{"as_of":"2026-08-11T18:57:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:401cd910807395ec9e4f79a4ae902374b31a30cde0038f9f4f90e17da71aa3df","coverage":[{"denominator":38,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":38,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-11T10:24:27.048790Z","state":"measured"},{"denominator":51,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":51,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-11T06:34:44.6726+00:00","state":"measured"},{"denominator":13,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":13,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:55:01.117692Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-07-03T16:58:43.565621Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":"2412.16682","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-07-03T16:58:43.565621Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents","venue":null,"work_id":"b7c7a2b7-aac7-48e3-9303-243af4686d81","year":2025},"citing_paper":{"arxiv_id":"2503.21460","last_updated":"2025-03-27T12:50:17Z","snapshot_observed_at":"2026-07-06T20:59:35.694800Z","submitted_at":"2025-03-27T12:50:17Z","title":"Large Language Model Agent: A Survey on Methodology, Applications and Challenges","version":1},"reference_index":209,"source":"pdf_text","source_observed_at":"2026-05-22T21:51:34.309870Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2503.21460"},"observation_digest":"sha256:599bf62fc9ef1443609d45e8f2fc01f89946d2755ded3e1afba9da35c294e0aa","observation_id":"7c6505b0-d9e2-4deb-afc8-d38971922780","resolution":{"observed_at":"2026-05-22T21:52:10.110882Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-08-07T14:55:01.117692Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.16957","last_updated":"2025-05-22T17:36:33Z","snapshot_observed_at":"2026-08-09T00:25:53.983420Z","submitted_at":"2025-05-22T17:36:33Z","title":"Invisible Prompts, Visible Threats: Malicious Font Injection in External Resources for Large Language Models","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-07T14:55:01.117692Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2505.16957"},"observation_digest":"sha256:fdf78373f763a232f3027f52eb6cb58f3ab2f06df0c74c56334da39facf281ab","observation_id":"a24a8668-3f8e-4800-b980-9aad03164431","resolution":{"observed_at":"2026-08-07T14:55:01.117692Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":"2412.16682","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-07-03T16:58:43.565621Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents","venue":null,"work_id":"b7c7a2b7-aac7-48e3-9303-243af4686d81","year":2025},"citing_paper":{"arxiv_id":"2510.23883","last_updated":"2026-04-03T16:27:34Z","snapshot_observed_at":"2026-08-11T00:12:51.643027Z","submitted_at":"2025-10-27T21:48:11Z","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","version":3},"reference_index":202,"source":"pdf_text","source_observed_at":"2026-05-18T03:42:10.703369Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2510.23883"},"observation_digest":"sha256:05f2d7db660a0132ef8c4e8a281295a8b045b4eb9d44d8ccd7211eeee0a9c4a2","observation_id":"f61e6893-03d9-438a-b98e-1c47a1604f0f","resolution":{"observed_at":"2026-05-18T03:42:22.422809Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-08-02T21:31:24.539379Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in LLM agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2602.20064","last_updated":"2026-07-10T15:10:01Z","snapshot_observed_at":"2026-08-09T10:05:53.034559Z","submitted_at":"2026-02-23T17:22:35Z","title":"The LLMbda Calculus: AI Agents, Conversations, and Information Flow","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-02T21:31:24.539379Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2602.20064"},"observation_digest":"sha256:2e8f6d7e6f0698adc9a8c5ef56ae17e51d76782fbbe0ab8b80a08470c6a75136","observation_id":"602dcf49-7c87-4618-aee3-8e8aa34947ed","resolution":{"observed_at":"2026-08-02T21:31:24.539379Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":"2412.16682","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-07-03T16:58:43.565621Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents","venue":null,"work_id":"b7c7a2b7-aac7-48e3-9303-243af4686d81","year":2025},"citing_paper":{"arxiv_id":"2604.16762","last_updated":"2026-04-18T00:23:32Z","snapshot_observed_at":"2026-08-05T05:46:03.567285Z","submitted_at":"2026-04-18T00:23:32Z","title":"CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-10T07:47:46.307793Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2604.16762"},"observation_digest":"sha256:35d8aa033be27aed6d230dd96711ea7aa965740a8ccd4bfe2fe2ff439eedf4ee","observation_id":"a5dfe640-3403-4a92-88f1-f6a84b0f2533","resolution":{"observed_at":"2026-05-10T07:52:13.816090Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":"2412.16682","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-07-03T16:58:43.565621Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents","venue":null,"work_id":"b7c7a2b7-aac7-48e3-9303-243af4686d81","year":2025},"citing_paper":{"arxiv_id":"2605.11026","last_updated":"2026-05-10T20:08:27Z","snapshot_observed_at":"2026-08-06T19:53:20.372995Z","submitted_at":"2026-05-10T20:08:27Z","title":"AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-13T01:31:34.468389Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2605.11026"},"observation_digest":"sha256:8782d2d93a88e9b6a3ee830880a06174c5af62184e71bde20c8a6d7e21a3d781","observation_id":"39f11dd9-3835-454e-9e1f-23ecd168e821","resolution":{"observed_at":"2026-05-13T01:32:02.665345Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":"2412.16682","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-07-03T16:58:43.565621Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents","venue":null,"work_id":"b7c7a2b7-aac7-48e3-9303-243af4686d81","year":2025},"citing_paper":{"arxiv_id":"2605.12233","last_updated":"2026-05-12T15:06:15Z","snapshot_observed_at":"2026-08-11T11:02:47.709348Z","submitted_at":"2026-05-12T15:06:15Z","title":"No More, No Less: Task Alignment in Terminal Agents","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-13T05:56:41.081523Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2605.12233"},"observation_digest":"sha256:85f1ccf54f0b33e6b3eca4e7a89a775749a0062a4988cc671153cba0c97424eb","observation_id":"ae4b724b-a685-4486-a15a-d71460f0ac21","resolution":{"observed_at":"2026-05-13T05:57:22.412603Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":"2412.16682","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-07-03T16:58:43.565621Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents","venue":null,"work_id":"b7c7a2b7-aac7-48e3-9303-243af4686d81","year":2025},"citing_paper":{"arxiv_id":"2605.14290","last_updated":"2026-05-14T02:48:57Z","snapshot_observed_at":"2026-08-03T04:50:16.568616Z","submitted_at":"2026-05-14T02:48:57Z","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-15T02:42:05.644536Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2605.14290"},"observation_digest":"sha256:dce65688dd11ce1339ddbabc60ae5d3b8b439f08a896ccf6d7cffd1cc57d9108","observation_id":"16d9ff76-c4db-40cd-8254-d77fbc15726d","resolution":{"observed_at":"2026-05-15T02:43:33.427337Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":"2412.16682","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-07-03T16:58:43.565621Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents","venue":null,"work_id":"b7c7a2b7-aac7-48e3-9303-243af4686d81","year":2025},"citing_paper":{"arxiv_id":"2606.10322","last_updated":"2026-06-09T02:18:44Z","snapshot_observed_at":"2026-08-07T13:25:53.329421Z","submitted_at":"2026-06-09T02:18:44Z","title":"Game-Theoretic Multi-Agent Control for Robust Contextual Reasoning in LLMs","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-06-27T13:05:57.618969Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2606.10322"},"observation_digest":"sha256:e8e40c4588a503afe1fe02e01cd21fd1bb9ded910cfadd1a38eff871c126b683","observation_id":"a6441a34-ccbf-405e-8d1a-f9ffdf08b84e","resolution":{"observed_at":"2026-07-03T05:47:41.182833Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":"2412.16682","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-07-03T16:58:43.565621Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents","venue":null,"work_id":"b7c7a2b7-aac7-48e3-9303-243af4686d81","year":2025},"citing_paper":{"arxiv_id":"2606.14517","last_updated":"2026-06-16T09:28:39Z","snapshot_observed_at":"2026-07-06T23:52:28.557859Z","submitted_at":"2026-06-12T14:49:00Z","title":"From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-06-27T04:42:05.886984Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2606.14517"},"observation_digest":"sha256:b1273fe1f1dd7f5bceb6b05de6f4eaf3bab9d352b0dcce32b75cf144c5e62671","observation_id":"b97fe467-b2be-45b0-a54e-1ecf87f86479","resolution":{"observed_at":"2026-07-03T16:58:43.567273Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-07-12T06:34:07.307906Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.02857","last_updated":"2026-07-03T01:41:17Z","snapshot_observed_at":"2026-08-06T19:42:53.155353Z","submitted_at":"2026-07-03T01:41:17Z","title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-07-12T06:34:07.307906Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2607.02857"},"observation_digest":"sha256:0eacfdf75183ab8597526f47d572c5ef0b7c9434177e40c4ca535b87f42c6ea4","observation_id":"a937b614-d959-4866-b85a-e7f590837ba4","resolution":{"observed_at":"2026-07-12T06:34:07.307906Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-08-01T16:35:19.137603Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in LLM agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.17951","last_updated":"2026-07-20T13:52:24Z","snapshot_observed_at":"2026-08-08T08:52:05.370156Z","submitted_at":"2026-07-20T13:52:24Z","title":"RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Control","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-01T16:35:19.137603Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2607.17951"},"observation_digest":"sha256:ca2bb3da99648bc6d40fd9769c4d62aa4a87ad52d4d558508979b81a6ca0900f","observation_id":"464c419e-90e4-4deb-995a-229b9da82332","resolution":{"observed_at":"2026-08-01T16:35:19.137603Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-07-31T23:24:19.538321Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-03T08:43:31.893929Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.538321Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:12e9d5bc9a87a605cf2fd07e3a935f252c03350bed14429365f662a9ed427099","observation_id":"1847c81d-a1bd-4925-8204-fb4336c41cec","resolution":{"observed_at":"2026-07-31T23:24:19.538321Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2412.16682/citation-record","integrity":"/paper/2412.16682/integrity","json":"/paper/2412.16682/citation-record.json","paper":"/paper/2412.16682"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:26.757134Z","title":"online\" 'onlinestring :=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.757134Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:6df0888d26df78c04c9a284b169a128cb639c7fc646d13e3cf68532199f5da9d","observation_id":"bcf99d7c-016a-465b-b6a2-abde8f1a0ebf","resolution":{"observed_at":"2026-08-11T10:24:26.757134Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:26.762707Z","title":"write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.762707Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:ce7de813c958b13ef4866480b0696f918a10216a589ab0d36579d7e145ce6311","observation_id":"d93e7f28-cce8-4484-8ec3-5fa9af4ee8b3","resolution":{"observed_at":"2026-08-11T10:24:26.762707Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:27.801756Z","title":null,"venue":null,"work_id":"9555aabb-90ba-41ea-a62e-05602d4d174c","year":2020},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.767748Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:a8d4e3a471b010769994423265747821b0875a5ffac87e2f744684a53d72abcc","observation_id":"ea47b1c7-24b8-4abb-90f2-2016884e6940","resolution":{"observed_at":"2026-08-11T10:24:27.805648Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-08-11T03:37:22.279261Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-08-11T10:24:26.774479Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.774479Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:fcef1613f320aba1c80ee7e37f450a983e46379d573c8f1b861bfc90436f123c","observation_id":"484e8516-d9db-4fbd-96ea-2ececb9cd542","resolution":{"observed_at":"2026-08-11T10:24:26.774479Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-11T10:24:26.779495Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.779495Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:cec64f33fd1d919f5426f3be05e1633fbf99d30225a4a8a7ed2054a0ad87fd82","observation_id":"76a685bd-7663-4b7f-b311-84a73ec55477","resolution":{"observed_at":"2026-08-11T10:24:26.779495Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:26.784475Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.784475Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:758a62984711598443781403005a9b373cd9314b0443564f64ccf78c8a06e39c","observation_id":"6b6a45ef-dd91-41d8-8544-dea7e7acb896","resolution":{"observed_at":"2026-08-11T10:24:26.784475Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:27.778808Z","title":null,"venue":null,"work_