{"as_of":"2026-08-18T06:40:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:57ba6a686160fd95b621c967e09f2d8a578a78c2f99fdf3afa23e222047096fc","coverage":[{"denominator":39,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":39,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-08T20:06:58.396831Z","state":"measured"},{"denominator":66,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":66,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-18T06:34:40.430872+00:00","state":"measured"},{"denominator":27,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":27,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-14T04:23:15.028834Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"pith","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"pith"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2504.20472","last_updated":"2026-04-09T06:57:42Z","snapshot_observed_at":"2026-08-13T08:12:27.488850Z","submitted_at":"2025-04-29T07:13:53Z","title":"Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction","version":2},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-05-22T19:10:55.009810Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2504.20472"},"observation_digest":"sha256:49072c91dd03e4420447fce3e337ae310629f5e9afd17c4d7c78c6912a9004ee","observation_id":"bc0da62c-e2b2-4b9e-9729-d62b6bba9bf5","resolution":{"observed_at":"2026-05-22T19:11:58.071951Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T05:09:40.020584Z","title":"¡” and “¿","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-17T05:43:59.220148Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:40.020584Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:cc94a7a91d327d2dae27737f3c416735053b96cbb2c6fc462aa67be568322725","observation_id":"cf50d8e3-a96a-4a81-9b6d-0591876bad5e","resolution":{"observed_at":"2026-08-05T05:09:40.020584Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2510.23883","last_updated":"2026-04-03T16:27:34Z","snapshot_observed_at":"2026-08-13T20:52:15.127327Z","submitted_at":"2025-10-27T21:48:11Z","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","version":3},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-05-18T03:42:10.703369Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2510.23883"},"observation_digest":"sha256:ecedaafe5fa0d4921e0e2b80f2a69c03d9a0ada44e273ae422c45b9bfe7c9dc6","observation_id":"f04d6e3a-abbb-4b23-900d-a43dd7764acf","resolution":{"observed_at":"2026-05-18T03:42:22.076283Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2601.22569","last_updated":"2026-05-18T21:06:40Z","snapshot_observed_at":"2026-08-16T19:02:26.679424Z","submitted_at":"2026-01-30T05:10:16Z","title":"Whispers of Wealth: Red-Teaming Google's Agent Payments Protocol via Prompt Injection","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-21T15:18:58.274360Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2601.22569"},"observation_digest":"sha256:0f7129c8b961b6a4d716776a816c38e0ada3dfd5a666d703ca71f4ee0a01e23a","observation_id":"83db55d0-db33-4d19-ae2a-643819ab73e1","resolution":{"observed_at":"2026-05-21T15:20:17.375618Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2604.18248","last_updated":"2026-07-30T16:35:11Z","snapshot_observed_at":"2026-08-02T23:57:45.082199Z","submitted_at":"2026-04-20T13:27:05Z","title":"Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-10T04:42:33.450658Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2604.18248"},"observation_digest":"sha256:2a53c81a71603122d4fa65a1cb5bac1043ca486b13ff4ad1617931659dcdc87d","observation_id":"eaa09e39-4804-40ab-97b3-d721ad91f20f","resolution":{"observed_at":"2026-05-10T11:55:21.358611Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2604.18248","last_updated":"2026-07-30T16:35:11Z","snapshot_observed_at":"2026-08-02T23:57:45.082199Z","submitted_at":"2026-04-20T13:27:05Z","title":"Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-21T00:51:22.907932Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2604.18248"},"observation_digest":"sha256:721be80000763147c19fdaf41467d9b4da2b7fb0a31bd636b130789ffa1ebb4c","observation_id":"dc536703-e33e-4e4c-810f-60d43b326d45","resolution":{"observed_at":"2026-05-21T00:53:53.086682Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-02T15:56:49.153150Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2604.18248","last_updated":"2026-07-30T16:35:11Z","snapshot_observed_at":"2026-08-02T23:57:45.082199Z","submitted_at":"2026-04-20T13:27:05Z","title":"Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection","version":4},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-02T15:56:49.153150Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2604.18248"},"observation_digest":"sha256:cb54e05c178d112abed5e4f53c56f0601bc212e54dc864bbd93c7800f4ab2ebf","observation_id":"27bc2e11-4352-471d-ba9a-ac370452f911","resolution":{"observed_at":"2026-08-02T15:56:49.153150Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:093ef7ce40c08745b9bba316df866193abcaff2661a0767cf7c6eee9413b3410","observation_id":"af9bf477-2843-42a9-acb7-81f110a10627","resolution":{"observed_at":"2026-05-11T22:16:30.500382Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2605.03129","last_updated":"2026-05-04T20:13:22Z","snapshot_observed_at":"2026-08-11T18:37:10.771052Z","submitted_at":"2026-05-04T20:13:22Z","title":"PIIGuard: