{"as_of":"2026-08-20T16:52:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:83d55fb8c59c0f092eb3c152cbf2d8376cb4316b7c19538fcbfebea6a56eef21","coverage":[{"denominator":58,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":58,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T23:09:36.738179Z","state":"measured"},{"denominator":95,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":95,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-20T06:33:59.587034+00:00","state":"measured"},{"denominator":37,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":37,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-16T00:16:52.643873Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"pith","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":3,"observed_at":"2026-08-05T02:28:24.338817Z","source":"pith"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2503.21460","last_updated":"2025-03-27T12:50:17Z","snapshot_observed_at":"2026-07-06T20:59:35.694800Z","submitted_at":"2025-03-27T12:50:17Z","title":"Large Language Model Agent: A Survey on Methodology, Applications and Challenges","version":1},"reference_index":208,"source":"pdf_text","source_observed_at":"2026-05-22T21:51:34.309870Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2503.21460"},"observation_digest":"sha256:0584793c9b05e701c78c26329d4434f9a45266588671d947241061b658a40bcc","observation_id":"bb8c9278-c915-4f58-beae-9a1df8b8b52e","resolution":{"observed_at":"2026-05-22T21:52:10.238901Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2504.20472","last_updated":"2026-04-09T06:57:42Z","snapshot_observed_at":"2026-08-13T08:12:27.488850Z","submitted_at":"2025-04-29T07:13:53Z","title":"Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-05-22T19:10:55.009810Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2504.20472"},"observation_digest":"sha256:ed8ef0d905fd8c5ea966fbf8d38429208d2f81a06fbde7eda66b7e850a9f8968","observation_id":"3de2c449-a3f9-4009-97aa-7f6d90a333e3","resolution":{"observed_at":"2026-05-22T19:11:58.042158Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-07T12:42:17.059726Z","title":"Rtbas: Defending LLM agents against prompt injection and privacy leakage.arXiv preprint arXiv:2502.08966, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.24019","last_updated":"2025-05-29T21:39:08Z","snapshot_observed_at":"2026-08-07T20:58:14.169872Z","submitted_at":"2025-05-29T21:39:08Z","title":"LLM Agents Should Employ Security Principles","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-07T12:42:17.059726Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2505.24019"},"observation_digest":"sha256:61c9883717885b6b73e8a103dc1393f7e9882c660bcfb35ba041e56e1962a052","observation_id":"4755f0c4-0df9-493b-bc87-041b609ba668","resolution":{"observed_at":"2026-08-07T12:42:17.059726Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-07T11:59:27.473122Z","title":"Titzer, Heather Miller, and Phillip B","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.01055","last_updated":"2025-06-01T15:48:06Z","snapshot_observed_at":"2026-08-15T10:52:39.381322Z","submitted_at":"2025-06-01T15:48:06Z","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-07T11:59:27.473122Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2506.01055"},"observation_digest":"sha256:bb75178f0379402b53f71f2f398c7cdde9f32c703199dae7f12bf1f6ad91794a","observation_id":"d1a3eb34-1cae-49ac-a1e5-9a5996482d17","resolution":{"observed_at":"2026-08-07T11:59:27.473122Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T22:51:28.187021Z","title":"Y.; Chen, S.; Wang, R.; McCall, M.; Titzer, B","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2508.06418","last_updated":"2025-08-08T16:05:27Z","snapshot_observed_at":"2026-08-08T12:59:56.859606Z","submitted_at":"2025-08-08T16:05:27Z","title":"Quantifying Conversation Drift in MCP via Latent