id":"0dffc3f0-8974-4dc5-8c36-af3843330ec1","year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.789191Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:049950e2e7363586dda543b78d80b84799ed978bccc9df6ba0375f301df18244","observation_id":"17d38585-9607-462f-8001-04814cf78fb6","resolution":{"observed_at":"2026-08-11T10:24:27.783322Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:26.793700Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.793700Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:ad14ca0e3f03818c6a0b1cb933c247885b73bf9c5fa031efb5eccc03196f6846","observation_id":"d2c0925e-10e3-4ba1-a904-89ee26259d3e","resolution":{"observed_at":"2026-08-11T10:24:26.793700Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:27.764000Z","title":"Gupta, Niloofar Mireshghallah, Taylor Berg-Kirkpatrick, and Earlence Fernandes","venue":null,"work_id":"4c6f5a7c-7e1a-49b5-9585-050b554b08db","year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.798633Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:c6110c825cf4245564bf4cf387576e7f20285ac2e8b9c00e3a4477f3669e198a","observation_id":"df98e536-0949-4705-b6bc-dbe534cd74d0","resolution":{"observed_at":"2026-08-11T10:24:27.768749Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:26.803006Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.803006Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:da181dd216ffa2d413256d618da6da99f50e8f3368550b610bcd9d1d9b00eb6d","observation_id":"94c3276b-a666-4d26-874f-525a1df8a0b2","resolution":{"observed_at":"2026-08-11T10:24:26.803006Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:26.807345Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.807345Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:8d10e3e76ed4fb5000aeea5bc6a169917780635493b5c187d79de4f46725654c","observation_id":"3acd4214-4126-4989-98aa-89fc8f5aace1","resolution":{"observed_at":"2026-08-11T10:24:26.807345Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-08-11T10:47:05.890022Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-08-11T10:24:26.933542Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.933542Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:d6bb47a776f5e065f5818eb6de7692afc83fca5f62c210e1ab286f99cc8b5dae","observation_id":"71c654a6-5307-4ad3-a490-f176f40a7b23","resolution":{"observed_at":"2026-08-11T10:24:26.933542Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.16505","last_updated":"2024-01-30T03:17:26Z","snapshot_observed_at":"2026-07-06T16:12:38.269310Z","submitted_at":"2023-08-31T07:36:44Z","title":"Recommender AI Agent: Integrating Large Language Models for Interactive Recommendations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.16505","snapshot_observed_at":"2026-08-11T10:24:26.937799Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.937799Z"},"links":{"cited_paper":"/paper/2308.16505","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:9f17233de4e21c7f934c5b3e3b36b9f1f347a47a05460c774665b3d8ed9068ae","observation_id":"1bc17b03-a4cb-4959-a64c-72f72af03d4f","resolution":{"observed_at":"2026-08-11T10:24:26.937799Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.21146","last_updated":"2024-10-28T15:47:03Z","snapshot_observed_at":"2026-07-06T19:40:52.844113Z","submitted_at":"2024-10-28T15:47:03Z","title":"Palisade -- Prompt Injection Detection Framework","version":1},"cited_work":{"arxiv_id":"2410.21146","doi":null,"metadata_source":"pith","pith_arxiv_id":"2410.21146","snapshot_observed_at":"2026-08-11T10:24:27.325139Z","title":"Palisade -- Prompt Injection Detection Framework","venue":"cs.CL","work_id":"44f9161b-bcc4-4b1e-a39a-e66ef6261c94","year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.942598Z"},"links":{"cited_paper":"/paper/2410.21146","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:479d64a6ba9ac4f7f5d810ee2ce44d75c4adc5ceed59edda09d220e183fbb628","observation_id":"a6560390-5104-41cf-abbd-bcaa6a2448c5","resolution":{"observed_at":"2026-08-11T10:24:27.330478Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.03014","last_updated":"2024-02-05T13:52:56Z","snapshot_observed_at":"2026-07-06T17:25:26.813696Z","submitted_at":"2024-02-05T13:52:56Z","title":"Whom to Trust? Elective Learning for Distributed Gaussian Process Regression","version":1},"cited_work":{"arxiv_id":"2402.03014","doi":null,"metadata_source":"pith","pith_arxiv_id":"2402.03014","snapshot_observed_at":"2026-08-11T10:24:27.301036Z","title":"Whom to Trust? Elective Learning