Mitigating PII Harvesting under Adversarial Sanitization","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-08T17:49:39.533090Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2605.03129"},"observation_digest":"sha256:42faa3c96847a72a7328f8c3cf1cd809908726c26b6a8801cf55b4463953064a","observation_id":"27d2da28-7187-47eb-9ce5-535bf8f5b342","resolution":{"observed_at":"2026-05-08T17:53:53.269765Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2605.03378","last_updated":"2026-07-08T15:04:28Z","snapshot_observed_at":"2026-08-12T18:46:39.799583Z","submitted_at":"2026-05-05T05:37:00Z","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-05-07T15:59:49.513500Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2605.03378"},"observation_digest":"sha256:0c833145aa4599527a0ece34ecdc4b69d89cc0e6392aecf983bee27be65dc15c","observation_id":"e4adebc1-6504-4c7c-8f20-a8d6b2fd0806","resolution":{"observed_at":"2026-05-11T23:56:13.752504Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2605.11026","last_updated":"2026-05-10T20:08:27Z","snapshot_observed_at":"2026-08-14T23:33:00.840191Z","submitted_at":"2026-05-10T20:08:27Z","title":"AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-13T01:31:34.468389Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2605.11026"},"observation_digest":"sha256:aa175277bee9780e335b1eb1383848f273f14448409575c3bab036a58e1d1d00","observation_id":"b5f50e10-3b71-4af1-8562-22cb40fb556b","resolution":{"observed_at":"2026-05-13T01:32:02.602437Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2605.11039","last_updated":"2026-05-11T04:09:11Z","snapshot_observed_at":"2026-08-10T16:05:13.802452Z","submitted_at":"2026-05-11T04:09:11Z","title":"The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-13T01:31:13.100257Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2605.11039"},"observation_digest":"sha256:6b41e16a789f2112ffdd5f02793155177912fd26eb82706a792fcaebfc4b8a2d","observation_id":"e8a283c1-48e1-42d5-9cd8-fe9247005d92","resolution":{"observed_at":"2026-05-13T01:32:02.864173Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2605.17986","last_updated":"2026-06-17T05:08:04Z","snapshot_observed_at":"2026-08-15T02:49:26.787473Z","submitted_at":"2026-05-18T07:41:35Z","title":"LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-20T10:03:05.696380Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2605.17986"},"observation_digest":"sha256:4b5813b75358cb358260cdac30b94756d331a465030a99e65639c002f8c7c9f1","observation_id":"692f3850-3a5e-4ad4-8cad-e516b7b8185c","resolution":{"observed_at":"2026-05-20T10:03:14.260886Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2605.17986","last_updated":"2026-06-17T05:08:04Z","snapshot_observed_at":"2026-08-15T02:49:26.787473Z","submitted_at":"2026-05-18T07:41:35Z","title":"LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection","version":3},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-06-30T18:48:32.929392Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2605.17986"},"observation_digest":"sha256:9659330b69f4b59ff06c51fa2b8e2df2a7cb7ae6a3e71759b16f0f61239f4b81","observation_id":"91bae419-35f8-4a06-987b-eadb178dd4bf","resolution":{"observed_at":"2026-06-30T18:55:00.614674Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2605.24309","last_updated":"2026-05-23T00:36:48Z","snapshot_observed_at":"2026-08-16T21:16:05.326638Z","submitted_at":"2026-05-23T00:36:48Z","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-06-30T13:52:06.272229Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2605.24309"},"observation_digest":"sha256:0b9d70833d23b770743fa7749cbb48a987d51047174a1ca6b5d80226d9b59bdb","observation_id":"dc44d31b-78bd-47b2-8f94-db0762f749a9","resolution":{"observed_at":"2026-06-30T13:54:43.862943Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2605.28914","last_updated":"2026-05-27T17:48:14Z","snapshot_observed_at":"2026-08-13T01:49:06.223804Z","submitted_at":"2026-05-27T17:48:14Z","title":"AIRGuard: Guarding Agent Actions with Runtime Authority Control","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-06-29T11:27:11.944532Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2605.28914"},"observation_digest":"sha256:459b74399f4363859ea72312b897d99b7ab85eedbc4477c6518369854c024277","observation_id":"727f71f4-65f5-463d-aabb-c7f8ff8c006b","resolution":{"observed_at":"2026-06-29T12:53:27.162560Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2605.30686","last_updated":"2026-05-29T00:28:42Z","snapshot_observed_at":"2026-08-14T10:55:16.514822Z","submitted_at":"2026-05-29T00:28:42Z","title":"Depth-Dependent