (StruQ, SecAlign), TopicAttack maintains high ASR (e.g., 92% on SecAlign for Qwen2-7B) where all other attacks drop below 10%. Attention analysis shows TopicAttack shifts model attention from original to injected instructions, correlating with attack success.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper states 'Code is publicly available at https://github.com/LukeChen-go/topicattack' in footnote 1."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available datasets: Inj-SQuAD and Inj-TriviaQA from Chen et al. (2025b), and InjectAgent from Zhan et al. (2024) released under the MIT License. The underlying QA datasets (SQuAD, TriviaQA) are public benchmarks."
       },
       "environment_specified": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A specifies: 'PyTorch 2.1.0, single NVIDIA H100 GPU, do_sample=false, max_new_tokens=256, max_length=8192.' Key generation parameters and framework version are provided."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. While code is released and implementation details are in Appendix A, there is no 'Reproducing Results' section or explicit workflow to replicate the experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1-11 are reported as point estimates (e.g., '87.89%' ASR) with no confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims TopicAttack 'significantly outperforms' baselines throughout, but no statistical significance tests (t-test, bootstrap, etc.) are reported. All comparisons are based on raw ASR value differences."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Tables report absolute ASR values for all methods under all conditions, providing clear context for the magnitude of differences. The text also contextualizes specific comparisons, e.g., 'TopicAttack achieves ASR of 90.67%... while other attacks are below 10%' (Section 5.3)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The datasets contain 900 samples each (Inj-SQuAD, Inj-TriviaQA) and 510 samples (InjectAgent), but no justification for these sizes or power analysis is provided."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported. Results appear to be single-run evaluations with no indication of stability across runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Five prompt-engineering attack baselines (Naive, Ignore, Escape, Fakecom, Combined) and two gradient-based attacks (AutoDAN, GCG) are compared. Five defense methods (None, Sandwich, Spotlight, StruQ, SecAlign) are also evaluated."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include recent methods: Fakecom (Willison 2023), Combined (Liu et al. 2024b), GCG (Zou et al. 2023), AutoDAN (Zhu et al. 2023), and defenses StruQ (Chen et al. 2024a) and SecAlign (Chen et al. 2025a). These represent the current state of the art."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Multiple ablation studies are conducted: reminding prompt removal (Table 9), identifier influence (Table 10), injection position (Table 11), and multi-turn dialogue scenarios (Table 7). Section 5.5 is dedicated to ablation experiments."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "Only ASR (attack success rate) is used as the evaluation metric. While perplexity and attention ratios are analyzed for explanatory purposes (Section 5.6, Figures 2-3), these are not evaluation metrics."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated. Chatbot attacks are evaluated by checking if target content appears in the response; agent attacks by checking if the target tool was invoked. No human evaluation of attack quality or naturalness is performed."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No explicit dev/test split is described. The method's hyperparameters (m=5 transition turns, prompt templates) appear to be set without a separate validation set. It is unclear whether any design decisions were informed by the evaluation data."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by model size (small/large/closed-source), dataset (Inj-SQuAD/Inj-TriviaQA/InjectAgent), defense method (5 defenses), and scenario (chatbot/agent/multi-turn). Tables 1-7 provide comprehensive breakdowns."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not analyze cases where TopicAttack fails. For example, on Llama3-8B with SecAlign, ASR drops to 0.44% (Table 1), but no analysis of why the attack fails in these cases is provided."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 10 shows that changing identifiers on the Fakecom attack to TopicAttack's format actually decreases ASR in several configurations (e.g., Llama3-8B Inj-SQuAD drops from 84.67% to 55.44%). The paper notes 'changing the identifiers alone does not consistently improve ASR. In some settings, performance improves, while in others it decreases significantly.'"
