ai-research-survey

scan.json (32746B)

---

 {
   "paper": {
     "title": "WebInject: Prompt Injection Attack to Web Agents",
     "authors": [
       "Xilong Wang",
       "John Bloch",
       "Zedian Shao",
       "Yuepeng Hu",
       "Shuyan Zhou",
       "Neil Zhenqiang Gong"
     ],
     "year": 2025,
     "venue": "Conference on Empirical Methods in Natural Language Processing",
     "arxiv_id": "2505.11717",
     "doi": "10.18653/v1/2025.emnlp-main.104"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "WebInject proposes an optimization-based prompt injection attack that perturbs raw webpage pixel values to mislead MLLM-based web agents into performing attacker-specified actions. The attack achieves 96-97% attack success rate across five open-source MLLMs (UI-TARS, Phi-4, Llama-3.2, Qwen-2.5, Gemma-3), vastly outperforming heuristic webpage-based baselines (max 34.5% ASR) and screenshot-based attacks (0% ASR when naively applied to raw pixels). A key technical contribution is training a neural network to approximate the non-differentiable webpage-to-screenshot mapping, enabling gradient-based optimization of perturbations constrained to be imperceptible (ℓ∞ ≤ 16/255).",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository URL is provided in the paper. No mention of code release on GitHub, Zenodo, or any archive."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper constructs 10 webpage datasets (5 real, 5 synthetic) but does not provide download links or mention releasing them. The synthetic webpages were generated via GPT-4-Turbo prompts shown in Fig. 9, but the actual generated webpages are not released."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions using selenium, PIL, ImageCms, Canvas API, PyTorch, and an NVIDIA RTX A6000 GPU, but provides no requirements.txt, Dockerfile, or detailed environment specification with library versions."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "Algorithm 1 provides pseudo-code for the attack and Fig. 3 shows monitor simulation code, but there are no step-by-step reproduction instructions, README, or runnable scripts."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Table 1 and all other result tables report single ASR values averaged across datasets with no confidence intervals, error bars, or uncertainty measures."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims WebInject 'significantly outperforms' baselines (e.g., 0.972 vs 0.062 for Gemma-3) but provides no statistical significance tests — comparisons are based solely on comparing raw ASR numbers."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports ASR values for both WebInject and all baselines (Table 1), providing sufficient context to assess effect size. E.g., 'the success rate of our attack is 0.910 higher than the best-performing baseline' for Gemma-3, with baseline ASR of 0.062 vs WebInject ASR of 0.972."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is provided for the choice of 10 webpage datasets, 10 target prompts per webpage, 10 shadow histories, or the number of real webpages per category (ranging from 26 to 51, Table 3). No power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Results are averaged across datasets and presented as single point estimates. No standard deviation, interquartile range, or spread measure is reported across webpages, prompts, or experimental runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 compares WebInject against five baselines: Naive Attack, Context Ignoring, Fake Completion, Combined Attack (all webpage-based), and Screenshot-based attacks. These cover both major categories of prior work."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include EIA (Liao et al., 2025), Pop-up Attack (Zhang et al., 2024), screenshot-based attacks (Aichberger et al., 2025; Zhao et al., 2025), and various textual prompt injection methods. All are from 2024-2025, representing the state of the art."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper includes ablation studies on: number of target monitors (Fig. 2a), perturbation bound ε (Fig. 2b), semantically equivalent user prompts (Table 11), and different target actions (Table 10)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses only Attack Success Rate (ASR) as the evaluation metric. No perceptual quality metrics (SSIM, LPIPS), human detection rates, or other complementary metrics are reported."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is conducted to verify the stealthiness claim. The paper argues perturbations with ℓ∞ ≤ 16/255 are imperceptible based on prior work convention, but no human study confirms this for the specific webpage context."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses separate shadow history sets (for optimization) and user history sets (for evaluation), as described in Section 5.1: 'the shadow history set is used by an attacker to optimize the perturbation, while the user history set is used to evaluate the perturbation.' Semantically equivalent user prompts (Table 11) also test generalization beyond optimization inputs."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Tables 4-9 provide per-dataset breakdowns across all 10 webpage categories (Blog, Commerce, Education, Healthcare, Portfolio × Synthetic/Real) for all attacks and agents."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not analyze the 2-5% of cases where the attack fails. No error analysis, qualitative examples of failures, or discussion of when/why the approach breaks down."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "Every experiment shows WebInject succeeding at high rates. The paper does not report approaches that were tried and failed, alternative formulations that didn't work, or configurations that broke the attack."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims WebInject is 'highly effective and significantly outperforms baselines.' Table 1 supports this with ASR of 0.963-0.975 across all five MLLMs, compared to baselines maxing at 0.345. The abstract's claim about Gemma-3 ('success rate of our attack is 0.910 higher') is supported by Table 1 (0.972 vs 0.062)."