Indirect Prompt Injection in Tool-Calling ReAct Agents: Injection Depth, Payload Framing, and Turn-Budget Sensitivity","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-28T22:30:14.098291Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2605.30686"},"observation_digest":"sha256:e2c0e48a62e4032ff9e656dc53689f81ed85e996f39af4d51b7465a37b2bf5be","observation_id":"7b8f0d67-b24c-4feb-bfce-0496f8f3e59f","resolution":{"observed_at":"2026-06-28T22:32:43.991088Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2606.00566","last_updated":"2026-05-30T06:38:41Z","snapshot_observed_at":"2026-07-06T23:41:15.410587Z","submitted_at":"2026-05-30T06:38:41Z","title":"Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-06-28T19:19:17.673497Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2606.00566"},"observation_digest":"sha256:604db446d5faf2d25f0fb9ab27bda13b0cb4a09c369570724fd063687f0d8aef","observation_id":"87627205-3b01-4073-870b-ecf8c197cf77","resolution":{"observed_at":"2026-06-28T19:22:34.416763Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2606.20922","last_updated":"2026-06-18T20:31:08Z","snapshot_observed_at":"2026-08-03T14:06:23.532934Z","submitted_at":"2026-06-18T20:31:08Z","title":"Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-06-26T16:32:09.625729Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2606.20922"},"observation_digest":"sha256:695522e35486f368d4cac2800bf0c0725032aae9a659a759701062fe891a2478","observation_id":"e1954abd-ca21-444a-a120-b1ed758cffee","resolution":{"observed_at":"2026-07-04T04:59:36.379930Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2606.22864","last_updated":"2026-06-22T05:13:25Z","snapshot_observed_at":"2026-08-15T21:31:16.648634Z","submitted_at":"2026-06-22T05:13:25Z","title":"When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-06-26T09:05:22.096955Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2606.22864"},"observation_digest":"sha256:b65be8144a11b1598c9c731ffa26655105be343b605fff00154d04c925d680a8","observation_id":"d79a76aa-5e44-4487-b491-db217ecb54fc","resolution":{"observed_at":"2026-07-04T10:09:45.221940Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"MELON: Provable defense against indirect prompt injection attacks in AI agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:e5842d9fdd89ea52042ca904504008ab6da0615ba50eb1866c2463f45bea4ddd","observation_id":"fa054f62-2795-4ad7-98c8-6a2a4f9a53cc","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2607.05743","last_updated":"2026-07-07T01:56:18Z","snapshot_observed_at":"2026-08-06T20:18:50.545716Z","submitted_at":"2026-07-07T01:56:18Z","title":"The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-07-11T02:41:24.813416Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2607.05743"},"observation_digest":"sha256:350db1a3711c108e09226d384431900363bc6f1845c1cf827c539eea4d1a8656","observation_id":"8788fdd6-120c-41e7-ba17-e306332bd7e0","resolution":{"observed_at":"2026-07-11T02:47:50.246193Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-01T06:04:46.304739Z","title":"arXiv preprint arXiv:2502.05174 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.22024","last_updated":"2026-07-24T06:43:09Z","snapshot_observed_at":"2026-08-15T17:15:20.495803Z","submitted_at":"2026-07-24T06:43:09Z","title":"Agent Security Needs Redefinition through a Holistic Framework","version":1},"reference_index":206,"source":"arxiv_source","source_observed_at":"2026-08-01T06:04:46.304739Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2607.22024"},"observation_digest":"sha256:706da796e4eb95d7daab2327e5fb26419dedb777db821aa43609b9827b9133d1","observation_id":"7409786b-0f30-4634-bcd7-e1b343f720f1","resolution":{"observed_at":"2026-08-01T06:04:46.304739Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-04T22:27:22.453591Z","title":"InInternational Conference on Learning Representations","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01710","last_updated":"2026-08-03T05:16:02Z","snapshot_observed_at":"2026-08-18T00:29:58.544994Z","submitted_at":"2026-08-03T05:16:02Z","title":"Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-04T22:27:22.453591Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2608.01710"},"observation_digest":"sha256:70e47c1e4669a2fe446e3eb67e83658620497305b44b7da5f0e34969065bae55","observation_id":"f2ebbed9-42ad-4d66-a74d-b17e01676a42","resolution":{"observed_at":"2026-08-04T22:27:22.453591Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-08T00:51:38.030612Z","title":"arXiv preprint arXiv:2502.05174 