Polytope","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-05T22:51:28.187021Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2508.06418"},"observation_digest":"sha256:91c9c3c8b2448933b244081ca53ce64d0a883f3e0d8a80d70c9a646d0c5f9b48","observation_id":"afccdfc2-6a61-4588-ae1d-7caaa7ddc689","resolution":{"observed_at":"2026-08-05T22:51:28.187021Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-03T10:32:33.909110Z","title":"Peter Yong Zhong, Siyuan Chen, Ruiqi Wang, McKenna McCall, Ben L Titzer, Heather Miller, and Phillip B Gibbons","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2601.09923","last_updated":"2026-06-04T15:38:02Z","snapshot_observed_at":"2026-08-19T21:09:59.831114Z","submitted_at":"2026-01-14T23:06:35Z","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","version":3},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-03T10:32:33.909110Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2601.09923"},"observation_digest":"sha256:3b6fc138987add42c7d99d3b760bcf137387800f451e3f74059f5f9152895e44","observation_id":"5d2d8ec6-39d3-4c27-b4f2-b2f48f2fbdce","resolution":{"observed_at":"2026-08-03T10:32:33.909110Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2602.03117","last_updated":"2026-05-07T07:42:14Z","snapshot_observed_at":"2026-08-11T14:17:58.581691Z","submitted_at":"2026-02-03T05:20:42Z","title":"AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?","version":3},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-16T08:13:33.928054Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2602.03117"},"observation_digest":"sha256:0a05c7c831c0abc77bc78983c893ff7cb0dd48e203a33d513d20b151b5a037db","observation_id":"cfe75a82-e001-4659-9aef-3bed1f25ec63","resolution":{"observed_at":"2026-05-16T08:17:36.456679Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2604.04035","last_updated":"2026-04-05T09:28:51Z","snapshot_observed_at":"2026-08-17T13:37:19.234244Z","submitted_at":"2026-04-05T09:28:51Z","title":"Causality Laundering: Denial-Feedback Leakage in Tool-Calling LLM Agents","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-13T17:19:32.255377Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2604.04035"},"observation_digest":"sha256:50538ab8a8c4f96822ce9b079efa8d0fe504254f5ac5728ee97df3fb9a56dbcb","observation_id":"e824a791-b449-450c-8ec3-5ebba32de1ab","resolution":{"observed_at":"2026-05-13T17:23:02.729426Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2604.15579","last_updated":"2026-07-05T22:49:32Z","snapshot_observed_at":"2026-08-14T07:57:45.254150Z","submitted_at":"2026-04-16T23:18:22Z","title":"Don't Make Models Guess Security and Safety: Symbolic Guardrails for Domain-Specific AI Agents","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-05-10T10:15:27.926105Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2604.15579"},"observation_digest":"sha256:e6cde8d908c4058a419e57462f34b8be99d51ce63389551cf6465303ef55f3e7","observation_id":"889266f4-42fe-4caf-8724-a49908aae6ba","resolution":{"observed_at":"2026-05-10T10:24:22.255308Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2604.19657","last_updated":"2026-04-21T16:45:30Z","snapshot_observed_at":"2026-08-13T13:06:09.080226Z","submitted_at":"2026-04-21T16:45:30Z","title":"An AI Agent Execution Environment to Safeguard User Data","version":1},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-05-10T02:14:40.639143Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2604.19657"},"observation_digest":"sha256:258cd19dc1882f1afbb6062f456bc542e6097417fa855c594a05d3d292c7d323","observation_id":"f72f3970-041a-47bd-a996-ddeec1a92ee4","resolution":{"observed_at":"2026-05-11T13:11:05.836253Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2604.23374","last_updated":"2026-04-25T16:39:16Z","snapshot_observed_at":"2026-08-15T03:12:46.423691Z","submitted_at":"2026-04-25T16:39:16Z","title":"Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-05-08T08:08:24.524671Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2604.23374"},"observation_digest":"sha256:7601d2eb607104d8989582914a088bfbe03914f692b56cc60a1758c6d0dd98c0","observation_id":"ed8708f0-3a77-45fe-b2fa-0a8fa60a5e7d","resolution