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper claims the optimized perturbation δ causes web agents to perform target actions. The experimental design — controlled pixel perturbation via optimization, evaluated on separate user histories and prompts — constitutes controlled single-variable manipulation adequate for this causal claim."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The Limitations section (Section 8) explicitly states: (1) the threat model may not apply to highly trustworthy sites like Amazon, and (2) transferability to closed-source MLLMs was not evaluated. The title 'Prompt Injection Attack to Web Agents' is appropriately scoped."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not consider alternative explanations for why WebInject achieves such high ASR. No discussion of whether model-specific artifacts, dataset properties, or the simplicity of the target actions could explain the uniformly high success rates."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures ASR (exact match of generated action to target action) and claims attack effectiveness. The metric directly measures the intended outcome — whether the agent performs the attacker-specified action — with no proxy gap."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 lists specific model identifiers: 'UI-TARS-7B-SFT', 'Phi-4-multimodal-instruct', 'Llama-3.2-11B-Vision-Instruct', 'Qwen2.5-VL-7B-Instruct', 'Gemma-3-4b-it', with full citations for each."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The meta-prompts used to generate target prompts (Fig. 10) and synthetic webpages (Fig. 9) are provided, but the actual 10 target prompts generated per webpage are not included. The reader cannot reconstruct the exact prompts used in experiments."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 reports: ℓ∞-norm constraint ε = 16/255, learning rate α = 0.3, iterations T = 2,500, mapping neural network training: 16,240 input-output pairs, 200 epochs, learning rate 0.005, batch size 16."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 2 describes the web agent pipeline: the MLLM receives user prompt, resized screenshot, and interaction history, and outputs an action. Table 2 describes the full action space. The pipeline is simple (no complex agentic scaffolding), and the components are fully described."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 documents: real webpages collected via SingleFile extension across 5 categories, synthetic webpages generated by GPT-4-Turbo (100 per category), prompts generated per webpage, monitor simulation via selenium + ICC profiles. Table 3 provides dataset statistics."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 8 is a dedicated 'Limitations' section with substantive discussion of two specific limitations and potential defenses."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 8 identifies specific threats: (1) the assumption of source code modification may not hold for trustworthy sites like Amazon, (2) transferability to closed-source MLLMs was not evaluated due to computational constraints. These are specific to this study."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 8 states specific scope boundaries: only open-source MLLMs tested, attacker must control webpage source code, and transferability to closed-source models is an open question. The threat model (Section 3) also bounds scope."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Neither the webpage datasets, generated prompts, optimized perturbations, nor raw experimental results are made available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 describes data collection: real webpages via SingleFile extension across 5 categories, synthetic webpages via GPT-4-Turbo with the prompt in Fig. 9, monitor simulation via selenium + ICC profiles (Fig. 3)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study evaluates automated attacks against ML models using constructed webpage datasets."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: collect webpages → generate target prompts (Fig. 10) → generate shadow/user histories → train mapping neural networks → optimize perturbation via PGD (Algorithm 1) → evaluate ASR. Fig. 3 shows monitor simulation code."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Section 9 (Acknowledgments) lists NSF grants: 'No. 2414406, 2131859, 2125977, 2112562, 1937787, and 2450935.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All authors are listed as Duke University affiliates with email addresses. They are not affiliated with any of the companies whose models they evaluate."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "NSF is the funder and has no financial interest in whether the attack succeeds or fails. The researchers are independent academic researchers evaluating open-source models."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is included in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates an adversarial attack's ability to manipulate web agents, not a model's learned capability on a benchmark. Whether the model has seen the test webpages is irrelevant to the pixel-perturbation attack mechanism."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — contamination is not a concern because the attack works by optimizing pixel perturbations against the model's parameters, not by exploiting model knowledge of test data."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the attack is optimization-based and does not depend on whether the model has seen the evaluation webpages during training."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in the study. All experiments are automated evaluations of adversarial attacks against ML models."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 12 reports per-target-webpage per-target-monitor training time and GPU memory usage for each MLLM agent, benchmarked on a single NVIDIA RTX A6000 GPU. However, costs are reported as relative additions (Δ + X min, Ω + X GB) over the screenshot-based baseline without stating the baseline's absolute cost."