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.04053","last_updated":"2026-08-04T10:41:34Z","snapshot_observed_at":"2026-08-14T17:28:05.631862Z","submitted_at":"2026-08-04T10:41:34Z","title":"AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection","version":1},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-08T00:51:38.030612Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2608.04053"},"observation_digest":"sha256:3c4c19ecd749754c928dd7903165ddc9a1c041cbd4cda89a0b363d5a461b5bf6","observation_id":"7de49ffb-9ea8-48b1-bdce-4bda27c3e421","resolution":{"observed_at":"2026-08-08T00:51:38.030612Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-08T13:19:01.988614Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05430","last_updated":"2026-08-05T21:44:44Z","snapshot_observed_at":"2026-08-17T21:06:22.654856Z","submitted_at":"2026-08-05T21:44:44Z","title":"Robust Context-Aware Detection of Malicious Instructions in Text","version":1},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-08T13:19:01.988614Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2608.05430"},"observation_digest":"sha256:72e50639c22d7925c65de96b71215d4cfb691c60f22d325390f8ece0cb275fc1","observation_id":"f4992c41-56f8-4f5f-aa4a-0a8bde72ae61","resolution":{"observed_at":"2026-08-08T13:19:01.988614Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-14T04:23:15.028834Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08939","last_updated":"2026-08-09T22:13:55Z","snapshot_observed_at":"2026-08-16T18:46:36.739662Z","submitted_at":"2026-08-09T22:13:55Z","title":"Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-14T04:23:15.028834Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2608.08939"},"observation_digest":"sha256:34bcaf5542b54408306b23741ce3424b227f4afacfa188fee76a9fe95654a2e0","observation_id":"54992195-e40d-41b8-bca5-1cc9f50365a6","resolution":{"observed_at":"2026-08-14T04:23:15.028834Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2502.05174/citation-record","integrity":"/paper/2502.05174/integrity","json":"/paper/2502.05174/citation-record.json","paper":"/paper/2502.05174"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.210635Z","title":"write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.210635Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:9f337c10bbc8857ae40bfc064aa48238eeb1235dd4a89a42fd9fdace8090043c","observation_id":"bf1d06bc-9a3e-448a-8ba7-829bd0768f4e","resolution":{"observed_at":"2026-08-08T20:06:58.210635Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.970359Z","title":"https://learnprompting.org/docs/prompt_hacking/defensive_measures/sandwich_defense, 2023","venue":null,"work_id":"b3647284-abc6-4662-9e9e-df53b9457931","year":2023},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.216987Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:3a0e0faca1d35630e86a639f227bda3c3baad9a8f26981fbbb0b5d46aeb3d5fe","observation_id":"dea9f8ed-8631-4d93-a512-34e00a5d8c8f","resolution":{"observed_at":"2026-08-08T20:06:58.975034Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.956587Z","title":"Claude 3.5 models and computer use, 2024","venue":null,"work_id":"dfefd7cf-c0ff-4a3d-b111-80a66cba8ae0","year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.222289Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:ae5bcc347a9af817b905c02c42a1f5034d76b012e9e43030d45e769c783657fe","observation_id":"7b77f22d-bffb-416f-a020-46cc078078a2","resolution":{"observed_at":"2026-08-08T20:06:58.961017Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-08-16T14:19:54.814069Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-08-08T20:06:58.227628Z","title":"Struq: Defending against prompt injection with structured queries","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.227628Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:9790676e0e8a564e682c77917fb1f330faf15bcfb5b497dfaf235cc23ad862af","observation_id":"b80735f8-ab6a-4cc9-9bf5-ddab069b1e30","resolution":{"observed_at":"2026-08-08T20:06:58.227628Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.05451","last_updated":"2025-07-03T05:45:41Z","snapshot_observed_at":"2026-08-16T13:11:45.940997Z","submitted_at":"2024-10-07T19:34:35Z","title":"SecAlign: Defending Against Prompt Injection with Preference Optimization","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.05451","snapshot_observed_at":"2026-08-08T20:06:58.233116Z","title":"Aligning llms to be robust against prompt injection","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.233116Z"},"links":{"cited_paper":"/paper/2410.05451","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:d34808e941f68604044d0747978e9a5555aeed1a11b476956773bcc44b0d2622","observation_id":"9dae070a-56be-4e5f-b63a-539284747a04","resolution":{"observed_at":"2026-08-08T20:06:58.233116Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.941972Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents","venue":null,"work_id":"1f7408d4-df0c-4c80-8d14-a824a0e09f5a","year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.238658Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:9da3afd47c7894445e1189dee5662e1095fbde51070876c38616e9d6fc084c2d","observation_id":"84b70a05-e67c-4f99-960d-baf286abf793","resolution":{"observed_at":"2026-08-08T20:06:58.946981Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.927799Z","title":"Deepseek