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'ASR over 90% in most cases, even when various defense methods are applied.' The tables show TopicAttack achieves >90% in the majority of configurations across chatbot and agent scenarios, supporting this claim. The 'state-of-the-art' claim is supported by TopicAttack achieving the highest ASR in nearly all tested configurations."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims about component contributions are supported by controlled ablation studies: reminding prompt removal (Table 9) and identifier changes (Table 10) use single-variable manipulation. The attention analysis (Section 5.6) provides a mechanistic explanation for why the method works."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title and claims frame the method broadly as 'An Indirect Prompt Injection Attack' without explicitly bounding generalization. While the evaluation covers 10 models and 3 datasets, the paper does not state what settings or models the results might NOT generalize to."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper attributes TopicAttack's success to smooth topic transitions and attention manipulation (Section 5.6) but does not consider alternative explanations, such as whether the longer context itself (more tokens from fabricated conversation) contributes to the effect, or whether the multi-turn format alone is sufficient."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "ASR directly measures attack success — whether the target content appears in the response (chatbot) or the target tool is invoked (agent). The paper's claims match the granularity of its measurements without broader framing beyond what was measured."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Open-source models are identified by specific release names (e.g., 'Llama3-8B-Instruct', 'Qwen2-7B-Instruct'), but closed-source models are given only as marketing names ('GPT-4o-mini', 'GPT-4o', 'GPT-4.1') without API version or snapshot dates. The schema requires specific versions for API-based models."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The transition construction prompts for both chatbot and agent scenarios are provided in full in Appendix C. The reminding prompt is given verbatim in Section 4.2. Case study examples showing complete constructed injections appear in Appendix D."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A reports: 'do_sample=false, max_new_tokens=256, max_length=8192.' The number of transition turns is fixed at m=5 (Section 4.2). Key generation parameters are documented."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "TopicAttack is a prompt construction method, not an agentic system. No scaffolding, tool use, or workflow orchestration is part of the attack methodology itself."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 describes the datasets: Inj-SQuAD and Inj-TriviaQA are derived from SQuAD and TriviaQA with injected instructions for phishing, advertisement, and propaganda (900 samples each). InjectAgent uses the 'Direct Harm' scenario with 510 samples. The transition prompt construction process is described in Section 4.2 and Appendix C."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "A dedicated 'Limitations' section appears after the Conclusion, discussing three specific limitations of the work."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section mentions study-specific concerns: inability to fine-tune models exceeding 70B parameters (limiting defense evaluation to prompt-based methods for large models), the need to design specific prompts for transition generation, and the inability to provide formal mathematical proof of the method's properties."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show or what settings are excluded. There is no discussion of models, application types, or attack scenarios where TopicAttack might not work."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Only aggregate ASR percentages are reported in tables. No per-example attack results, model outputs, or raw data files are mentioned as available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 describes the data sources: Inj-SQuAD and Inj-TriviaQA from Chen et al. (2025b) derived from two QA datasets with injected instructions, and InjectAgent from Zhan et al. (2024) under the 'Direct Harm' scenario. Sample sizes are stated (900 and 510)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. All data comes from standard public benchmarks (SQuAD, TriviaQA, InjectAgent)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The attack construction pipeline is documented in Section 4.2: benign content Tb is concatenated with a fabricated transition Tt (generated by GPT-4o with m=5 turns) and the injected instruction Iinj with a reminding prompt. The formula Tinj = Tb ⊕ Tt ⊕ Iinj is explicit."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The Acknowledgment section states: 'Dr. Haoran Li, JC STEM Early Career Research Fellow, supported by The Hong Kong Jockey Club Charities Trust.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: National University of Singapore and HKUST. The authors evaluate third-party models (Meta's Llama, Alibaba's Qwen, OpenAI's GPT), not their own institution's products."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "The Hong Kong Jockey Club Charities Trust is a charitable organization with no financial interest in prompt injection attack research outcomes."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial interests declaration is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates the effectiveness of prompt injection attacks, not model knowledge or capability on benchmarks. The models are tested for vulnerability to attacks, not for correct answers to questions."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the paper tests attack success (whether models follow injected instructions), not model knowledge. Train/test overlap in the traditional contamination sense does not apply."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates attack transferability across models and defenses, not model performance on knowledge benchmarks. Contamination is structurally inapplicable."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in any experiments."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The Ethical Consideration section discusses adherence to ACM Code of Ethics and ACL Code of Conduct but no IRB is needed."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost is reported. The method requires GPT-4o API calls to generate transition prompts for each attack instance, but this cost is not quantified. Victim model inference costs are also unreported."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Appendix A mentions a single NVIDIA H100 GPU but does not state total GPU hours, API spend, or total runtime. The cost of generating 900+ transition prompts via GPT-4o is not quantified."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds or seed sensitivity analysis. Results appear to be single-run with do_sample=false (deterministic generation for open-source models), but no seed variation is tested."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The exact number of experimental runs is not stated. It is unclear whether results are from single runs or averaged."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "The transition turn count is fixed at m=5 without reporting any search over alternatives. No hyperparameter search budget or method is described."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "Key design choices (m=5 turns, specific prompt templates, role identifiers) appear fixed without justification for why these configurations were selected or any systematic comparison of alternatives."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes hundreds of comparisons across 10 models, 5 defenses, 3 datasets, and 6+ attack methods, but no correction for multiple comparisons is applied."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement all baseline attack methods themselves but do not acknowledge potential self-comparison bias. Lucic et al. (2018) showed that authors' implementations of baselines systematically underperform."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "TopicAttack requires additional GPT-4o API calls to generate multi-turn transition prompts, making it computationally more expensive than simple baselines (Naive, Ignore, Escape). This cost disparity is not discussed or controlled for in the comparison."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether ASR on these specific datasets (derived from SQuAD/TriviaQA with synthetic injected instructions) actually reflects real-world attack effectiveness against deployed LLM applications."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding confound exists — all attack methods are prompt-based and evaluated under identical model configurations. The comparison is between attack strategies, not between scaffolded systems."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The SQuAD and TriviaQA datasets are from 2016 and 2017 respectively, well before the training data of all tested models. Models may have seen these QA pairs during training, which could affect their behavior when the same content appears as 'retrieved data.' This is not discussed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup could leak information about the expected response. For example, the benign data content directly answers the user's question, which could interact with the model's training on the same QA pairs."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether examples in Inj-SQuAD/Inj-TriviaQA share structural similarities that could inflate apparent generalization. Examples from the same QA dataset may share topical or structural patterns."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are applied. No analysis of whether models' familiarity with SQuAD/TriviaQA content affects attack outcomes."
