ai-research-survey

scan.json (28777B)

---

 {
   "paper": {
     "title": "Toward Trustworthy Agentic AI: A Multimodal Framework for Preventing Prompt Injection Attacks",
     "authors": [
       "Toqeer Ali Syed",
       "Mishal Ateeq Almutairi",
       "Mahmoud Abdel Moaty"
     ],
     "year": 2025,
     "venue": "arXiv.org",
     "arxiv_id": "2512.23557",
     "doi": "10.48550/arXiv.2512.23557"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "The paper proposes a Cross-Agent Multimodal Provenance-Aware Defense Framework that integrates text sanitization, visual sanitization, provenance tracking, and output validation for multi-agent LLM systems. The framework reports 94% detection accuracy for multimodal prompt injection (vs 52–66% for baselines), 70% reduction in cross-modal trust leakage, and 96% task accuracy retention on benign inputs. However, the evaluation dataset, sample sizes, and experimental methodology are almost entirely unspecified, making these numbers impossible to verify or reproduce.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No source code repository, GitHub link, or archive is provided anywhere in the paper. The implementation is described in Section IV but no code is released."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "No evaluation dataset is released or even named. The paper does not specify what attack samples or benign inputs were used for evaluation, nor provide any download links."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Section IV mentions Python, RoBERTa, PaddleOCR, CLIP, Redis, GPT-4o-mini, and LLaVA/BLIP-2, but no version numbers, requirements.txt, Dockerfile, or dependency specifications are provided. This is insufficient to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. Section IV describes the architecture and integration but not how to set up and run the experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Figure 3 shows only point estimates for detection accuracy, trust leakage, and task accuracy retention. No confidence intervals, error bars, or uncertainty measures are reported anywhere."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims the proposed method outperforms all baselines (Section V.A: 94% vs 52–66%) but provides no statistical significance tests. Comparisons are made by simply presenting two numbers side by side."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports raw performance values with baseline context: 94% detection vs 52/61/66% baselines, trust leakage reduced from 0.24 to 0.07 (explicitly stated as '70% reduction'), and 96% vs 94% task retention. This provides enough context to understand effect magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No sample sizes are stated at all. The paper does not specify how many attack samples, benign inputs, or evaluation instances were used. There is no power analysis or justification for the evaluation scale."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or any spread measure is reported. All results appear as single point estimates with no indication of run-to-run variability."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Section V compares against four baselines: keyword filtering, safety fine-tuning, post-hoc output filtering, and single VLM baseline. Results are shown in Figure 3."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "The baselines are generic technique categories (keyword filtering, fine-tuning, output filtering) rather than specific contemporary defense systems. No particular implementations or recent defense papers are cited as baselines. The paper does not compare against any named state-of-the-art prompt injection defense system."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "The system has four distinct components (Text Sanitizer, Visual Sanitizer, Provenance Ledger, Output Validator) but no ablation study is conducted to measure the individual contribution of each component."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three evaluation metrics are used: detection accuracy (%), cross-modal trust leakage, and task accuracy retention (%). All three are reported in Section V and shown in Figure 3."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is conducted. All evaluation is automated. For a security defense system, human review of false positives/negatives or adversarial robustness testing by human red-teamers would be relevant but is not included."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No mention of train/test splits, held-out data, or any data partitioning strategy. The evaluation dataset itself is not described, so it is impossible to determine whether proper held-out testing was used."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": false,
         "justification": "Only aggregate numbers are reported. No breakdown by attack type (text vs image vs metadata vs agent-to-agent), attack difficulty, or modality is provided despite the multimodal nature of the framework."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No failure cases are shown or discussed. The paper does not analyze what types of attacks the system misses (the 6% not detected) or when the sanitization fails."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "No negative results are reported. Every metric shows the proposed system outperforming all baselines. No failed approaches, ablations that hurt performance, or configurations that did not work are mentioned."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims 'multimodal injection detection accuracy is significantly enhanced' (94% vs 52–66%), 'cross-agent trust leakage is minimized' (0.07 vs 0.24), and 'agentic execution pathways become stable' (96% task retention). These qualitative claims are directionally supported by the numbers in Section V, though the evidence quality is low."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes causal claims throughout — e.g., the framework 'enhances' detection, sanitization 'prevents' injection propagation, trust masking 'ensures' safety. Without ablation studies or controlled experiments isolating individual components, these causal claims are not adequately justified. The comparison against baselines does not control for the added complexity of the multi-component system."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Trustworthy Agentic AI' broadly. The abstract generalizes to 'agentic AI systems' and 'LangChain or GraphChain-style workflows.' No evaluation dataset is specified, so it is impossible to know what attack types, modalities, or system configurations were actually tested. No generalization bounds are stated."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No alternative explanations for the results are discussed. The paper does not consider whether the performance gains might be due to the multi-stage processing overhead, the specific attack types chosen, or other confounds rather than the proposed trust-aware architecture."