for Distributed Gaussian Process Regression","venue":"cs.LG","work_id":"4dcf220c-7c6b-479d-90ec-7e4daa2ab81b","year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.947597Z"},"links":{"cited_paper":"/paper/2402.03014","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:6cd116b38ba4aec94fb0ecbe7332cf382266b4b842ad4e224683ce854c8cff56","observation_id":"3f040989-1353-46fc-8b8f-160540a97800","resolution":{"observed_at":"2026-08-11T10:24:27.308043Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-07-06T15:40:27.639368Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-08-11T10:24:26.952239Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.952239Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:8d984ccb3d1c7da434d2e98b925a6ff5ff9c64b02552358b8742665648c0d247","observation_id":"cfd0bb1c-cbae-4a4b-88d2-a9b016e901dd","resolution":{"observed_at":"2026-08-11T10:24:26.952239Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:27.740067Z","title":null,"venue":null,"work_id":"53913290-ae2f-4d33-875a-42300e78306d","year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.956756Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:a38c54a5818ba70e29080c5886c7922c953ca473a56f17a4133b27cc7581a44f","observation_id":"65e2677d-278b-4aef-8373-35f3e37dde80","resolution":{"observed_at":"2026-08-11T10:24:27.744602Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:27.725184Z","title":null,"venue":null,"work_id":"58a799c7-129a-4567-839c-ec8ba6f4afe0","year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.960577Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:50045d42414a375227ebb8a1ecbbbcb36da59313e508108c6489de55ba53d758","observation_id":"ee2b5907-d90b-4b39-b78b-a01cdc9f2b8a","resolution":{"observed_at":"2026-08-11T10:24:27.729799Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:27.710710Z","title":null,"venue":null,"work_id":"3aa49d2a-a164-4e4f-9938-e52cdcf8900d","year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.964597Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:6ae5697c93de7b740b3975368fe3ed405f73ed11bde5fbd4873ca1c5050ac5a6","observation_id":"6a7f2124-6096-4d18-90ca-e2a2afef1ffa","resolution":{"observed_at":"2026-08-11T10:24:27.715161Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:27.696497Z","title":null,"venue":null,"work_id":"bb096bec-0ef3-45c4-8d69-137fdf484b70","year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.968473Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:9f2c2c03de469d257ce15268b8a05376d73356a4111a2c790f48a75f48a838f1","observation_id":"a34672dd-4f90-4939-86b7-59ed44be8df7","resolution":{"observed_at":"2026-08-11T10:24:27.701052Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:26.972102Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.972102Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:c4f3686a6de33169ab61ca6d7955771f0d21cd89e56ccb7d9cb3db2fd19661fe","observation_id":"5f6c73d7-a0bb-442a-ada1-117515891602","resolution":{"observed_at":"2026-08-11T10:24:26.972102Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.15334","last_updated":"2023-05-24T16:48:11Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-05-24T16:48:11Z","title":"Gorilla: Large Language Model Connected with Massive APIs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.15334","snapshot_observed_at":"2026-08-11T10:24:26.975809Z","title":"Patil, Tianjun Zhang, Xin Wang, and Joseph E","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.975809Z"},"links":{"cited_paper":"/paper/2305.15334","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:ec0299180a86a6e2b52e68eeaff8b90f761c1a423c08bf41c52861f0005ac573","observation_id":"36386400-ab38-442b-b3e9-6cc1530b7097","resolution":{"observed_at":"2026-08-11T10:24:26.975809Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-07-06T14:19:47.424778Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-08-11T10:24:26.979697Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.979697Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:0ac7ef01a38c8237082e499b51c1a6dc46bcb802fb905b95fa72fe2ee218c1b1","observation_id":"aa91ded2-6669-44ff-9d59-e17902d476c8","resolution":{"observed_at":"2026-08-11T10:24:26.979697Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.17673","last_updated":"2024-01-08T19:11:26Z","snapshot_observed_at":"2026-08-11T18:53:57.726869Z","submitted_at":"2023-12-29T16:37:53Z","title":"Jatmo: Prompt Injection Defense by Task-Specific