{"id":"88fb87e7-1924-4401-b839-844b3727ad54","arxiv_id":"2508.02312","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":2.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A survey of data security risks in LLMs that organizes threats, defenses, and evaluation datasets, with notable factual errors in its tables.","lead":"This preprint reviews data security risks for large language models, including data poisoning, prompt injection, hallucination, prompt leakage, and bias. It organizes current defenses and datasets, which is useful for researchers and practitioners choosing tools and benchmarks, though several entries in the tables are inaccurate.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The survey's value depends on faithful secondary summaries, yet core tables and Section 4.2 contain demonstrable citation/description errors; the 'comprehensive overview' claim is therefore not currently secure.","rationale":"The paper is a survey; its contribution is not a new algorithm or theorem but an organized, reliable map of the literature. The abstract's 'comprehensive overview' and 'reviews current defense strategies' claims can only be true if the summaries of cited work are faithful. The Reader found specific errors, and the text confirms the pattern: Table 3's Jigsaw/ECHR swap is not arguable—'legal text deviations' is a description of ECHR, and the Jigsaw dataset is a toxicity/comment dataset—and the Burns et al. [7] entry under RLHF contradicts the reference's own title and abstract. Eq. (1) in Section 3.2 is internally inconsistent: the condition x in X is always true for an input space, so the piecewise behavior is undefined; it should be x in X_t or an explicit trigger characterization. These are load-bearing because they affect the core taxonomy and dataset directory, not peripheral prose. They are also easily correctable, so the appropriate disposition is the same CONDITIONAL verdict the Reader gave, not a rejection. No independent formal verification or reproducible code exists for the survey, so the cited sources are the only evidence base; that makes source fidelity the main risk. The Reader and I agree on this weakest assumption, and the recommended verdict remains unchanged.","tokens_in":20688,"tokens_out":4617,"duration_ms":55886,"concrete_test":"Perform a full citation-to-content audit of Tables 1-3: open each cited reference and verify (a) the method or attack category, (b) the evaluated model, and (c) the dataset named in the row; for Table 3, check the Jigsaw and ECHR descriptions by looking up those datasets in the cited survey [20] or their public releases. Flag every row where the cited paper does not mention the assigned method or dataset. If any core-table row fails, extend the same standard to all rows; if the error rate is nonzero, the 'comprehensive overview' claim should be qualified and the tables corrected.","verdict_should_be":"UNCHANGED","load_bearing_attack":"For the central claim—a comprehensive, reliable survey of LLM data security risks and defenses—to hold, every taxonomy row, defense entry, and dataset recommendation must faithfully summarize its cited source. That condition currently fails in the most-used artifacts. Table 3 swaps Jigsaw and ECHR: Jigsaw is described as ECHR legal-case data and ECHR as Jigsaw online-review data, with mismatched URLs. Table 2 places Burns et al. [7] (unsupervised latent-knowledge discovery) under RLHF, and Section 4.2 compounds this by attributing the same point to 'Perez et al.' The virtual-prompt-injection equation (Eq. 1) is garbled: it tests x in X, which is trivially true for an input space, instead of membership in the trigger set X_t, so it does not define the claimed behavior. Section 5 also appears to assign datasets to references that do not support them, such as 'English Gigaword [69]' for a defense paper whose own table lists CIFAR/TinyImageNet data. These are not cosmetic typographical issues; they occur in exactly the tables a reader would use to select datasets or defenses. A survey whose guidance is demonstrably wrong in several core entries cannot yet be called comprehensive or reliable, so the central claim is conditionally unsupported pending a source-level verification pass.