":{"observed_at":"2026-05-08T22:39:20.560351Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2605.00314","last_updated":"2026-05-01T00:48:47Z","snapshot_observed_at":"2026-08-12T21:52:39.015520Z","submitted_at":"2026-05-01T00:48:47Z","title":"Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-05-09T19:58:28.584941Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2605.00314"},"observation_digest":"sha256:40f9a1ac3d67946d6169a6b6d41e252bfed52c3b34ebf0271ff1ab66c958427e","observation_id":"2125e95c-ae4c-46ba-bd5a-5b6900e9d503","resolution":{"observed_at":"2026-05-11T15:26:11.075385Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2605.03129","last_updated":"2026-05-04T20:13:22Z","snapshot_observed_at":"2026-08-11T18:37:10.771052Z","submitted_at":"2026-05-04T20:13:22Z","title":"PIIGuard: Mitigating PII Harvesting under Adversarial Sanitization","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-08T17:49:39.533090Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2605.03129"},"observation_digest":"sha256:030ffaeccb60e4451df228d2660470a9bdc81bf90248aeccb25ce16d6b8b6ef2","observation_id":"89038650-9305-4b6f-8841-ff7a5ebcdb6b","resolution":{"observed_at":"2026-05-08T17:53:53.279055Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2605.03213","last_updated":"2026-05-07T16:46:43Z","snapshot_observed_at":"2026-08-19T04:50:05.742324Z","submitted_at":"2026-05-04T23:09:16Z","title":"When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-05-07T02:12:30.086152Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2605.03213"},"observation_digest":"sha256:26f548ec29a4bb38a2cb7e1f3008fc4f7004ae008ba6377f3820b878a75aab9d","observation_id":"4d8997e7-20e6-4b4a-869a-5cc7a0faa4d7","resolution":{"observed_at":"2026-05-12T10:46:31.618660Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2605.03213","last_updated":"2026-05-07T16:46:43Z","snapshot_observed_at":"2026-08-19T04:50:05.742324Z","submitted_at":"2026-05-04T23:09:16Z","title":"When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI","version":2},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-05-08T17:56:09.884837Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2605.03213"},"observation_digest":"sha256:906f829a94246819661dd7e0d10c1a5fa1e20cfec10221af505e1d0d1176f4fd","observation_id":"c983bbf0-71f7-4455-8318-13798820fb44","resolution":{"observed_at":"2026-05-09T06:55:44.561705Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2605.24309","last_updated":"2026-05-23T00:36:48Z","snapshot_observed_at":"2026-08-16T21:16:05.326638Z","submitted_at":"2026-05-23T00:36:48Z","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-06-30T13:52:06.272229Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2605.24309"},"observation_digest":"sha256:7d45e43ae603f8e0a67b9a1991ad665c8c4eca9a5264e06d74f37c8a9433627e","observation_id":"15b8949e-8444-43db-83b9-e9b6657c0e10","resolution":{"observed_at":"2026-06-30T13:54:43.881131Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2605.26497","last_updated":"2026-05-26T03:20:23Z","snapshot_observed_at":"2026-08-11T10:23:59.168251Z","submitted_at":"2026-05-26T03:20:23Z","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-06-29T17:36:40.290498Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2605.26497"},"observation_digest":"sha256:e7c240ee95cdbd617d0b0a17dd75c5399014bf74039722d7707efd93c1ff084d","observation_id":"f2968074-18cf-4836-b8ab-a1132d6dcb92","resolution":{"observed_at":"2026-06-29T18:03:48.509291Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2605.28914","last_updated":"2026-05-27T17:48:14Z","snapshot_observed_at":"2026-08-13T01:49:06.223804Z","submitted_at":"2026-05-27T17:48:14Z","title":"AIRGuard: Guarding Agent Actions with Runtime Authority