function calling guide","venue":null,"work_id":"c93d6c29-1f5b-4c5b-bc5c-74ec3a15a00a","year":2025},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.243672Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:b3f240080264d3d7ee633959ebf511a6f6cbe798bcbda9b671e6a6161dc68fd0","observation_id":"292d00cc-2e23-4846-914f-3dc3ae942497","resolution":{"observed_at":"2026-08-08T20:06:58.932465Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-08-16T09:49:03.438566Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-08-08T20:06:58.248872Z","title":"Defending against indirect prompt injection attacks with spotlighting","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.248872Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:9554de46045da78124b47cd8172312d226d758bd90c7d4bcd9d700317130bec1","observation_id":"223ee63e-2043-45f2-bff2-5f55c802e61d","resolution":{"observed_at":"2026-08-08T20:06:58.248872Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-08-17T16:58:11.267710Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-08-08T20:06:58.253925Z","title":"H., Chen, P.-Y., et al","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.253925Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:e7adba3177297795a4bb812b473e82e42638c7db72bd4c6df1cf29ae7b6c93f3","observation_id":"b1dc6c89-9d97-48be-a6eb-b3b54354f6ec","resolution":{"observed_at":"2026-08-08T20:06:58.253925Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06674","last_updated":"2023-12-07T19:40:50Z","snapshot_observed_at":"2026-08-14T15:42:19.849118Z","submitted_at":"2023-12-07T19:40:50Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.06674","snapshot_observed_at":"2026-08-08T20:06:58.258918Z","title":"Llama guard: Llm-based input-output safeguard for human-ai conversations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.258918Z"},"links":{"cited_paper":"/paper/2312.06674","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:d22541d79067c88376adcc0e1e3f9179f290fbb61c8fa9b2047ca644c2148416","observation_id":"6975a179-af4f-48af-95dc-e328b3791da9","resolution":{"observed_at":"2026-08-08T20:06:58.258918Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.11295","last_updated":"2025-03-12T20:54:00Z","snapshot_observed_at":"2026-08-16T13:17:47.038379Z","submitted_at":"2024-09-17T15:49:44Z","title":"EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.11295","snapshot_observed_at":"2026-08-08T20:06:58.263834Z","title":"Eia: Environmental injection attack on generalist web agents for privacy leakage","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.263834Z"},"links":{"cited_paper":"/paper/2409.11295","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:ac6974a3a057aa30523103aeb61bf021101aba62ede51bafeff96d7b27097f72","observation_id":"81c623e0-dee3-419b-9334-f00aa2f7ef84","resolution":{"observed_at":"2026-08-08T20:06:58.263834Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.913050Z","title":null,"venue":null,"work_id":"21c73211-fd00-4f7a-bcc2-a9c61942f181","year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.269070Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:d4b10f43bcf1eab3f53532abc73fb13f0e59e30702d8558096cf7ad4c9c2cbe2","observation_id":"f927fbde-b04d-4b53-8ffb-d1a5ce0c29d2","resolution":{"observed_at":"2026-08-08T20:06:58.917814Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.898344Z","title":"Llama3.3 model cards, 2024","venue":null,"work_id":"5214dd48-0bd8-40b4-bc71-b45e8fa00e12","year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.273661Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:cbff295ed37ef889afd77282887070179df873c448fec91556d75c4736dc5f45","observation_id":"2958124b-7daa-4ad6-9b3d-69e447113e6f","resolution":{"observed_at":"2026-08-08T20:06:58.902871Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.884048Z","title":"Ultimate ChatGPT prompt engineering guide for general users and developers","venue":null,"work_id":"8f18dd5c-c0bd-439c-b2e8-8486b5f97aaa","year":2023},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.278368Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:6b699ce8f6f0fd70697f3d8b4f92dcada2ade2ac7886ea418486752d834dac2c","observation_id":"2300653e-959b-4b9f-81f3-71f10a7ff7dc","resolution":{"observed_at":"2026-08-08T20:06:58.888824Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.10538","last_updated":"2023-12-03T13:18:09Z","snapshot_observed_at":"2026-08-16T14:42:23.503802Z","submitted_at":"2023-11-17T14:06:05Z","title":"Testing Language Model Agents Safely in the