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This survey paper proposes to offer a comprehensive overview of data security risks in large language models, covering data poisoning, prompt injection, hallucination, prompt leakage, and bias; reviews defense strategies (adversarial training, RLHF, data augmentation); and provides a categorized catalog of datasets for evaluating robustness and security, together with future research directions. The paper is organized around a risk taxonomy (Section 3), a defense taxonomy (Section 4), a dataset table (Section 5), and a set of forward-looking recommendations (Section 6). Its central claim, stated in the abstract, is that it provides a reliable and comprehensive synthesis of these threats and defenses for researchers and practitioners.","tokens_in":20887,"tokens_out":4067,"duration_ms":45211,"significance":"If the factual content were verified and corrected, this survey would fill a useful niche: it explicitly organizes LLM-specific data-centric threats (poisoning, prompt injection, hallucination, prompt leakage, bias) alongside defenses and evaluation datasets, with tables that could serve as a quick reference. The paper makes no original derivations, so its value rests entirely on the fidelity of its secondary summaries and the accuracy of its citations. The taxonomy itself is reasonable and the coverage of threats is broad. However, the central artifacts—the defense table, the dataset table, and the formal definitions—currently contain demonstrable errors that undermine the reliability of the guidance. The paper does not claim or provide machine-checked proofs or reproducible code; its contribution is a structured literature synthesis, which is exactly where the identified factual errors are most damaging.","major_comments":[{"comment":"Table 3 swaps the descriptions and URLs of Jigsaw and ECHR. The Jigsaw row is described as 'Dataset of cases published by the European Court of Human Rights' with a URL to a counterfactual-data-substitution repository, while the ECHR row is described as 'Dataset by Jigsaw containing online review data' with a URL to a poisoning-defense repository. The ECHR dataset is a legal-case corpus and Jigsaw is a toxic-comment dataset; both the descriptions and the URLs are inconsistent with the actual datasets. Since Table 3 is the primary artifact a reader would use to select a dataset, this error is load-bearing and requires a source-level correction of every row.","section":"Table 3, Section 5"},{"comment":"Table 2 lists Burns et al. [7] ('Discovering latent knowledge in language models without supervision') under the RLHF category, and Section 4.2 states 'As highlighted by Perez et al. [7], RLHF-trained models may retain latent unsafe behaviors...'. Reference [7] is Burns et al., not Perez et al., and it is a probing method for extracting latent knowledge, not an RLHF approach or a claim about RLHF-trained models per se. This is not a cosmetic citation slip: it misattributes a substantive claim about RLHF limitations and conflates a probing technique with a training paradigm, thereby misinforming the reader about the defense taxonomy.","section":"Table 2, Section 4.2"},{"comment":"The formal definition of virtual prompt injection is incorrect as written. The equation states M(x) = response to x⊕p if x∈X, and response to x otherwise, where X is defined as the natural language instruction space. Since every input x is in X by definition, the condition is trivially true and the specification reduces to M(x) = response to x⊕p for all inputs, which is not what VPI describes. The condition should be membership in the trigger instruction subset X_t (e.g., x∈X_t), as described in the preceding paragraph. The current formulation garbles the core definition of the threat.","section":"Section 3.2, Eq. (1)"},{"comment":"Several dataset-to-reference assignments in Section 5 are not supported by the cited papers. For example, 'English Gigaword [69]' is listed as a dataset for the defense paper [69] (Wen et al., 'Is adversarial training really a silver bullet...'), but that paper's own table (also reproduced in this survey's Table 2) reports CIFAR-10, CIFAR-100, and TinyImageNet, not English Gigaword. Similarly, 'AQuA [76]' is attributed to [76], a prompt-injection attack paper whose reported datasets in Table 1 are GSM8K, web-based QA, and SQuAD2.0, not AQuA. These mismatches indicate that the dataset-recommendation layer of the survey is unreliable and needs verification against the primary sources.","section":"Section 5, Table 3"}],"minor_comments":[{"comment":"The phrase 'commutable LLMs and a commutable groundtruth function' should likely be 'computable' rather than 'commutable'.","section":"Section 3.3"},{"comment":"The sentence 'Because it is not feasible to list all possible instructions, X_t can be used to define X_t' is circular and appears to be a typo; it should say that X_t is used to define the trigger scenario.","section":"Section 3.2"},{"comment":"Several entries in Table 1 are garbled, for example 'SuSuper-NaturalInstructions' and the concatenation of dataset names and metrics; the table should be reformatted so