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures detection accuracy, trust leakage, and task retention — and frames these as exactly what they are. There is no proxy gap; the claims match the granularity of the measurements."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Section IV.A mentions 'GPT-4o-mini via OpenAI API', 'LLaVA/BLIP-2 via Hugging Face Transformers', and 'RoBERTa-based pattern detector' but provides no specific version numbers, snapshot dates, or model sizes for any of these."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "No prompts or system instructions are provided. The paper describes what the agents do algorithmically (Algorithms 1–4) but does not show the actual prompt text sent to GPT-4o-mini or other LLMs."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameters are reported — no trust score thresholds, detection thresholds, temperature settings, attention mask parameters, or any tunable values. The algorithms reference trust scores and thresholds abstractly without specifying concrete values."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The multi-agent scaffolding is described in substantial detail. Section III provides algorithms for each agent (Algorithms 1–4), Figure 1 shows the architecture, Figure 2 shows the sequence diagram, Section IV describes the integration points with LangChain/GraphChain, and Table II lists required modifications."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "No description of how the evaluation data was prepared, what attack samples were used, how benign inputs were selected, or any preprocessing steps applied to the test data."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no limitations section. The paper goes directly from the Discussion (Section V.D) to the Conclusion (Section VI) without acknowledging any limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed anywhere in the paper."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No scope boundaries are stated. The paper does not explicitly state what was not tested, what attack types are excluded, or what limitations apply to the generality of the results."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data is available. Neither the evaluation dataset nor the raw experimental results are released."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "The data collection procedure is not described at all. The paper does not specify what attack samples were used, where they came from, how many there were, or what benign inputs were included."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "While there are no human participants, the evaluation data source is completely unspecified. The paper does not describe how attack samples or test cases were selected or constructed, making the sample provenance unknown."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "No data pipeline is documented. There is no description of how evaluation data was processed from collection to analysis."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The Acknowledgment section states: 'The author acknowledges Islamic University of Madinah University's support for ongoing research in AI security and trust assurance.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: Islamic University of Madinah (two authors) and Arab Open University-Bahrain (one author). The paper does not evaluate a commercial product, so there is no undisclosed product affiliation."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "The funder (Islamic University of Madinah) is an academic institution with no apparent financial stake in the outcome of the research on prompt injection defense."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates a defense framework against prompt injection attacks, not a pre-trained model's capability on a benchmark. Contamination of model training data is not the relevant concern."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests a defense system rather than evaluating model knowledge on a benchmark. Train/test overlap in the LLM sense is not applicable."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests a defense framework, not a model's inherent capabilities on a benchmark. Benchmark contamination is not the relevant threat."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost or latency is reported despite the system adding multiple sanitization layers (RoBERTa, OCR, CLIP, two LLM calls) to every request. The overhead of this multi-agent pipeline is never quantified."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No computational budget is stated. The paper does not report GPU hours, API costs, training time for the RoBERTa classifier, or total resources consumed."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity. All results appear to be from a single run."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. It is unclear whether results are from one run or averaged across multiple."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is described. Trust thresholds, detection parameters, and other tunable values are not discussed, let alone searched over."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of how the reported configuration was selected. No validation set or configuration selection procedure is described."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed at all, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own system against baseline categories (not specific implementations). They do not acknowledge the bias of implementing and evaluating their own system, nor that their implementation of baselines may be suboptimal."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No comparison of compute budgets across methods. The proposed framework uses multiple neural models (RoBERTa, CLIP, GPT-4o-mini) plus Redis, while baselines like keyword filtering are far cheaper. This compute asymmetry is never discussed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The evaluation benchmark/dataset is not even specified, let alone analyzed for construct validity. The paper does not discuss whether its three metrics adequately capture real-world defense effectiveness."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The scaffold IS the thing being tested — the paper evaluates its multi-agent defense framework as a bundled system."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of temporal leakage. The RoBERTa classifier may have been trained on data that includes the test attack patterns, but this is never addressed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of feature leakage. The evaluation setup is so poorly described that it is impossible to assess whether the defense system had access to information not available in realistic deployment."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether training and test data for the classifiers are independent. The data pipeline is not described at all."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is used or discussed."
