{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2025:7BITF3N774EQTDALYBUWC3BQGJ","short_pith_number":"pith:7BITF3N7","schema_version":"1.0","canonical_sha256":"f85132edbfff09098c0bc069616c303262b37f362c1c07700783b395a4385e08","source":{"kind":"arxiv","id":"2505.18333","version":1},"attestation_state":"computed","paper":{"title":"A Critical Evaluation of Defenses against Prompt Injection Attacks","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Dawn Song, Jinyuan Jia, Neil Zhenqiang Gong, Yupei Liu, Yuqi Jia, Zedian Shao","submitted_at":"2025-05-23T19:39:56Z","abstract_excerpt":"Large Language Models (LLMs) are vulnerable to prompt injection attacks, and several defenses have recently been proposed, often claiming to mitigate these attacks successfully. However, we argue that existing studies lack a principled approach to evaluating these defenses. In this paper, we argue the need to assess defenses across two critical dimensions: (1) effectiveness, measured against both existing and adaptive prompt injection attacks involving diverse target and injected prompts, and (2) general-purpose utility, ensuring that the defense does not compromise the foundational capabiliti"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2505.18333","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-23T19:39:56Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"8cfd9ec1147122931580fb60f1eaae6998477e425c284715889d39239685c304","abstract_canon_sha256":"06bd1ee1dfdfdc791b0a6398643b26f6f14b276848dbf847bb5309d618b7e229"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:08:44.983186Z","signature_b64":"PyC/ovzMOIo/ahdzBGxf1oW0pcisH9GNbsvmDXT+tDm2K1Nr0bcj1fY9zIhjkCQ2WjUsgk5DKzaEjMi7v2I+Cg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"f85132edbfff09098c0bc069616c303262b37f362c1c07700783b395a4385e08","last_reissued_at":"2026-07-05T11:08:44.982757Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:08:44.982757Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"A Critical Evaluation of Defenses against Prompt Injection Attacks","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Dawn Song, Jinyuan Jia, Neil Zhenqiang Gong, Yupei Liu, Yuqi Jia, Zedian Shao","submitted_at":"2025-05-23T19:39:56Z","abstract_excerpt":"Large Language Models (LLMs) are vulnerable to prompt injection attacks, and several defenses have recently been proposed, often claiming to mitigate these attacks successfully. However, we argue that existing studies lack a principled approach to evaluating these defenses. In this paper, we argue the need to assess defenses across two critical dimensions: (1) effectiveness, measured against both existing and adaptive prompt injection attacks involving diverse target and injected prompts, and (2) general-purpose utility, ensuring that the defense does not compromise the foundational capabiliti"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.18333","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2505.18333/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2505.18333","created_at":"2026-07-05T11:08:44.982813+00:00"},{"alias_kind":"arxiv_version","alias_value":"2505.18333v1","created_at":"2026-07-05T11:08:44.982813+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.18333","created_at":"2026-07-05T11:08:44.982813+00:00"},{"alias_kind":"pith_short_12","alias_value":"7BITF3N774EQ","created_at":"2026-07-05T11:08:44.982813+00:00"},{"alias_kind":"pith_short_16","alias_value":"7BITF3N774EQTDAL","created_at":"2026-07-05T11:08:44.982813+00:00"},{"alias_kind":"pith_short_8","alias_value":"7BITF3N7","created_at":"2026-07-05T11:08:44.982813+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":16,"internal_anchor_count":1,"sample":[{"citing_arxiv_id":"2607.08147","citing_title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","ref_index":37,"is_internal_anchor":true},{"citing_arxiv_id":"2606.26479","citing_title":"Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents","ref_index":34,"is_internal_anchor":false},{"citing_arxiv_id":"2606.21377","citing_title":"ARENA: An Architecture for Measuring the Transferability of Autonomous Cyber Defense","ref_index":9,"is_internal_anchor":false},{"citing_arxiv_id":"2605.28999","citing_title":"Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening","ref_index":15,"is_internal_anchor":false},{"citing_arxiv_id":"2605.30677","citing_title":"Investigating Detection and Obfuscation of Prompt Injection Attacks Against Software Reverse Engineering AI Agents","ref_index":4,"is_internal_anchor":false},{"citing_arxiv_id":"2504.20984","citing_title":"ACE: A Security Architecture for LLM-Integrated App Systems","ref_index":31,"is_internal_anchor":false},{"citing_arxiv_id":"2509.25448","citing_title":"Fingerprinting LLMs via Prompt Injection","ref_index":5,"is_internal_anchor":false},{"citing_arxiv_id":"2605.19159","citing_title":"On the Geometric Limits of Transformer Defenses against Obfuscation Attacks: Latent Embedding Collapse & Performance Robustness Gap","ref_index":15,"is_internal_anchor":false},{"citing_arxiv_id":"2605.01970","citing_title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","ref_index":39,"is_internal_anchor":false},{"citing_arxiv_id":"2510.23883","citing_title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","ref_index":182,"is_internal_anchor":false},{"citing_arxiv_id":"2504.19793","citing_title":"Prompt Injection Attack to Tool Selection in LLM Agents","ref_index":71,"is_internal_anchor":false},{"citing_arxiv_id":"2602.16708","citing_title":"Formal Policy Enforcement for Real-World Agentic Systems","ref_index":36,"is_internal_anchor":false},{"citing_arxiv_id":"2604.28157","citing_title":"FlashRT: Towards Computationally and Memory Efficient Red-Teaming for Prompt Injection and Knowledge Corruption","ref_index":7,"is_internal_anchor":false},{"citing_arxiv_id":"2605.01462","citing_title":"LocalAlign: Enabling Generalizable Prompt Injection Defense via Generation of Near-Target Adversarial Examples for Alignment Training","ref_index":21,"is_internal_anchor":false},{"citing_arxiv_id":"2605.00460","citing_title":"CleanBase: Detecting Malicious Documents in RAG Knowledge Databases","ref_index":72,"is_internal_anchor":false},{"citing_arxiv_id":"2605.01970","citing_title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","ref_index":40,"is_internal_anchor":false}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/7BITF3N774EQTDALYBUWC3BQGJ","json":"https://pith.science/pith/7BITF3N774EQTDALYBUWC3BQGJ.json","graph_json":"https://pith.science/api/pith-number/7BITF3N774EQTDALYBUWC3BQGJ/graph.json","events_json":"https://pith.science/api/pith-number/7BITF3N774EQTDALYBUWC3BQGJ/events.json","paper":"https://pith.science/paper/7BITF3N7"},"agent_actions":{"view_html":"https://pith.science/pith/7BITF3N774EQTDALYBUWC3BQGJ","download_json":"https://pith.science/pith/7BITF3N774EQTDALYBUWC3BQGJ.json","view_paper":"https://pith.science/paper/7BITF3N7","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2505.18333&json=true","fetch_graph":"https://pith.science/api/pith-number/7BITF3N774EQTDALYBUWC3BQGJ/graph.json","fetch_events":"https://pith.science/api/pith-number/7BITF3N774EQTDALYBUWC3BQGJ/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/7BITF3N774EQTDALYBUWC3BQGJ/action/timestamp_anchor","attest_storage":"https://pith.science/pith/7BITF3N774EQTDALYBUWC3BQGJ/action/storage_attestation","attest_author":"https://pith.science/pith/7BITF3N774EQTDALYBUWC3BQGJ/action/author_attestation","sign_citation":"https://pith.science/pith/7BITF3N774EQTDALYBUWC3BQGJ/action/citation_signature","submit_replication":"https://pith.science/pith/7BITF3N774EQTDALYBUWC3BQGJ/action/replication_record"}},"created_at":"2026-07-05T11:08:44.982813+00:00","updated_at":"2026-07-05T11:08:44.982813+00:00"}