that each column is legible.","section":"Table 1"},{"comment":"The citation 'Perez et al. [7]' should be corrected to the actual author(s) of reference [7] (Burns et al.), or replaced with the intended source on latent unsafe behaviors; the reference list should be checked for year consistency ([7] is arXiv 2212.03827).","section":"Section 4.2"},{"comment":"The prose in Section 5 uses bracket references that are inconsistent with the dataset rows; for example, the text lists 'Jigsaw [67], [63], [45]' and 'ECHR [20]' while Table 3 assigns different references to these datasets. Please reconcile the text and table.","section":"Section 5"},{"comment":"The survey does not report a systematic search strategy or inclusion criteria for selecting the surveyed papers; adding a short methodology paragraph would help substantiate the 'comprehensive' claim.","section":"Section 1"}],"recommendation":"major_revision","confidential_remarks":"The paper's core contribution—its taxonomy and dataset/defense tables—is useful in principle, but the number and location of citation and factual errors (Table 2, Table 3, Eq. (1), Section 5) suggest that the manuscript has not undergone a careful source-verification pass. I would advise the editor to require a full audit of every table row and citation against the cited papers before any acceptance decision. The survey's scope and organization are appropriate for the venue, but the reliability of its secondary summaries is currently the deciding factor."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this survey is a decent first draft that needs a thorough fact-check before anyone should rely on it. The structure is fine and the high-level taxonomy is sensible, but the tables and a definition contain demonstrable errors.\n\nWhat's new: not much--it's a survey, no new attacks or defenses. What it does well: it gives a clear narrative around five threat categories (data poisoning, prompt injection, hallucination, prompt leakage, bias) and three defense families, with references to the major work. The future-directions section is generic but reasonable. I liked the attempt to formalize VPI and PLeak, even though one of those formalizations is botched.\n\nThe soft spots are real. Table 3 swaps Jigsaw and ECHR, both in the descriptions and the URLs. Table 2 places Burns et al. (unsupervised latent-knowledge detection) under RLHF, and the text then attributes the same point to 'Perez et al.' Eq. (1) defines the backdoor trigger as x∈X instead of x∈X_t, which makes it vacuous. Section 5 assigns English Gigaword to [69], a paper that actually reports CIFAR/TinyImageNet, and pairs Jigsaw with references that never use it. These aren't typo-level nuisances; they're in the exact places a reader would go to select a dataset or understand a defense. Also, no search methodology or inclusion criteria are reported, so 'comprehensive' is doing a lot of work without supporting evidence.\n\nTo be fair, the problems are clerical rather than conceptual. The narrative sections read as competent summaries, the taxonomy is defensible, and the citations are broad. If the authors did a careful source-level pass and fixed the equations, this could become a useful entry point for newcomers and policymakers. The paper doesn't pretend to offer new results, so its value is entirely in the fidelity of its summaries--and that fidelity is currently not good enough.\n\nWho'd benefit: someone who wants a quick map of the field and can cross-check the details, not someone who needs a reliable reference. It deserves a serious referee: the topic is timely, survey quality matters, and the errors are correctable. I'd send it to review, but insist on major revision before acceptance--and ask the referee to spot-check at least half the table entries.\n\nMy call: accept for peer review with heavy revision, and don't cite it until the corrected version is out.","headline":"A useful survey skeleton whose core tables and one formal definition have multiple demonstrable errors; correctable, but not citable in current form.","tokens_in":21470,"tokens_out":4935,"would_cite":false,"duration_ms":52208,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This survey argues that the data-security risks of large language models can be organized into five threat families — data poisoning, prompt injection, hallucination, prompt leakage, and bias — and that current defenses fall into three…","keywords":["large language models","data security","data poisoning","prompt injection","hallucination","prompt leakage","bias","defense strategies"],"falsifier":"Check Table 3 against the cited sources: Jigsaw is a toxicity and online-comment dataset, while ECHR contains