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Table 12 provides relative per-unit costs (e.g., Δ+1.92 min, Ω+1.93 GB compared to screenshot-based attacks) but the total compute budget across all experiments is not stated, and the baseline absolute costs (Δ, Ω) are not given."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds, seed sensitivity analysis, or results across multiple seeds. The optimization involves random initialization of shadow histories and prompt mini-batches, but sensitivity to this randomness is not analyzed."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not state how many times the perturbation optimization was run per target webpage, or whether the reported ASR values reflect single-run or multi-run averages."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Fixed hyperparameters are used (ε=16/255, α=0.3, T=2500) with sensitivity analysis on ε (Fig. 2b) but no description of how these defaults were selected or how many configurations were tried."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The default hyperparameters (ε=16/255, α=0.3, T=2500) are used without justification for why these values were chosen. The ε ablation study (Fig. 2b) shows higher ε gives better ASR, but 16/255 is selected based on a convention from prior adversarial example work, not systematic optimization."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement both their attack and the baselines. They do not acknowledge potential bias from implementing baselines themselves, which Lucic et al. (2018) showed can lead to systematic underperformance of baselines."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Table 12 reports relative compute costs but does not plot or analyze performance as a function of compute budget. The paper does not compare whether baselines would perform better with equivalent compute."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses ASR as the sole measure of attack effectiveness but does not discuss whether exact action matching is the right metric, or whether partial success (e.g., clicking near the target) should be considered. No discussion of construct validity of the evaluation setup."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The evaluation tests bare MLLM inference (prompt + screenshot → action) without complex scaffolding. No scaffolding confound is present."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the open-source MLLMs may have been trained on the real webpages used in evaluation, or whether temporal ordering of model training vs. webpage collection matters."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly separates optimization inputs from evaluation inputs: shadow histories (optimization) vs. user histories (evaluation) are drawn from different random samples. Target prompts vs. semantically equivalent user prompts provide another separation layer (Section 5.1)."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether webpages within the same category share structural properties that could inflate ASR consistency, or whether the synthetic webpages (all generated by GPT-4-Turbo) share artifacts."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is used beyond the train/eval split of histories and prompts."
       }
     }
   },
   "claims": [
     {
       "claim": "WebInject achieves >96% attack success rate across five open-source MLLMs, vastly outperforming all baselines.",
       "evidence": "Table 1 shows ASR of 0.963-0.975 for WebInject across UI-TARS, Phi-4, Llama-3.2, Qwen-2.5, and Gemma-3, compared to a maximum baseline ASR of 0.345 (Fake Completion on Llama-3.2).",
       "supported": "strong"
     },
     {
       "claim": "Screenshot-based attacks completely fail (0% ASR) when perturbations are applied to raw pixel values instead of screenshots.",
       "evidence": "Table 1 shows ASR of 0.000 for screenshot-based attacks across all five MLLMs and all 10 datasets (detailed in Table 9), demonstrating that the webpage-to-screenshot mapping invalidates direct pixel-to-screenshot transfer.",
       "supported": "strong"
     },
     {
       "claim": "WebInject remains effective when user prompts are semantically equivalent but not identical to target prompts.",
       "evidence": "Table 11 shows ASR of 0.871-0.959 across all agents and datasets when using semantically equivalent user prompts, compared to 0.929-0.999 with exact target prompts (Table 4).",
       "supported": "moderate"
     },
     {
       "claim": "The attack generalizes to multiple target action types beyond click, including drag, hotkey, type, scroll, wait, finished, and call_user.",
       "evidence": "Table 10 shows ASR of 0.976-0.993 for various target actions on the synthetic Blog dataset with Phi-4. However, this is only tested on one model and one dataset.",
       "supported": "moderate"
     },
     {
       "claim": "A trained U-Net can approximate the non-differentiable webpage-to-screenshot mapping, enabling gradient-based optimization.",
       "evidence": "The paper trains mapping neural networks per target monitor (Section 4.2) and the resulting high ASR values (Table 1) indirectly demonstrate the approximation is effective, but no direct evaluation of approximation quality (e.g., MSE between predicted and actual screenshots) is reported.",
       "supported": "moderate"
     },
     {
       "claim": "WebInject perturbations are stealthy (imperceptible to users) at ε ≤ 16/255.",
       "evidence": "Fig. 5 shows examples of perturbed webpages at different ε values, and the paper cites prior work convention that ε ≤ 16/255 is generally considered stealthy. However, no human study validates imperceptibility.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "No stealthiness validation with humans",
       "detail": "The paper claims perturbations are stealthy/imperceptible but relies solely on the ℓ∞ ≤ 16/255 convention from prior adversarial example work. No human study is conducted to verify that perturbed webpages are actually indistinguishable from originals in a web browsing context, where users may notice subtle color shifts more easily than in natural images."