Control","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-06-29T11:27:11.944532Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2605.28914"},"observation_digest":"sha256:c1df83990ebec9d09a4b24f14abbe91dafdbef6a4075b609667aac1c47d86bea","observation_id":"f4ee1d49-2a26-4813-891a-45aaada12f46","resolution":{"observed_at":"2026-06-29T12:53:27.150378Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2605.29224","last_updated":"2026-05-28T01:23:48Z","snapshot_observed_at":"2026-08-16T16:06:47.494825Z","submitted_at":"2026-05-28T01:23:48Z","title":"Relevance as a Vulnerability: How Web Retrieval Degrades Safety Alignment in LLM Agents","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-06-29T08:21:44.993917Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2605.29224"},"observation_digest":"sha256:76f62f642da832b08760515b1e77f2327722a8bd265980b95544509575919541","observation_id":"3ff414f6-8af9-4fda-902b-c7e1d2c13121","resolution":{"observed_at":"2026-06-29T08:23:14.888499Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2606.02483","last_updated":"2026-06-01T16:53:19Z","snapshot_observed_at":"2026-08-13T22:14:53.192025Z","submitted_at":"2026-06-01T16:53:19Z","title":"Ghost Tool Calls: Issue-Time Privacy for Speculative Agent Tools","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-06-28T13:46:11.765116Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2606.02483"},"observation_digest":"sha256:3d131a2de22a52e6a0aa3000135fcdbe3040f39d777c99ffa2f0465a79dae654","observation_id":"d67d0e00-d1b5-41ec-b992-02a653b76759","resolution":{"observed_at":"2026-06-28T14:42:18.230738Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2606.09549","last_updated":"2026-06-08T14:29:01Z","snapshot_observed_at":"2026-08-17T20:58:32.899354Z","submitted_at":"2026-06-08T14:29:01Z","title":"SecureClaw: Clawing Back Control of LLM Agents","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-06-27T16:26:01.286610Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2606.09549"},"observation_digest":"sha256:809d26d355ce757bec19c0c0d18cdabd23a978372bfd0ef0343870afa903a331","observation_id":"8ca0a012-5ed1-4940-8e35-707412bf006a","resolution":{"observed_at":"2026-07-03T01:37:30.746835Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-17T21:16:08.248641Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:3786c2c017a43a177b405aa655eb86cb2d33e078c7464389b12327d8b4f819a6","observation_id":"23bc665b-1513-4c67-8076-ab33edaecd18","resolution":{"observed_at":"2026-07-03T06:17:41.876038Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2606.10749","last_updated":"2026-06-09T12:01:07Z","snapshot_observed_at":"2026-08-14T19:50:49.492797Z","submitted_at":"2026-06-09T12:01:07Z","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","version":1},"reference_index":255,"source":"pdf_text","source_observed_at":"2026-06-27T12:55:22.831264Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2606.10749"},"observation_digest":"sha256:4f9f79e33b6ed7611b89b410a55e31f9dc6cb6edf009805df0ac84d281d900ef","observation_id":"5e84c857-4e4b-4856-80bc-499d91357c64","resolution":{"observed_at":"2026-06-27T13:20:56.872177Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2606.12341","last_updated":"2026-06-10T17:13:35Z","snapshot_observed_at":"2026-08-14T10:25:30.408531Z","submitted_at":"2026-06-10T17:13:35Z","title":"OCELOT: Inference-Leakage Budgets for Privacy-Preserving LLM Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-06-27T09:11:42.204778Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2606.12341"},"observation_digest":"sha256:3adf172aac1c270547f8e53b3cd7070b5197f8ec12fd314b3775c06091707c79","observation_id":"4ed535c9-1144-424a-9307-3c20744aa829","resolution":{"observed_at":"2026-07-03T11:58:06.930341Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2606.23277","last_updated":"2026-06-22T12:54:04Z","snapshot_observed_at":"2026-08-15T15:18:54.393608Z","submitted_at":"2026-06-22T12:54:04Z","title":"GIF: Locally Sound Geometric Information Flow Control for