Wild","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.10538","snapshot_observed_at":"2026-08-08T20:06:58.282814Z","title":"T., and Bau, D","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.282814Z"},"links":{"cited_paper":"/paper/2311.10538","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:da5b5c576d93defa23089ab485f3dc0a2547911ffc10753536d811978a9bb125","observation_id":"3c8a0ba8-6613-4941-80b3-81b203a0e047","resolution":{"observed_at":"2026-08-08T20:06:58.282814Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.869885Z","title":"Openai text embeddings, 2024","venue":null,"work_id":"56a0e9d6-2f5f-4e2f-b143-6236fbbd9c1e","year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.287513Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:59d95f2a482f5ad708468e90eebd6ce38447761f9f10875075ee8920c5a2cc42","observation_id":"e8786f57-27dc-434f-9fea-c06eba48afa7","resolution":{"observed_at":"2026-08-08T20:06:58.874469Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.855179Z","title":"Openai function calling guide, 2024","venue":null,"work_id":"2623d0db-4025-4ba1-b95f-59c1fa03f649","year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.292137Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:284a8b61ea452bbf6e40e8952c79bb00421afb045b4d5696b7e097927063c081","observation_id":"4d3cfb36-3fbd-498f-a0ef-efef24db98f6","resolution":{"observed_at":"2026-08-08T20:06:58.859955Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.06921","last_updated":"2024-04-10T11:17:33Z","snapshot_observed_at":"2026-08-16T14:02:06.887579Z","submitted_at":"2024-04-10T11:17:33Z","title":"GoEX: Perspectives and Designs Towards a Runtime for Autonomous LLM Applications","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.06921","snapshot_observed_at":"2026-08-08T20:06:58.296667Z","title":"G., Zhang, T., Fang, V., Huang, R., Hao, A., Casado, M., Gonzalez, J","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.296667Z"},"links":{"cited_paper":"/paper/2404.06921","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:5195894c727517fe4f3207b1aae9f50fc6d384dfc1f5a0d8f9d507b4695e8cde","observation_id":"ed056a33-5c43-4096-9f46-5aad6e97aea0","resolution":{"observed_at":"2026-08-08T20:06:58.296667Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.840092Z","title":"and Ribeiro, I","venue":null,"work_id":"1a3701bf-2060-4598-a9ee-d1fbc61fdd49","year":2022},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.301706Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:c968c07cd8b041e62504867bbd07864b13facf9c37b479d58719dac40adb4983","observation_id":"15640117-b63f-482d-acfd-5ba149c2421a","resolution":{"observed_at":"2026-08-08T20:06:58.844863Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.824066Z","title":"Fine-tuned deberta-v3-base for prompt injection detection, 2024","venue":null,"work_id":"ca565476-6810-4f4f-b0b5-0e72ceecb0f4","year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.306771Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:316008c43f6a44094c65b983df2a1a09a8ee56566348eeb3a94524ce7b46f0b1","observation_id":"fa310591-321c-4cb8-9946-08b5fb4d3ea7","resolution":{"observed_at":"2026-08-08T20:06:58.829647Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.809176Z","title":"J., and Hashimoto, T","venue":null,"work_id":"644284db-bf47-48b0-aced-866179250828","year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.311563Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:9fbff61190c1d14c7e330d569a6554048a4ecb07f8f604c50f8fd12034bd6d20","observation_id":"b9f42e10-c581-4f3f-9cea-e68f9267f892","resolution":{"observed_at":"2026-08-08T20:06:58.813875Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.316068Z","title":"Ignore this title and H ack AP rompt: Exposing systemic vulnerabilities of LLM s through a global prompt hacking competition","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.316068Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:45a39d1c93623d7810d6c12071f1d3412f19f85682def77648e815f8629103d5","observation_id":"bab47efd-26d4-4e4e-87e7-df91a32a3d55","resolution":{"observed_at":"2026-08-08T20:06:58.316068Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.793462Z","title":"A., Svegliato, J., Bailey, L., Wang, T., Ong, I., Elmaaroufi, K., Abbeel, P., Darrell, T., Ritter, A., and Russell, S","venue":null,"work_id":"945e74b2-e899-478e-9321-8d45eb70b760","year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.321013Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:6f3eab94fefe95b2621cd429cfd11b12b11cc941962e7fdbc8b5db5a52d262fa","observation_id":"f52a6040-3dc9-475a-a901-78344b38a012","resolution":{"observed_at":"2026-08-08T20:06:58.798731Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-11T23:45:02.178667Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-08T20:06:58.325586Z","title":"The instruction hierarchy: Training llms to prioritize