European Court of Human Rights legal cases, so a reader who finds these descriptions swapped, or who finds Burns et al. [7] filed under RLHF in Table 2, has concrete evidence that the survey's dataset and defense summaries cannot be trusted as a guide.","tokens_in":20441,"feed_emoji":"🛡️","tokens_out":3289,"duration_ms":39956,"temperature":0.7,"pith_summary":"The paper is a survey that tries to give researchers, practitioners, and policymakers a structured map of how data can compromise large language models. It claims that five threat families — data poisoning, prompt injection, hallucination, prompt leakage, and bias — cover the main data-centric risks, and that defenses cluster into adversarial training, reinforcement learning from human feedback, and data augmentation. It also categorizes evaluation datasets by domain and intended use, and it sketches future directions such as secure model updates, explainability-driven defenses, and governance frameworks. A sympathetic reader would take the paper as a practical orienting guide: a taxonomy to name a threat, a menu of defenses to counter it, and a dataset directory to test it.","feed_headline":"Five data threats can corrupt any LLM's output","feed_subtitle":"A survey sorts poisoning, prompt injection, hallucination, leakage, and bias into one map, with defenses and datasets.","key_machinery":"The organizing machinery is a lifecycle-stage taxonomy: the paper assigns each data-security risk to the phase of the LLM pipeline where it enters — collection, preprocessing, training, fine-tuning, or deployment — and maps defense strategies to those phases. Two formalized examples carry the technical detail: a virtual-prompt-injection definition that characterizes a backdoored model as responding to trigger inputs as if a virtual prompt had been appended, and a prompt-leakage reconstruction equation in which adversarial queries and a post-processing function combine to approximate the hidden system prompt. Together, these give the survey's taxonomy a concrete, checkable form rather than a purely descriptive list.","core_discovery":"The central claim is that LLM data security is best understood by locating threats along the model lifecycle, from training-data collection through preprocessing, fine-tuning, and user interaction. The paper's taxonomy treats data poisoning and prompt injection as deliberate manipulations, hallucination as a failure mode that can be triggered or amplified by bad data, prompt leakage as an information-exposure risk, and bias as a harm inherited from skewed corpora. For defenses, it groups methods into adversarial training (hardening the model against manipulated inputs), RLHF (aligning behavior with human preferences), and data augmentation (rebalancing or diversifying training data), and it evaluates each family's strengths and limitations. The paper also compiles a table of datasets used to attack or defend LLMs, organized by domain, and concludes that the field needs standardized evaluation metrics, traceable data provenance, and continual security verification.","pith_inferences":["The boundary of the taxonomy is contestable: hallucination is treated here as a data-security risk, but one could argue it is primarily a capability limitation that bad data merely exploits, and the paper does not defend that classification against alternatives.","The dataset table's reliability is load-bearing for the survey's practical value; if entries misattribute datasets to domains or swap descriptions, the guidance to researchers would actively mislead, which suggests an immediate verification pass on every table row.","The formal prompt-leakage reconstruction framework could be extended into a defense metric: measuring how closely a post-processing function can reconstruct a system prompt would quantify leakage risk across model families.","A natural testable extension is applying the same lifecycle taxonomy to multimodal LLMs, where poisoning and injection can enter through image or audio tokens as well as text."],"forward_implications":["A practitioner facing a suspect LLM output can use the taxonomy to hypothesize which lifecycle stage was compromised — training data, fine-tuning data, or live prompt input.","Choosing a defense strategy becomes a triage decision: adversarial training for input-level manipulation, RLHF for alignment and hallucination reduction, and data augmentation for bias mitigation.","The dataset directory gives a starting point for benchmarking a new defense, with domain-appropriate attack and defense sets for movie, news, social, book, study, and research scenarios.","If the survey's framing is adopted, future work on LLM security will likely organize