LLMs","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-26T08:24:49.908288Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2606.23277"},"observation_digest":"sha256:e323bb352db5c07999f08ace5aef8a9b9c8e764e4ff16ffc8a3cb5ba4acc188b","observation_id":"8d49e100-8e40-44b2-a0ec-152792d33054","resolution":{"observed_at":"2026-07-04T10:49:46.735990Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2606.26479","last_updated":"2026-06-25T00:35:23Z","snapshot_observed_at":"2026-07-07T00:00:46.505337Z","submitted_at":"2026-06-25T00:35:23Z","title":"Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-06-26T04:58:59.046289Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2606.26479"},"observation_digest":"sha256:a80bf550c23fe63f1e4bdbf08020b6696980136cfa5b5b622972e3d534a2db4a","observation_id":"61facb60-add7-4507-8e20-d8a5151dbc76","resolution":{"observed_at":"2026-07-04T13:39:51.335715Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2606.26627","last_updated":"2026-06-25T05:44:18Z","snapshot_observed_at":"2026-08-14T08:17:57.360957Z","submitted_at":"2026-06-25T05:44:18Z","title":"Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents","version":1},"reference_index":133,"source":"pdf_text","source_observed_at":"2026-06-26T04:29:16.386339Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2606.26627"},"observation_digest":"sha256:4a6f65ff717b9a07ef38be2a34e37512ca86451a9fe51d29dc8057974d593316","observation_id":"68134e5b-cb3b-4981-80b9-fb64ac43457c","resolution":{"observed_at":"2026-07-04T14:09:53.128363Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2606.28061","last_updated":"2026-06-26T13:08:46Z","snapshot_observed_at":"2026-08-07T03:21:29.426876Z","submitted_at":"2026-06-26T13:08:46Z","title":"ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-06-29T03:44:48.288444Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2606.28061"},"observation_digest":"sha256:540e9cd9bc1cc38de14ae8dc2b93fa6c73aed09098923a62e191a31843d42940","observation_id":"a647f80e-0495-4430-93fa-92f54cb5c1d6","resolution":{"observed_at":"2026-07-01T17:25:51.826373Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2607.02357","last_updated":"2026-07-03T12:34:17Z","snapshot_observed_at":"2026-08-12T16:46:46.071117Z","submitted_at":"2026-07-02T16:00:52Z","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-07-03T10:28:59.762796Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2607.02357"},"observation_digest":"sha256:3bdcc5b4ed6dd6b08b3dfad9ec4c1067df905d553b0e1c933f55ecc432aeaed4","observation_id":"38ed1a0b-f2b5-48e9-b0d9-2aa1dbaad83c","resolution":{"observed_at":"2026-07-03T10:37:56.234656Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-07-12T08:09:57.596812Z","title":"RTBAS: Defending LLM agents against prompt injection and privacy leakage,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.02357","last_updated":"2026-07-03T12:34:17Z","snapshot_observed_at":"2026-08-12T16:46:46.071117Z","submitted_at":"2026-07-02T16:00:52Z","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-07-12T08:09:57.596812Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2607.02357"},"observation_digest":"sha256:f7434f3eabdc40558f04b2c38a3fbebcdbc52d3f419cd02025f72c2759b3a8bb","observation_id":"92320250-441e-4518-9a1b-5240ada67f43","resolution":{"observed_at":"2026-07-12T08:09:57.596812Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"RTBAS: Defending LLM agents against prompt injection and privacy leakage,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:bfda4e99c64e1252a8902bf8c96e11f91135be1ec3f967b5002ee718544b9433","observation_id":"6fc5b00d-74af-4ecc-8d8f-5b149157070e","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":"2502.08966","doi":"10.48550/arxiv.2502.08966","metadata_source":"pith","pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage","venue":"cs.CR","work_id":"b2ed3d15-7e6f-4e4d-bf10-b9ac8029133a","year":2025},"citing_paper":{"arxiv_id":"2607.08147","last_updated":"2026-07-09T06:37:52Z","snapshot_observed_at":"2026-08-07T03:47:57.753615Z","submitted_at":"2026-07-09T06:37:52Z","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","version":1},"reference_index":102,"source":"pdf_text","source_observed_at":"2026-07-10T12:20:03.672480Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2607.08147"},"observation_digest":"sha256:cf26deae3eccc7f99231c05ea21bc585ccaf6e2aa127852902f86cc27c629f13","observation_id":"0f24a9c5-0e3d-4916-b197-713dd251ebfd","resolution":{"observed_at":"2026-07-10T12:27:04.073825Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-01T22:55:50.423697Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.15596","last_updated":"2026-08-10T02:18:19Z","snapshot_observed_at":"2026-08-13T23:29:00.063873Z","submitted_at":"2026-07-17T03:44:05Z","title":"From