privileged instructions","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.325586Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:08857eceb8bc8b6882186ea69953743945a4e0059ed9a3c23ab3f952e9deb0f6","observation_id":"ee407b4a-e4f6-47c2-b901-5d6f7b07b83b","resolution":{"observed_at":"2026-08-08T20:06:58.325586Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.777589Z","title":"Prompt injection attacks against GPT-3","venue":null,"work_id":"15c6867c-d2ea-43d4-96cb-03c718605d0e","year":2022},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.330790Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:62fd77ba8ac69b2497b19f19961f082adb1c9013837f006f80779c63bb32b0c9","observation_id":"6b492243-a40a-46b2-99eb-196c045e6598","resolution":{"observed_at":"2026-08-08T20:06:58.782338Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.762982Z","title":"Delimiters won’t save you from prompt injection","venue":null,"work_id":"5ac004f2-9079-4a83-98a7-e18234aefc7e","year":2023},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.335473Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:1ab3ca79532fc3bbbe8c968f2637f4c666d5c2a9180d9602c18b8baa2904b140","observation_id":"f2a6f917-3765-4e79-9c51-501658165f08","resolution":{"observed_at":"2026-08-08T20:06:58.767633Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.12814","last_updated":"2025-02-04T20:02:17Z","snapshot_observed_at":"2026-08-16T13:41:44.544093Z","submitted_at":"2024-06-18T17:32:48Z","title":"Dissecting Adversarial Robustness of Multimodal LM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.12814","snapshot_observed_at":"2026-08-08T20:06:58.339855Z","title":"H., Koh, J","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.339855Z"},"links":{"cited_paper":"/paper/2406.12814","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:9d953167e9e3e0b106f38d558b8ae9780d1538951e85d5b5836506f0c7f742ff","observation_id":"6a90feb9-8f8c-46df-9d07-11fed6300970","resolution":{"observed_at":"2026-08-08T20:06:58.339855Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.19091","last_updated":"2024-10-10T15:29:07Z","snapshot_observed_at":"2026-08-16T18:58:20.908041Z","submitted_at":"2024-09-27T18:41:58Z","title":"System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.19091","snapshot_observed_at":"2026-08-08T20:06:58.344908Z","title":"System-level defense against indirect prompt injection attacks: An information flow control perspective","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.344908Z"},"links":{"cited_paper":"/paper/2409.19091","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:7017433b823c6e5fac09dac5d6d01f69375fc08571870d295a3e4306472f6ba1","observation_id":"90c09a10-0c7b-4026-acca-d88284c82bed","resolution":{"observed_at":"2026-08-08T20:06:58.344908Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.18649","last_updated":"2024-02-28T19:00:12Z","snapshot_observed_at":"2026-08-16T14:14:24.016527Z","submitted_at":"2024-02-28T19:00:12Z","title":"A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systems","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.18649","snapshot_observed_at":"2026-08-08T20:06:58.349652Z","title":"A new era in llm security: Exploring security concerns in real-world llm-based systems","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.349652Z"},"links":{"cited_paper":"/paper/2402.18649","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:3c5569dffe4f9a7c0f70b7e93e76ef3f3f93f0f775a77548c41fce8372c3239d","observation_id":"3d187030-68c4-41d5-8272-38aaf24193f0","resolution":{"observed_at":"2026-08-08T20:06:58.349652Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.748163Z","title":"IsolateGPT: An Execution Isolation Architecture for LLM-Based Systems","venue":null,"work_id":"25fa745f-b6dd-4115-a5c8-966aa7ff3c0d","year":2025},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.354320Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:54134bcce3ead4823c5297a9ef15b49010c074f6192ab10ad9e8253b9538d91d","observation_id":"f395f473-974b-4c1b-90aa-e96b3dcf682c","resolution":{"observed_at":"2026-08-08T20:06:58.752762Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.17401","last_updated":"2025-05-31T18:34:01Z","snapshot_observed_at":"2026-08-16T13:06:50.874384Z","submitted_at":"2024-10-22T20:18:26Z","title":"AdvAgent: Controllable Blackbox Red-teaming on Web Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.17401","snapshot_observed_at":"2026-08-08T20:06:58.358737Z","title":"Advweb: Controllable black-box attacks on vlm-powered web agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.358737Z"},"links":{"cited_paper":"/paper/2410.17401","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:4179f787a2efe256c2d4b9ddd64229ca1808c80f38ea2e4ebf40fbd97f1c14b4","observation_id":"51c834a0-bcc7-4ef8-ae66-97d23a97fdcf","resolution":{"observed_at":"2026-08-08T20:06:58.358737Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.11538","last_updated":"2024-05-25T05:32:39Z","snapshot_observed_at":"2026-08-16T14:41:58.337813Z","submitted_at":"2023-11-20T04:56:46Z","title":"Assessing