Finetuning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.17673","snapshot_observed_at":"2026-08-11T10:24:26.983523Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.983523Z"},"links":{"cited_paper":"/paper/2312.17673","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:cf5a7791aa9d3942bc24988ea506f40a56ae25045ce3fc44f624e986dbdbb2c6","observation_id":"746e4891-1d42-4be8-8177-c845af83407e","resolution":{"observed_at":"2026-08-11T10:24:26.983523Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:27.672507Z","title":null,"venue":null,"work_id":"e46a67ef-64ca-47b7-aa84-72ad525ac21c","year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.988254Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:791b31b8a7983e5e24246dcbe893a047db007c2793997f28745f619c52be043a","observation_id":"bf6a7214-f7d6-44f4-898f-053be29809e6","resolution":{"observed_at":"2026-08-11T10:24:27.677129Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.16789","last_updated":"2023-10-03T14:45:48Z","snapshot_observed_at":"2026-07-06T16:00:46.542753Z","submitted_at":"2023-07-31T15:56:53Z","title":"ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.16789","snapshot_observed_at":"2026-08-11T10:24:26.992471Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.992471Z"},"links":{"cited_paper":"/paper/2307.16789","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:8a928ceba2ebefe0dfc9562fddf7383d8fd3ea2cc226507518d013d8d9da58b5","observation_id":"56d2b729-8275-4768-b4b9-341bb4a6f248","resolution":{"observed_at":"2026-08-11T10:24:26.992471Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:26.997239Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:26.997239Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:e40e4f7fac16e2d97225985202e26fc61b6d3a75367625a58083b6bf5ccce234","observation_id":"79913162-26e2-469c-8b01-b941dc1a52bf","resolution":{"observed_at":"2026-08-11T10:24:26.997239Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:27.647790Z","title":null,"venue":null,"work_id":"2fd6d87a-269a-489d-b6d4-a5b5449563fa","year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:27.001732Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:170db5f16468acc5da86fb41d85e7dcb2a9dcdedd87e7ab1269165f820aa18b2","observation_id":"0ac53856-199a-472b-84e5-3a53171bb034","resolution":{"observed_at":"2026-08-11T10:24:27.652442Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05301","last_updated":"2023-09-07T12:20:45Z","snapshot_observed_at":"2026-08-11T16:55:59.039497Z","submitted_at":"2023-06-08T15:46:32Z","title":"ToolAlpaca: Generalized Tool Learning for Language Models with 3000 Simulated Cases","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05301","snapshot_observed_at":"2026-08-11T10:24:27.006328Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:27.006328Z"},"links":{"cited_paper":"/paper/2306.05301","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:0720ac79f35020e2dc4917e5a0115adce9b22c5f33de2e413bf9297b01c85ef0","observation_id":"db738dc8-08bb-4e65-a7b9-132119b530d8","resolution":{"observed_at":"2026-08-11T10:24:27.006328Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-11T10:24:27.011050Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:27.011050Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:26da81005c8b7d695d0a8ea151a62f832967062587807b4b07b883675da49933","observation_id":"72f79fa5-3b0f-41fe-82ff-65ea438f2905","resolution":{"observed_at":"2026-08-11T10:24:27.011050Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-10T04:45:11.275468Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-11T10:24:27.016077Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:27.016077Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:6e6c6602e90f9bea7b2d3304e4adcf2c65b8d4e9f8dd39be5e5f33843f6c5a2c","observation_id":"dcc648a0-67f7-4a86-9803-ebf7a875a12f","resolution":{"observed_at":"2026-08-11T10:24:27.016077Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.21492","last_updated":"2024-11-25T20:37:40Z","snapshot_observed_at":"2026-08-09T21:43:55.291084Z","submitted_at":"2024-10-28T20:02:47Z","title":"FATH: Authentication-based Test-time Defense against Indirect Prompt Injection Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.21492","snapshot_observed_at":"2026-08-11T10:24:27.020630Z","title":"Morley Mao, Muhao Chen, and Chaowei