Vietnamese RAG Prompt Injection Test Kit

I think this project is highly relevant to AI safety because Vietnamese-language RAG prompt-injection benchmarks are still scarce, while RAG chatbots are increasingly used across HR, customer support, banking/fintech, education, healthcare, and public-service settings in Vietnam. The project makes a strong contribution by introducing a defensive benchmark for Vietnamese RAG systems and comparing baseline behavior against strategies such as instruction-hierarchy prompting and context sanitization.

The methodology is generally sound. The report clearly presents the benchmark setup, attack categories, mitigation controls, automatic scoring, and manual review. The results also communicate a meaningful safety finding: the baseline system showed nontrivial attack success, while the mitigation controls reduced failures in the reviewed cases.

However, the report could explain the findings more clearly. For example, IDs such as TC014, TC027, TC046, etc. are referenced in the analysis, but their meanings and data structures are not clearly explained for readers. It would help to briefly describe what each highlighted test case represents and why it matters. The report seems to emphasize Table 1, Figure 1, and Table 2, but Table 3 and Table 4 could be discussed in more depth. In particular, the authors could explain what the results suggest about Vietnamese-only attacks versus Vietnamese-English code-switching attacks, as well as how the different GPT-5.4-mini evaluation settings compare across the reported metrics.

Another useful addition would be a sector-level analysis. Since the benchmark covers HR, customer support, banking/fintech, school policy, clinic information, and public-service FAQ domains, the authors could discuss whether certain sectors appear more vulnerable or safety-critical. Even with only 48 test cases, highlighting qualitative patterns across sectors would strengthen the impact of the report.

Overall, this is a good and practically useful project. It provides a meaningful starting point for safer Vietnamese and Southeast Asian RAG deployment, and the report would be even stronger with clearer interpretation of tables, domain-specific risks, and GPT-5.4 model variations.

This is the kind of thing regional teams can actually run before launch, which is the point. Your evaluation habits are the strongest part: the manual pass caught both false positives and four real failures the auto-judge missed. The code-switching result (87.5% at baseline) is worth leading with. One quick fix: the submitted PDF still has the template's placeholder text sitting in the Results and References sections, plus a "Miltigated" typo. After that, headline the real-model number (10.42%) and keep it clear of the deterministic sim, whose 54% comes from a stub built to fail. Then push past 48 cases and add a second model. Good, practical safety work.

Good job! You should add held-out validation, as you tested your defenses on the same 48 attacks that you designed the defenses on. In addition, both defenses scored a perfect 0/48, so there is no signal to distinguish the two controls. Consider tests that are hard enough to separate them.

Also remember to remove the leftover Apart template boilerplate in Section 4 ("Present your main findings…").