Prompt Injection Risks in 200+ Custom GPTs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.11538","snapshot_observed_at":"2026-08-08T20:06:58.363694Z","title":"Assessing prompt injection risks in 200+ custom gpts","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.363694Z"},"links":{"cited_paper":"/paper/2311.11538","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:7648aad944f5523e49c4af5d9598d8af454ea8c501ea2512b06a01b264e34dab","observation_id":"a54c5ddd-84e9-4792-90b9-959a80102c65","resolution":{"observed_at":"2026-08-08T20:06:58.363694Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.733246Z","title":"R-judge: Benchmarking safety risk awareness for LLM agents","venue":null,"work_id":"cc1f21d5-5c1c-488c-9769-01f53f5c8740","year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.368510Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:de786709c199eec91a39a7619d27a6850f916186bb3ac661365616b4f2b1aa7d","observation_id":"9728db56-fcdf-4bc8-9110-f538457876f7","resolution":{"observed_at":"2026-08-08T20:06:58.737887Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.372999Z","title":"I njec A gent: Benchmarking indirect prompt injections in tool-integrated large language model agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.372999Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:feba3ea3f2e0b5f1fac39a7d6c6d2eac706a2c75d3e330d5d2a7b82a90453d5b","observation_id":"b9ef8ef5-a886-4dba-b054-fc56eaea1a55","resolution":{"observed_at":"2026-08-08T20:06:58.372999Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.02644","last_updated":"2025-05-30T03:50:33Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-03T16:30:47Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.02644","snapshot_observed_at":"2026-08-08T20:06:58.377603Z","title":"Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.377603Z"},"links":{"cited_paper":"/paper/2410.02644","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:610366a2907f18c6def732390d18b786804bbfcf4cb79107b60c0d2c2c097597","observation_id":"68c84e93-8235-4f7b-91ac-d9b1d83476b2","resolution":{"observed_at":"2026-08-08T20:06:58.377603Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.715646Z","title":"Attacking vision-language computer agents via pop-ups, 2024 b","venue":null,"work_id":"a8a53daa-afe6-4257-8d9f-db4e14ee6c17","year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.382660Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:ca8ec8318052af00359f3555ad0ab5d1bf7925d6a85c5e631d03e06707ef0da8","observation_id":"4dbf589f-f2cd-4380-a814-c3ac8c22a68a","resolution":{"observed_at":"2026-08-08T20:06:58.722556Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T20:06:58.387249Z","title":"Poisoning retrieval corpora by injecting adversarial passages","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.387249Z"},"links":{"citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:e9fa96eca044802b12d60b8c5bd07d5cf474c92509f58372b7f7adfd6bab075e","observation_id":"6e8a3080-e8a4-4803-9599-75eaf82c2e79","resolution":{"observed_at":"2026-08-08T20:06:58.387249Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-08T20:06:58.391995Z","title":"Z., and Fredrikson, M","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.391995Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:995183fd959f68e71414c4cd6275a05d1449587f28af5dd711a9ed60a306c47f","observation_id":"2ec90ab3-1ff6-4bcb-9c8a-40b346d24fd5","resolution":{"observed_at":"2026-08-08T20:06:58.391995Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.07867","last_updated":"2024-08-13T01:55:06Z","snapshot_observed_at":"2026-08-16T14:19:14.608461Z","submitted_at":"2024-02-12T18:28:36Z","title":"PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.07867","snapshot_observed_at":"2026-08-08T20:06:58.396831Z","title":"Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.396831Z"},"links":{"cited_paper":"/paper/2402.07867","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:b14fe2f7c73112647b14efd749e458c40533993df795a4dcc4ad602a67fdba79","observation_id":"27efaa9a-50aa-4e30-87aa-399eeb3fc73b","resolution":{"observed_at":"2026-08-08T20:06:58.396831Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","latest_version":4,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents"},"reference_resolution":{"displayed":39,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":22,"verified_exact":0,"verified_fuzzy":17},"total_outbound_references":39},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"thesis":"As of 18 August 2026, this Paper Citation Record lists 39 of 39 outbound references and 27 inbound Pith citation observations for arXiv:2502.05174."}