{"as_of":"2026-08-09T03:15:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:6a40bfcc642d4d95534a22a2c4cd5ff413c696bc24e040da4af906237059843f","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":10,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":10,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":10,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":10,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T23:56:00.156616Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"arxiv_reference","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"arxiv_reference"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","version":3},"cited_work":{"arxiv_id":"2403.06833","doi":"10.48550/arxiv.2403.06833","metadata_source":"arxiv_reference","pith_arxiv_id":"2403.06833","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Can llms separate instructions from data? and what do we even mean by that?","venue":"arXiv (Cornell University)","work_id":"714da9a8-c412-4caf-9c48-7c8dfe5cf10e","year":2025},"citing_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-05-13T06:35:13.331872Z"},"links":{"cited_paper":"/paper/2403.06833","citing_paper":"/paper/2406.13352"},"observation_digest":"sha256:37d8ac52135e5d1e0768fed6598543fbaf076df2b71a0d3d05a6d6a091db88e9","observation_id":"46fec84a-dbcb-4e7e-8d3f-a40d8fa35f43","resolution":{"observed_at":"2026-05-13T06:35:13.544043Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.06833","snapshot_observed_at":"2026-08-07T23:56:00.156616Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.08745","last_updated":"2025-03-26T20:35:30Z","snapshot_observed_at":"2026-08-08T01:24:44.588510Z","submitted_at":"2025-02-12T19:35:28Z","title":"IHEval: Evaluating Language Models on Following the Instruction Hierarchy","version":2},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-07T23:56:00.156616Z"},"links":{"cited_paper":"/paper/2403.06833","citing_paper":"/paper/2502.08745"},"observation_digest":"sha256:cc798d961181c8e9fee43963533adaa01b8a32e0512c55eb47ec7107bf676263","observation_id":"b934316d-ab8c-426a-8d27-774b3c045fa5","resolution":{"observed_at":"2026-08-07T23:56:00.156616Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.06833","snapshot_observed_at":"2026-08-07T11:59:27.808634Z","title":"Can llms separate instructions from data? and what do we even mean by that? arXiv preprint arXiv:2403.06833, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.01055","last_updated":"2025-06-01T15:48:06Z","snapshot_observed_at":"2026-08-09T00:34:14.908419Z","submitted_at":"2025-06-01T15:48:06Z","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-07T11:59:27.808634Z"},"links":{"cited_paper":"/paper/2403.06833","citing_paper":"/paper/2506.01055"},"observation_digest":"sha256:87ae6970940ac13c211779048ca26156d2a6a4b8a01e7909deefd74fc47cd268","observation_id":"9931e2ed-3a9e-4a01-b986-f997ec53af2a","resolution":{"observed_at":"2026-08-07T11:59:27.808634Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.06833","snapshot_observed_at":"2026-08-07T05:06:15.330135Z","title":"Traditional","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.08837","last_updated":"2025-06-27T11:13:27Z","snapshot_observed_at":"2026-08-07T04:58:26.428959Z","submitted_at":"2025-06-10T14:23:55Z","title":"Design Patterns for Securing LLM Agents against Prompt Injections","version":3},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T05:06:15.330135Z"},"links":{"cited_paper":"/paper/2403.06833","citing_paper":"/paper/2506.08837"},"observation_digest":"sha256:b55224ceb7836dc0b35c087b9e110ad87cff99d91f3a0f4e764574b692a61cb0","observation_id":"07c87b88-74f8-4aac-95e0-46bc0cd8a13b","resolution":{"observed_at":"2026-08-07T05:06:15.330135Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","version":3},"cited_work":{"arxiv_id":"2403.06833","doi":"10.48550/arxiv.2403.06833","metadata_source":"arxiv_reference","pith_arxiv_id":"2403.06833","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Can llms separate instructions from data? and what do we even mean by that?","venue":"arXiv (Cornell University)","work_id":"714da9a8-c412-4caf-9c48-7c8dfe5cf10e","year":2025},"citing_paper":{"arxiv_id":"2605.01462","last_updated":"2026-05-02T14:25:26Z","snapshot_observed_at":"2026-07-06T23:14:43.034336Z","submitted_at":"2026-05-02T14:25:26Z","title":"LocalAlign: Enabling Generalizable Prompt Injection Defense via Generation of Near-Target Adversarial Examples for Alignment Training","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-05-09T14:17:57.772960Z"},"links":{"cited_paper":"/paper/2403.06833","citing_paper":"/paper/2605.01462"},"observation_digest":"sha256:7b488d195ac7587fd3badbd557b8fb52dc7cf2d1a6556fc5b035c9dc7852a15a","observation_id":"1860e671-b3b1-4376-86f6-9233a024b7b7","resolution":{"observed_at":"2026-05-11T17:01:08.575344Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","version":3},"cited_work":{"arxiv_id":"2403.06833","doi":"10.48550/arxiv.2403.06833","metadata_source":"arxiv_reference","pith_arxiv_id":"2403.06833","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Can llms separate instructions from data? and what do we even mean by that?","venue":"arXiv (Cornell University)","work_id":"714da9a8-c412-4caf-9c48-7c8dfe5cf10e","year":2025},"citing_paper":{"arxiv_id":"2605.16471","last_updated":"2026-05-15T13:53:02Z","snapshot_observed_at":"2026-07-06T23:27:38.955917Z","submitted_at":"2026-05-15T13:53:02Z","title":"From