       }
     }
   },
   "claims": [
     {
       "claim": "TopicAttack achieves state-of-the-art ASR over 90% in most configurations, outperforming all baseline attack methods.",
       "evidence": "Tables 1-6 show TopicAttack achieving the highest ASR across 10 models, 3 datasets, and 5 defense configurations. For example, on Qwen2-7B with Inj-SQuAD (Table 1), TopicAttack achieves 99.22% (None), 68.56% (Sandwich), 99.44% (Spotlight), 99.22% (StruQ), and 92.00% (SecAlign).",
       "supported": "strong"
     },
     {
       "claim": "TopicAttack maintains high effectiveness even under strong fine-tuning-based defenses (StruQ, SecAlign) where other attacks fail.",
       "evidence": "Tables 1-2 show that on StruQ/SecAlign defenses, baseline attacks drop to near 0% while TopicAttack achieves up to 98.67% (StruQ) and 92.00% (SecAlign) on Qwen2-7B. On Llama3.1-8B with SecAlign, TopicAttack achieves 90.67% vs <5% for all baselines.",
       "supported": "strong"
     },
     {
       "claim": "The reminding prompt is crucial for attack effectiveness, especially under the Sandwich defense.",
       "evidence": "Table 9 shows removing the reminding prompt causes ASR drops of 20-25 percentage points under Sandwich defense across models (e.g., 79.78% → 55.89% on Llama3-8B Inj-SQuAD, 72.67% → 46.78% on Llama3.1-8B Inj-TriviaQA).",
       "supported": "strong"
     },
     {
       "claim": "TopicAttack lowers the perplexity of the injected instruction, indicating smoother topic integration.",
       "evidence": "Figure 2 shows the average log perplexity distribution of injected instructions: TopicAttack consistently has lower perplexity than Fakecom and Naive across Llama3-8B, Llama3.1-8B, and Qwen2-7B.",
       "supported": "moderate"
     },
     {
       "claim": "Higher attention ratio on injected vs. original instructions correlates with higher attack success, and TopicAttack achieves the highest ratio.",
       "evidence": "Figure 3 shows the distribution of injected/original attention score ratios under No Defense, StruQ, and SecAlign. TopicAttack achieves substantially higher ratios than Fakecom and Naive across all three defense settings.",
       "supported": "moderate"
     },
     {
       "claim": "TopicAttack's effectiveness transfers to closed-source models including GPT-4o and GPT-4.1.",
       "evidence": "Tables 4 and 6 show TopicAttack achieves 99.78-100% ASR without defense and 60.44-99.56% under defenses on GPT-4o-mini, GPT-4o, and GPT-4.1, significantly outperforming all baselines on both chatbot and agent scenarios.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No uncertainty quantification across hundreds of comparisons",
       "detail": "All results are single-run point estimates with no confidence intervals, error bars, or variance measures. With 900 binary outcomes per cell, even 95% CI would be informative (±~2pp). The paper makes claims of 'significantly outperforms' without any statistical tests."
     },
     {
       "flag": "Unequal compute comparison with baselines",
       "detail": "TopicAttack requires GPT-4o API calls to generate multi-turn transition prompts for each attack instance, while baseline attacks (Naive, Ignore, Escape) are simple prompt templates. This gives TopicAttack a substantial compute advantage that is never discussed or accounted for."
     },
     {
       "flag": "Self-implementation of all baselines",
       "detail": "The authors implement all baseline attack methods themselves rather than using official implementations. This introduces potential self-comparison bias where baselines may be implemented suboptimally, as documented by Lucic et al. (2018)."