     },
     {
       "flag": "No error bars or variance across runs",
       "detail": "All ASR values are single point estimates with no uncertainty quantification. The optimization involves stochastic elements (random mini-batches of prompts and histories), yet the paper does not report variation across runs or seeds."
     },
     {
       "flag": "Uniformly high ASR across all models is suspiciously clean",
       "detail": "ASR ranges from 0.963 to 0.975 across five architecturally diverse MLLMs (Table 1). Such uniformity despite different model architectures, sizes, and training procedures is noteworthy and not discussed."
     },
     {
       "flag": "White-box assumption limits practical applicability",
       "detail": "The attack requires full model parameters (Section 3), which is acknowledged in Section 8 but significantly limits real-world applicability since widely deployed web agents often use closed-source MLLMs (GPT-4V, Claude, Gemini)."
     },
     {
       "flag": "Self-implemented baselines may be disadvantaged",
       "detail": "The authors implement all baseline attacks themselves (Section 5.1). Webpage-based baselines are adapted into a uniform pop-up framework (Fig. 4) which may not represent each baseline's optimal configuration."
     },
     {
       "flag": "Single evaluation metric",
       "detail": "Only ASR (exact action match) is reported. No perceptual quality metrics for stealthiness (SSIM, LPIPS) or partial success measures (e.g., click distance from target) are included."
     }
   ],
   "cited_papers": [
     {
       "title": "Eia: Environmental injection attack on generalist web agents for privacy leakage",
       "authors": ["Zeyi Liao", "Lingbo Mo", "Chejian Xu", "Mintong Kang", "Jiawei Zhang", "Chaowei Xiao", "Yuan Tian", "Bo Li", "Huan Sun"],
       "year": 2025,
       "relevance": "Directly relevant prompt injection attack on web agents that injects HTML elements to trick agents into interacting with malicious elements."
     },
     {
       "title": "Attacking vision-language computer agents via pop-ups",
       "authors": ["Yanzhe Zhang", "Tao Yu", "Diyi Yang"],
       "year": 2024,
       "arxiv_id": "2411.02391",
       "relevance": "Pop-up-based prompt injection attack on vision-language web agents, a key baseline for evaluating WebInject."
     },
     {
       "title": "Attacking multimodal os agents with malicious image patches",
       "authors": ["Lukas Aichberger", "Alasdair Paren", "Yarin Gal", "Philip Torr", "Adel Bibi"],
       "year": 2025,
       "arxiv_id": "2503.10809",
       "relevance": "Screenshot-based adversarial attack on multimodal OS agents, demonstrates adversarial perturbation approach that WebInject improves upon."
     },
     {
       "title": "Formalizing and benchmarking prompt injection attacks and defenses",
       "authors": ["Yupei Liu", "Yuqi Jia", "Runpeng Geng", "Jinyuan Jia", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Foundational work on formalizing prompt injection attacks including the Combined Attack baseline used in WebInject's evaluation."
     },
     {
       "title": "Dissecting adversarial robustness of multimodal lm agents",
       "authors": ["Chen Henry Wu", "Rishi Rajesh Shah", "Jing Yu Koh", "Russ Salakhutdinov", "Daniel Fried", "Aditi Raghunathan"],
       "year": 2025,
       "relevance": "Studies adversarial robustness of multimodal LM agents, directly relevant to understanding vulnerability of MLLM-based web agents."