AI-Generated Content to Agentic Action: Security and Safety Threats in Generative AI","version":1},"reference_index":162,"source":"pdf_text","source_observed_at":"2026-05-20T18:08:24.901025Z"},"links":{"cited_paper":"/paper/2403.06833","citing_paper":"/paper/2605.16471"},"observation_digest":"sha256:2373a4f0e506849846403c7fbc6b3e4af6fa73a3a6698641c082ff1e4fb3d8c2","observation_id":"130a24d2-66d5-4481-82cc-4aa1c32906cd","resolution":{"observed_at":"2026-05-20T18:08:50.640748Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","version":3},"cited_work":{"arxiv_id":"2403.06833","doi":"10.48550/arxiv.2403.06833","metadata_source":"arxiv_reference","pith_arxiv_id":"2403.06833","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Can llms separate instructions from data? and what do we even mean by that?","venue":"arXiv (Cornell University)","work_id":"714da9a8-c412-4caf-9c48-7c8dfe5cf10e","year":2025},"citing_paper":{"arxiv_id":"2605.28467","last_updated":"2026-05-27T13:33:26Z","snapshot_observed_at":"2026-08-05T22:05:24.662345Z","submitted_at":"2026-05-27T13:33:26Z","title":"Mitigating Adaptive Attacks against Reasoning Models with Activation Consistency Training","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-06-29T14:18:16.033063Z"},"links":{"cited_paper":"/paper/2403.06833","citing_paper":"/paper/2605.28467"},"observation_digest":"sha256:bb29ccd50a93b1fcdd47123748c15913ea0c8de84e160cad14ff947113ef592c","observation_id":"b501d23f-8263-43ed-bbc8-2b0d0721a1b2","resolution":{"observed_at":"2026-06-29T14:23:30.681903Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","version":3},"cited_work":{"arxiv_id":"2403.06833","doi":"10.48550/arxiv.2403.06833","metadata_source":"arxiv_reference","pith_arxiv_id":"2403.06833","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Can llms separate instructions from data? and what do we even mean by that?","venue":"arXiv (Cornell University)","work_id":"714da9a8-c412-4caf-9c48-7c8dfe5cf10e","year":2025},"citing_paper":{"arxiv_id":"2606.02211","last_updated":"2026-06-01T13:10:49Z","snapshot_observed_at":"2026-08-02T18:41:16.377453Z","submitted_at":"2026-06-01T13:10:49Z","title":"Consistency Training while Mitigating Obfuscation via Rate Matching","version":1},"reference_index":108,"source":"arxiv_source","source_observed_at":"2026-06-28T14:25:43.147442Z"},"links":{"cited_paper":"/paper/2403.06833","citing_paper":"/paper/2606.02211"},"observation_digest":"sha256:bbf8241a3b8eca1fbed5e2b50d7ab37816130a175fccdbf3b50b77dac30963fd","observation_id":"7dc3e0b7-957e-4fc8-980f-5132d9fb617f","resolution":{"observed_at":"2026-06-28T14:32:18.125469Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","version":3},"cited_work":{"arxiv_id":"2403.06833","doi":"10.48550/arxiv.2403.06833","metadata_source":"arxiv_reference","pith_arxiv_id":"2403.06833","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Can llms separate instructions from data? and what do we even mean by that?","venue":"arXiv (Cornell University)","work_id":"714da9a8-c412-4caf-9c48-7c8dfe5cf10e","year":2025},"citing_paper":{"arxiv_id":"2606.04109","last_updated":"2026-06-08T04:40:12Z","snapshot_observed_at":"2026-08-07T20:39:01.290780Z","submitted_at":"2026-06-02T18:12:57Z","title":"Discourse-Role Labels as Presentation-Time Variables for Context Use in Language Models","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-06-28T10:13:48.860754Z"},"links":{"cited_paper":"/paper/2403.06833","citing_paper":"/paper/2606.04109"},"observation_digest":"sha256:75d497565dfe9b09fb11a33c110d303a29778bcd57d802eb66d5614fe6b0a45c","observation_id":"afa66361-b136-43dc-9398-0514501536dd","resolution":{"observed_at":"2026-07-02T03:16:33.687686Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","version":3},"cited_work":{"arxiv_id":"2403.06833","doi":"10.48550/arxiv.2403.06833","metadata_source":"arxiv_reference","pith_arxiv_id":"2403.06833","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Can llms separate instructions from data? and what do we even mean by that?","venue":"arXiv (Cornell University)","work_id":"714da9a8-c412-4caf-9c48-7c8dfe5cf10e","year":2025},"citing_paper":{"arxiv_id":"2606.30783","last_updated":"2026-06-29T18:11:17Z","snapshot_observed_at":"2026-08-08T22:30:38.879886Z","submitted_at":"2026-06-29T18:11:17Z","title":"Security--Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense","version":1},"reference_index":71,"source":"arxiv_source","source_observed_at":"2026-07-01T01:44:07.700127Z"},"links":{"cited_paper":"/paper/2403.06833","citing_paper":"/paper/2606.30783"},"observation_digest":"sha256:d0e5077cbcd257f399cc1fe3623274e959e35c39012c05e2898b523ef63739f4","observation_id":"f36b374a-3905-4eb1-a4d7-50ce77a07eb9","resolution":{"observed_at":"2026-07-01T01:45:13.802713Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2403.06833/citation-record","integrity":"/paper/2403.06833/integrity","json":"/paper/2403.06833/citation-record.json","paper":"/paper/2403.06833"},"outbound":[],"paper":{"arxiv_id":"2403.06833","last_updated":"2025-01-31T16:06:52Z","latest_version":3,"primary_category":"cs.LG","snapshot_observed_at":"2026-07-06T17:42:41.349428Z","submitted_at":"2024-03-11T15:48:56Z","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 10 inbound Pith citation observations for arXiv:2403.06833."}