     },
     {
       "flag": "No analysis of failure modes",
       "detail": "On Llama3-8B with SecAlign, TopicAttack achieves only 0.44% ASR (Table 1), nearly complete failure. This is never analyzed or discussed. Understanding why the attack fails against this specific model-defense combination could reveal important limitations."
     }
   ],
   "cited_papers": [
     {
       "title": "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection",
       "authors": ["Kai Greshake", "Sahar Abdelnabi", "Shailesh Mishra", "Christoph Endres", "Thorsten Holz", "Mario Fritz"],
       "year": 2023,
       "relevance": "Foundational work on indirect prompt injection attacks against LLM-integrated applications, directly motivates TopicAttack."
     },
     {
       "title": "Evaluating the instruction-following robustness of large language models to prompt injection",
       "authors": ["Zekun Li", "Baolin Peng", "Pengcheng He", "Xifeng Yan"],
       "year": 2023,
       "relevance": "Evaluates LLM vulnerability to prompt injection, establishing the instruction-following robustness problem."
     },
     {
       "title": "InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents",
       "authors": ["Qiusi Zhan", "Zhixiang Liang", "Zifan Ying", "Daniel Kang"],
       "year": 2024,
       "arxiv_id": "2403.02691",
       "relevance": "Provides the InjectAgent benchmark dataset used for agent attack evaluation in this paper."
     },
     {
       "title": "StruQ: Defending against prompt injection with structured queries",
       "authors": ["Sizhe Chen", "Julien Piet", "Chawin Sitawarin", "David Wagner"],
       "year": 2024,
       "arxiv_id": "2402.06363",
       "relevance": "Fine-tuning-based defense method that TopicAttack is evaluated against; represents strong adversarial training defense."
     },
     {
       "title": "SecAlign: Defending against prompt injection with preference optimization",
       "authors": ["Sizhe Chen", "Arman Zharmagambetov", "Saeed Mahloujifar", "Kamalika Chaudhuri", "David Wagner", "Chuan Guo"],
       "year": 2025,
       "arxiv_id": "2410.05451",
       "relevance": "DPO-based defense that represents the strongest tested defense against prompt injection; TopicAttack is the first method to substantially bypass it."
     },
     {
       "title": "Defending against indirect prompt injection attacks with spotlighting",
       "authors": ["Keegan Hines", "Gary Lopez", "Matthew Hall", "Federico Zarfati", "Yonatan Zunger", "Emre Kiciman"],
       "year": 2024,
       "arxiv_id": "2403.14720",
       "relevance": "Proposes the Spotlight defense using special tokens to mark data regions, one of the key defense baselines evaluated."
     },
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Formalizes the Combined attack baseline and provides systematic benchmarking framework for prompt injection research."
     },
     {
       "title": "The instruction hierarchy: Training LLMs to prioritize privileged instructions",
       "authors": ["Eric Wallace", "Kai Xiao", "Reimar Leike", "Lilian Weng", "Johannes Heidecke", "Alex Beutel"],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Proposes training LLMs to distinguish instruction privilege levels as a defense against prompt injection."
     },
     {
       "title": "AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunovic", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "Provides a dynamic evaluation environment for prompt injection in LLM agent settings, relevant to the agent attack scenario."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Proposes the GCG gradient-based attack method, used as a baseline comparison for TopicAttack."
     },
     {
       "title": "Can indirect prompt injection attacks be detected and removed?",
       "authors": ["Yulin Chen", "Haoran Li", "Yuan Sui", "Yufei He", "Yue Liu", "Yangqiu Song", "Bryan Hooi"],
       "year": 2025,
       "arxiv_id": "2502.16580",
       "relevance": "Constructs the Inj-SQuAD and Inj-TriviaQA datasets used for chatbot attack evaluation in this paper."
     },
     {
       "title": "Machine against the RAG: Jamming retrieval-augmented generation with blocker documents",
       "authors": ["Avital Shafran", "Roei Schuster", "Vitaly Shmatikov"],
       "year": 2024,
       "arxiv_id": "2406.05870",
       "relevance": "Demonstrates attacks against RAG systems via document poisoning, a related attack vector to indirect prompt injection."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Security researchers and red-teamers can use the released code to test LLM applications against topic-transition prompt injection attacks."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The idea that gradual topic transitions improve attack success is intuitive; the surprising element is the magnitude of improvement over existing methods against strong defenses."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates that even the strongest current defenses (StruQ, SecAlign) can be bypassed with >90% success, raising serious concerns about LLM application security."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Implies current defenses are inadequate but presents this as incremental research without framing it as a major controversy."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code is released on GitHub and uses standard open-source models, so researchers can reproduce the attacks with moderate setup effort."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "From NUS and HKUST — respected but not household-name AI labs. Tests against GPT-4o adds some brand recognition."
     }
   }
 }