     },
     {
       "title": "Agentdojo: A dynamic environment to evaluate attacks and defenses for llm agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunović", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "relevance": "Dynamic evaluation framework for attacks and defenses on LLM agents, provides benchmarking infrastructure for agent security research."
     },
     {
       "title": "VisualWebArena: Evaluating multimodal agents on realistic visual web tasks",
       "authors": ["Jing Yu Koh", "Robert Lo", "Lawrence Jang", "Vikram Duvvur", "Ming Chong Lim", "Po-Yu Huang", "Graham Neubig", "Shuyan Zhou", "Ruslan Salakhutdinov", "Daniel Fried"],
       "year": 2024,
       "arxiv_id": "2401.13649",
       "relevance": "Major benchmark for evaluating multimodal web agents, provides evaluation infrastructure relevant to assessing web agent capabilities and vulnerabilities."
     },
     {
       "title": "GPT-4V(ision) is a generalist web agent, if grounded",
       "authors": ["Boyuan Zheng", "Boyu Gou", "Jihyung Kil", "Huan Sun", "Yu Su"],
       "year": 2024,
       "arxiv_id": "2401.01614",
       "relevance": "Foundational work on using vision-language models as web agents with grounding, establishing the paradigm WebInject attacks."
     },
     {
       "title": "A critical evaluation of defenses against prompt injection attacks",
       "authors": ["Yuqi Jia", "Zedian Shao", "Yupei Liu", "Jinyuan Jia", "Dawn Song", "Neil Zhenqiang Gong"],
       "year": 2025,
       "arxiv_id": "2505.18333",
       "relevance": "Evaluates defenses against prompt injection attacks, directly relevant to understanding the defense landscape for attacks like WebInject."
     },
     {
       "title": "Optimization-based prompt injection attack to LLM-as-a-judge",
       "authors": ["Jiawen Shi", "Zenghui Yuan", "Yinuo Liu", "Yue Huang", "Pan Zhou", "Lichao Sun", "Neil Zhenqiang Gong"],
       "year": 2024,
       "relevance": "Optimization-based prompt injection approach applied to LLM judges, shares the optimization methodology with WebInject but in a different domain."
     },
     {
       "title": "DataSentinel: A game-theoretic detection of prompt injection attacks",
       "authors": ["Yupei Liu", "Yuqi Jia", "Jinyuan Jia", "Dawn Song", "Neil Zhenqiang Gong"],
       "year": 2025,
       "relevance": "Prompt injection detection method that the authors note is not applicable to WebInject since it does not inject explicit textual prompts."
     },
     {
       "title": "On the robustness of GUI grounding models against image attacks",
       "authors": ["Haoren Zhao", "Tianyi Chen", "Zhen Wang"],
       "year": 2025,
       "arxiv_id": "2504.04716",
       "relevance": "Studies robustness of GUI grounding models against image-based attacks, a screenshot-based baseline approach compared to WebInject."
     },
     {
       "title": "AdvAgent: Controllable blackbox red-teaming on web agents",
       "authors": ["Chejian Xu", "Mintong Kang", "Jiawei Zhang", "Zeyi Liao", "Lingbo Mo", "Mengqi Yuan", "Huan Sun", "Bo Li"],
       "year": 2024,
       "arxiv_id": "2410.17401",
       "relevance": "Black-box red-teaming approach for web agents, complementary to WebInject's white-box adversarial attack methodology."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Demonstrates a concrete attack vector against deployed web agents, but requires white-box model access and ML expertise to implement."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Adversarial perturbations misleading vision models is well-established; the novel contribution is bridging the webpage-to-screenshot mapping gap, which is technically interesting but not paradigm-shifting."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates a novel attack enabling click fraud, malware downloads, and data theft through imperceptible webpage modifications that hijack autonomous web agents."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Highlights web agent vulnerability but does not target specific products or make controversial claims about the industry."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or tool is released; the attack cannot be tried without reimplementation."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Duke University is reputable but not a marquee AI lab; the tested models (Gemma, Qwen, Llama) are recognizable but not headline products like ChatGPT."
     }
   }
 }