       }
     }
   },
   "claims": [
     {
       "claim": "The proposed framework achieves 94% multimodal prompt injection detection accuracy, outperforming keyword filtering (52%), post-hoc output filtering (61%), safety fine-tuning (66%), and single VLM (78%).",
       "evidence": "Section V.A and Figure 3 show comparative bar chart. No dataset specification, sample sizes, or statistical tests accompany the numbers.",
       "supported": "weak"
     },
     {
       "claim": "The framework reduces cross-modal trust leakage from 0.24 to 0.07, a 70% reduction.",
       "evidence": "Section V.B states this figure and attributes it to trust-aware attention masking and provenance metadata propagation. No dataset, sample size, or statistical validation is provided.",
       "supported": "weak"
     },
     {
       "claim": "The framework retains 96% task accuracy on benign multimodal tasks.",
       "evidence": "Section V.C reports 96% retention vs 94% for the single VLM baseline. No details on what benign tasks were used or how accuracy was measured.",
       "supported": "weak"
     },
     {
       "claim": "The framework provides end-to-end security for LangChain and GraphChain environments through dual-stage sanitization.",
       "evidence": "Section III describes the architecture with pre-agent and pre-LLM sanitization stages, Algorithms 1-4, and Table II lists required framework modifications. This is a design claim supported by the architecture description but not empirically validated for end-to-end security.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "Phantom evaluation dataset",
       "detail": "The paper reports precise performance numbers (94%, 0.07, 96%) but never specifies what evaluation dataset was used, how it was constructed, how many samples it contains, or what types of attacks are included. Results appear without any verifiable experimental setup."
     },
     {
       "flag": "No sample sizes anywhere",
       "detail": "Not a single sample size is reported in the entire paper. The reader cannot assess whether these results come from 10 or 10,000 test cases."
     },
     {
       "flag": "No error bars or statistical tests",
       "detail": "All results are single point estimates with no uncertainty quantification. Claims of superiority over baselines are made by comparing bare numbers without any statistical testing."
     },
     {
       "flag": "Excessive self-citation",
       "detail": "Six of sixteen references (37.5%) are by the first author (Syed): refs [8]-[13]. These are primarily other 'Agentic AI Framework' papers by the same group on topics like finance, disabilities, cloudburst prediction, and inventory management — none directly related to prompt injection defense."
     },
     {
       "flag": "No ablation study despite multi-component system",
       "detail": "The framework has four distinct agent components plus a provenance ledger, yet no ablation is performed to determine which components contribute to the reported gains."
     },
     {
       "flag": "Claims outrun evidence",
       "detail": "The title promises 'Trustworthy Agentic AI' and the abstract claims the framework 'enhances the establishment of secure, understandable and reliable agentic AI systems.' The evidence is a single bar chart with three metrics and no dataset specification."