Xiao","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:27.020630Z"},"links":{"cited_paper":"/paper/2410.21492","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:171656d7adfdc814ec71dab28b7895e26e95113fd2e9c6593685f85ceb5f287c","observation_id":"6bf1c9c8-fa8b-4ae4-afea-1f963c6ab16d","resolution":{"observed_at":"2026-08-11T10:24:27.020630Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2206.04615","last_updated":"2023-06-12T17:51:15Z","snapshot_observed_at":"2026-07-06T13:19:12.109592Z","submitted_at":"2022-06-09T17:05:34Z","title":"Beyond the Imitation Game: Quantifying and extrapolating the capabilities of language models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2206.04615","snapshot_observed_at":"2026-08-11T10:24:27.025077Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:27.025077Z"},"links":{"cited_paper":"/paper/2206.04615","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:12820e43bae95b589ef7fd08973ce6bf6da34abef54fc968ff3c96a8b41562d2","observation_id":"925909bd-96d6-4f78-814d-59dfd0e55d5d","resolution":{"observed_at":"2026-08-11T10:24:27.025077Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.09102","last_updated":"2025-03-01T19:06:35Z","snapshot_observed_at":"2026-08-04T17:29:52.046121Z","submitted_at":"2024-10-09T12:52:41Z","title":"Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.09102","snapshot_observed_at":"2026-08-11T10:24:27.030118Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:27.030118Z"},"links":{"cited_paper":"/paper/2410.09102","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:93decd34f94057457da4717da12408cda7b85f032c67d98eb67062e1031f8ac7","observation_id":"fbe276cd-bc22-4a66-a1cd-42eccb588a63","resolution":{"observed_at":"2026-08-11T10:24:27.030118Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.09187","last_updated":"2025-05-29T03:09:05Z","snapshot_observed_at":"2026-07-06T18:30:23.849880Z","submitted_at":"2024-06-13T14:49:26Z","title":"GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.09187","snapshot_observed_at":"2026-08-11T10:24:27.034983Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:27.034983Z"},"links":{"cited_paper":"/paper/2406.09187","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:3c5d45b098bc43f24afb8a4238d5422636489ad591df74b54ffa30ca0c15c45e","observation_id":"55a100af-990e-4bbc-b180-2afb7374885a","resolution":{"observed_at":"2026-08-11T10:24:27.034983Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T10:24:27.039647Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:27.039647Z"},"links":{"citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:b4e498c84b4d337d89f53f0e803d456a64e2a25e1e89a44e85a44b40446d2a2e","observation_id":"1c845cf5-c9c7-4bbb-9a99-e69d44e5aae2","resolution":{"observed_at":"2026-08-11T10:24:27.039647Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02691","last_updated":"2024-08-04T04:52:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-05T06:21:45Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.02691","snapshot_observed_at":"2026-08-11T10:24:27.044054Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:27.044054Z"},"links":{"cited_paper":"/paper/2403.02691","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:4643fb2ed71b0f0b9211e0932e1bd0352b7ed294c82145d9c5f2aab512694115","observation_id":"968de845-c1d1-46e8-b04c-6436f9478028","resolution":{"observed_at":"2026-08-11T10:24:27.044054Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09283","last_updated":"2024-03-14T08:28:13Z","snapshot_observed_at":"2026-07-06T15:55:21.408850Z","submitted_at":"2023-07-18T14:24:33Z","title":"RepViT: Revisiting Mobile CNN From ViT Perspective","version":8},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09283","snapshot_observed_at":"2026-08-11T10:24:27.048790Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-11T10:24:27.048790Z"},"links":{"cited_paper":"/paper/2307.09283","citing_paper":"/paper/2412.16682"},"observation_digest":"sha256:791086abd227e716e707cbf5c58fc9d020c1da567abf97cc38c1893bd52bef3a","observation_id":"caf73733-d20f-40e8-8442-d013003c7282","resolution":{"observed_at":"2026-08-11T10:24:27.048790Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-11T10:19:32.483789Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents"},"reference_resolution":{"displayed":38,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":35,"verified_exact":2,"verified_fuzzy":1},"total_outbound_references":38},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"thesis":"As of 11 August 2026, this Paper Citation Record lists 38 of 38 outbound references and 13 inbound Pith citation observations for arXiv:2412.16682."}