itself around provenance tracking and standardized robustness benchmarks rather than isolated attack reports.","The identified research gaps — secure model updates, explainability-driven monitoring, and governance frameworks — define a concrete agenda for the field."],"supporting_citations":[{"why":"Supplies the working definition of data poisoning as intentional manipulation of training data to disrupt model decisions.","marker":"[15]"},{"why":"Defines prompt injection and documents the model's sensitivity to escape and delimiter characters that the survey's prompt-injection section builds on.","marker":"[42]"},{"why":"Introduces the goal-hijacking and prompt-leaking distinction that anchors the survey's prompt-injection and prompt-leakage categories.","marker":"[52]"},{"why":"Provides the intrinsic-extrinsic hallucination dichotomy and the argument that hallucination is an inevitable limitation of LLMs.","marker":"[71]"},{"why":"Serves as the bias survey that grounds the paper's definitions of social bias and data selection bias.","marker":"[20]"},{"why":"Supplies the adversarial-training saddle-point formulation and the classic robustness baseline the defense section relies on.","marker":"[44]"},{"why":"Offers the variant of adversarial training that targets data poisoning, a key evidence point for the defense's utility.","marker":"[21]"},{"why":"Defines the RLHF training procedure that the survey presents as the main alignment-based defense.","marker":"[49]"},{"why":"Describes FairFlow, the counterfactual data augmentation method that the data-augmentation defense section centers on.","marker":"[63]"},{"why":"Demonstrates instruction-tuning data poisoning, which the survey repeatedly cites as a concrete threat model.","marker":"[67]"}],"fun_headline_variants":["Survey maps five data threats to LLM security","LLM data defenses: adversarial training, RLHF, augmentation","Data poisoning, injection, and bias: a survey of LLM risks","Combating data attacks on LLMs: survey and datasets","LLM data security: threats, defenses, and evaluation datasets"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The survey's usefulness depends on its secondary summaries of the cited literature being faithful and representative, yet no systematic search or inclusion criteria are reported, and several specific entries are inaccurate.","fun_headline_variants_meta":{"raw":{"variants":["Survey maps five data threats to LLM security","LLM data defenses: adversarial training, RLHF, augmentation","Data poisoning, injection, and bias: a survey of LLM risks","Combating data attacks on LLMs: survey and datasets","LLM data security: threats, defenses, and evaluation datasets"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000396,"raw_usage":{"total_tokens":2065,"prompt_tokens":925,"completion_tokens":1140,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":541,"completion_tokens_details":{"reasoning_tokens":1056}},"tokens_in":541,"tokens_out":1140,"duration_ms":14308,"temperature":1.0,"reasoning_tokens":1056,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T05:01:09.122836+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Check Table 3 against the cited sources: Jigsaw is a toxicity and online-comment dataset, while ECHR contains European Court of Human Rights legal cases, so a reader who finds these descriptions swapped, or who finds Burns et al. [7] filed under RLHF in Table 2, has concrete evidence that the survey's dataset and defense summaries cannot be trusted as a guide.","supporting_citations":[{"cited_title":"2633– 2650","cited_arxiv_id":null,"evidence_quote":"Supplies the working definition of data poisoning as intentional manipulation of training data to disrupt model decisions."},{"cited_title":"Biasandfairness in large language models: A survey","cited_arxiv_id":null,"evidence_quote":"Serves as the bias survey that grounds the paper's definitions of social bias and data selection bias."},{"cited_title":"Towards deep learning models resistant to adversarial attacks","cited_arxiv_id":null,"evidence_quote":"Supplies the adversarial-training saddle-point formulation and the classic robustness baseline the defense section relies on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Describes FairFlow, the counterfactual data augmentation method that the data-augmentation defense section centers on."},{"cited_title":"Say the rightthingright: Ethicsissuesinnaturallanguagegenerationsystems, in: ProceedingsoftheFirstACLWorkshoponEthicsinNaturalLan- guage Processing, pp","cited_arxiv_id":null,"evidence_quote":"Demonstrates instruction-tuning data poisoning, which the survey repeatedly cites as a concrete threat model."}],"review_version":1}