     },
     {
       "flag": "Generic baselines, not specific systems",
       "detail": "Baselines are technique categories (keyword filtering, fine-tuning, output filtering) rather than specific implementations of state-of-the-art defense systems. It is unclear how these baselines were implemented or configured."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper has no limitations, threats to validity, or scope boundaries section. Every result is presented as unambiguously positive."
     },
     {
       "flag": "Results appear too clean",
       "detail": "The proposed method dominates on every single metric with no trade-offs, failure modes, or edge cases discussed. A 94% detection rate with 96% benign retention and minimal leakage, all without any negative results, is suspiciously clean for a first prototype."
     }
   ],
   "cited_papers": [
     {
       "title": "More than you've asked for: A comprehensive analysis of prompt injection attacks in large language models",
       "authors": ["T. Greshake"],
       "year": 2023,
       "arxiv_id": "2302.12173",
       "relevance": "Foundational work on indirect prompt injection attacks in LLMs, directly relevant to the survey's coverage of PI attack surfaces."
     },
     {
       "title": "Red teaming large language models",
       "authors": ["T. Zhuo", "Y. Wang"],
       "year": 2023,
       "arxiv_id": "2309.07890",
       "relevance": "Red-teaming methodology for evaluating LLM safety vulnerabilities, relevant to the survey's assessment of AI safety evaluation methods."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["A. Zou"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Demonstrates universal adversarial prompts that transfer across models and modalities, a key attack vector in the LLM security landscape."
     },
     {
       "title": "Prompt injection defense mechanisms in large language models: A survey",
       "authors": ["C. Xu"],
       "year": 2024,
       "relevance": "Survey of PI defense mechanisms including sandboxing, filtering, and RL guardrails — directly relevant to the survey's coverage of defense taxonomy."
     },
     {
       "title": "Multimodal Prompt Injection Attacks against Vision-Language Models",
       "authors": ["L. Wolff", "L. Shen", "M. Faezi", "N. Akhtar", "A. Mian"],
       "year": 2024,
       "arxiv_id": "2403.04888",
       "relevance": "Demonstrates adversarial instructions encoded in images via steganography and metadata manipulation, extending PI attacks to the visual modality."
     },
     {
       "title": "MM-SafetyBench: Evaluating Safety Risks of Multimodal Large Language Models with Generated Prompts",
       "authors": ["Z. Liu", "R. Zhang", "J. Xu", "D. Lin"],
       "year": 2024,
       "arxiv_id": "2402.12323",
       "relevance": "Safety benchmark for multimodal LLMs showing VLMs fail to identify harmful visual prompts, relevant to benchmarking methodological quality."
     },
     {
       "title": "Visual Prompt Injection Attacks and Defenses for Vision-Language Models",
       "authors": ["Y. Liu", "Z. Han", "B. Li", "N. Z. Gong"],
       "year": 2024,
       "arxiv_id": "2404.00562",
       "relevance": "Evaluates visual prompt injection exploiting vision encoder / language decoder vulnerabilities, relevant to multimodal AI safety research."
     },
     {
       "title": "Exploring interpretability and safety of large language models under adversarial prompting",
       "authors": ["S. Casper", "D. Hadfield-Menell"],
       "year": 2023,
       "arxiv_id": "2305.13636",
       "relevance": "Taxonomy of prompt-based attack types and evasion/mitigation strategies, relevant to understanding the adversarial prompting landscape."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "Describes LangChain/GraphChain integration conceptually but releases no code, no library, and no working implementation a practitioner could use."
     },
     "surprise_contrarian": {
       "score": 0,
       "justification": "Confirms the widely-held view that multimodal defenses and provenance tracking are needed for agentic AI security — no surprising or contrarian findings."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Addresses prompt injection in multi-agent AI systems, a real and growing security concern that resonates with AI safety discourse."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no critique of specific companies or products, no conflict angle."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code released, no demo, no package — nothing for anyone to try."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "From Islamic University of Madinah and Arab Open University-Bahrain — not well-known AI research labs."
     }
   }
 }