Neural Intent to Cryptographic Authorization: Securing AI-Driven Enterprise Workflows","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-01T22:55:50.423697Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2607.15596"},"observation_digest":"sha256:35228df057b746802dc5a8bc87b8bb6dae2c50794dfadae5c197d5af3fe7b61c","observation_id":"086d7580-83f5-4d3e-a7f6-81fb0196c399","resolution":{"observed_at":"2026-08-01T22:55:50.423697Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-01T14:11:22.426651Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.18847","last_updated":"2026-07-21T08:35:22Z","snapshot_observed_at":"2026-08-18T20:56:34.346323Z","submitted_at":"2026-07-21T08:35:22Z","title":"Data Leakage Prevention in Agentic Applications via Preemptive Hardening","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-01T14:11:22.426651Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2607.18847"},"observation_digest":"sha256:4792af98720a209f81b6f0973ae9b923db4fc2e4fbd33d792e44b0647b9cffe7","observation_id":"8c60331b-a861-4004-b04d-39c7c8aa3430","resolution":{"observed_at":"2026-08-01T14:11:22.426651Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-03T07:41:24.234199Z","title":"and Chen, Shangwu and Wang, Ruian and McCall, Matthew and Titzer, Ben L","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.29405","last_updated":"2026-07-31T13:24:34Z","snapshot_observed_at":"2026-08-13T08:34:02.633611Z","submitted_at":"2026-07-31T13:24:34Z","title":"Beyond Component Testing: Validating Agentic AI Systems","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-03T07:41:24.234199Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2607.29405"},"observation_digest":"sha256:50367be0bbc7e1d8d9d53a1e05e986afb130091305f2933b50a90782ec4a3af0","observation_id":"9261d1b0-3159-4ef0-a2b5-92b5e3377723","resolution":{"observed_at":"2026-08-03T07:41:24.234199Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-15T14:21:42.763513Z","title":"Titzer, Heather Miller, and Phillip B","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.10530","last_updated":"2026-08-11T06:11:26Z","snapshot_observed_at":"2026-08-19T18:52:42.862550Z","submitted_at":"2026-08-11T06:11:26Z","title":"On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models","version":1},"reference_index":163,"source":"pdf_text","source_observed_at":"2026-08-15T14:21:42.763513Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2608.10530"},"observation_digest":"sha256:7b7c2a5bbff36fde399dfc6b32eea8721c9e2f7a12fcda24dc048003f4e4b464","observation_id":"58746dc0-eb42-4bcf-b78f-43d7b37caef6","resolution":{"observed_at":"2026-08-15T14:21:42.763513Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-16T00:16:52.643873Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage.arXiv preprint arXiv:2502.08966, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-20T04:46:24.279130Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.643873Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:bf28121f320f3d450a3e6f8a3d9899c3bb79030e3b47337f0d7cd9b7ab801e24","observation_id":"8e10ec44-80f8-4ff2-94f6-1c098895bc68","resolution":{"observed_at":"2026-08-16T00:16:52.643873Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2502.08966/citation-record","integrity":"/paper/2502.08966/integrity","json":"/paper/2502.08966/citation-record.json","paper":"/paper/2502.08966"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:38.112427Z","title":"https://www.teneo.ai/solutions/ industries/airlines","venue":null,"work_id":"f9a33e0a-e3bc-4a68-aeb7-5fc10c4950aa","year":2025},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.379163Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:efefba63fba0ed96877bae2b33e6e300cb26d6fad20f72fbdd31d7bc851e3faa","observation_id":"0c74a6a3-c513-4a80-9e01-ac72c0ee4467","resolution":{"observed_at":"2026-08-07T23:09:38.116530Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.14219","last_updated":"2024-08-30T21:17:17Z","snapshot_observed_at":"2026-08-17T03:25:04.404839Z","submitted_at":"2024-04-22T14:32:33Z","title":"Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.14219","snapshot_observed_at":"2026-08-07T23:09:36.384228Z","title":"Phi-3 technical report: A highly capable language model locally on your phone","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.384228Z"},"links":{"cited_paper":"/paper/2404.14219","citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:86cd545e2a05e93fb200b0e55387d6b1fbddb87edd417fd15ed6eedc661471cc","observation_id":"9a78b874-a00d-4955-b6f6-248a1bf443e2","resolution":{"observed_at":"2026-08-07T23:09:36.384228Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:38.100474Z","title":"Fine-tuned deberta-v3-base for prompt in- jection detection, 2024","venue":null,"work_id":"507c0284-8b3b-4cca-b259-aac5284c68fe","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.389536Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:5165765ed2aae36b0f57b6fd993c98dc4980b394804ce41481272c030df9f18d","observation_id":"badef446-7079-4309-a97a-f59b8f752143","resolution":{"observed_at":"2026-08-07T23:09:38.104196Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:38.089248Z","title":"Claude: An ai assistant by anthropic, 2023","venue":null,"work_id":"a1e10c6f-fa11-4093-9364-c75ee84465f2","year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.394324Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:193895384206b60d1c7122ca32e72332061073b6b2d54175d43573c1fdbe7f6e","observation_id":"07c17d0a-f9e7-4d98-af37-ccd9672a003c","resolution":{"observed_at":"2026-08-07T23:09:38.093640Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:38.076343Z","title":"Prevent factual errors from llm hallucina- tions with mathematically sound automated reasoning checks (preview), December 2024","venue":null,"work_id":"4931baa7-9326-498b-935b-9acbc4c89ca0","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.398448Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:dbf09f759a92e45355ad06646aafc43aabeeb5fdaef2584f9a652bbe9e4bd29b","observation_id":"78d6ffa3-d31b-43c0-9675-dd4bc0c9c2ca","resolution":{"observed_at":"2026-08-07T23:09:38.081236Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:38.064403Z","title":"Extracting training data from large language models","venue":null,"work_id":"f52a9cd1-9925-4cff-b9c0-b761a255d1b9","year":2021},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.402751Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:c5230f62d12ff6b1753de24b28590158891024b5afe253e42191d228af6eecf2","observation_id":"ec5b9fbf-b8f9-41eb-8291-22c979c5a4ef","resolution":{"observed_at":"2026-08-07T23:09:38.068418Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:38.052432Z","title":"Clear: Towards contextual llm- empowered privacy policy analysis and risk generation for large language model applications, 2024","venue":null,"work_id":"321719b9-06ff-42e4-9e27-0a492de11483","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.407615Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:120ce592f23694e0b8b0e1cc66892b790c9b41d49990e136c848bd0376742456","observation_id":"ad7b8941-1eff-4f80-bd19-29e17682ddcb","resolution":{"observed_at":"2026-08-07T23:09:38.056295Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.412536Z","title":"Struq: Defending against prompt injection with structured queries, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.412536Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:ba3756faa8142efd4b228581de4ee35816a08e7ccc481bfa543d4dd1b9a9a61f","observation_id":"5edde386-6d6a-4419-a75a-284aa8de3b4d","resolution":{"observed_at":"2026-08-07T23:09:36.412536Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:38.032837Z","title":"Custom gpts from your content for business, 2025","venue":null,"work_id":"0732a401-0e17-4817-8837-79a63e18b696","year":2025},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.417919Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:ac9db793b29f3ada2dd19c00605e7468abed9bd88520928d2be316db6befcabb","observation_id":"7d420f18-e0ac-4e8e-b7a0-6c8ae7460108","resolution":{"observed_at":"2026-08-07T23:09:38.037288Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-07T23:09:36.424083Z","title":"Agentdojo: A dynamic environment to evaluate at- tacks and defenses for llm agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.424083Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:f7785eff79bdb34e58ca43e52dc7b44ee1ba1dc29c350262e7209880bc720bb2","observation_id":"2206a5b9-a1f2-4613-a8a6-f6507c9f67ca","resolution":{"observed_at":"2026-08-07T23:09:36.424083Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:38.021151Z","title":null,"venue":null,"work_id":"7bc46d5a-6e3e-4ef7-b8cd-29097fb2f4aa","year":1976},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.434684Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:99cfc8d72a8e8232686e3369b1480ff6cd45a3dd4b1bcb95092412d444f097d4","observation_id":"55fc7daf-a34b-4c09-b704-b355dd79bda8","resolution":{"observed_at":"2026-08-07T23:09:38.025510Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:38.009826Z","title":"A survey on llm-as-a-judge, 2025","venue":null,"work_id":"cf0554fd-d66f-4e73-a894-f40739279c07","year":2025},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.444827Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:dfa16677ea08e211eea06c4b80e0bdca2dde3561a792eb03f356e09c696e4ba6","observation_id":"b7c7ef42-bf4c-44f9-97e5-465c25489d75","resolution":{"observed_at":"2026-08-07T23:09:38.013773Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.998064Z","title":"Defending against indirect prompt injection attacks with spotlight- ing, 2024","venue":null,"work_id":"7edcd961-dd48-4e11-a980-7e2f2f9e741e","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.448393Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:a911ebe08bab2e473380238ac521b2b8ffae7b5257dec197e9f990acc3c87f7c","observation_id":"a5772095-765a-442f-a0a3-c46664c04d03","resolution":{"observed_at":"2026-08-07T23:09:38.002173Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.985935Z","title":"Long short- term memory","venue":null,"work_id":"1d03166b-c1d7-43b9-b6a8-e53318000b55","year":1997},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.451488Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:c198a8f83fbe4f00295251c071b122e6b86604ac58fda4ad8a14d05a65f68c94","observation_id":"5e3f1e46-6c5d-419f-b688-a11f600e9ca1","resolution":{"observed_at":"2026-08-07T23:09:37.990393Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.974723Z","title":"Firewallm: A portable data protection and recovery framework for llm services","venue":null,"work_id":"3bde264b-b3e0-43b0-9c54-8d6a45bce922","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.455013Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:034a501f19925d0c3916ff87f79f08e6720cdf8c087645d42a6167a69f99445c","observation_id":"0aefcb79-6550-4972-8f7a-22d7e1821c09","resolution":{"observed_at":"2026-08-07T23:09:37.978754Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.934613Z","title":"Language models as zero-shot plan- ners: Extracting actionable knowledge for embodied agents, 2022","venue":null,"work_id":"9a7da25f-969d-431d-b94b-0d4ab1a82daf","year":2022},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.458181Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:842e9b1fdc89cc6033c5ea03898375f4734930f69a50ff9101f4c258b7d7b372","observation_id":"70c34846-0835-405e-8f9f-49318c2a01ff","resolution":{"observed_at":"2026-08-07T23:09:37.957222Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.907796Z","title":"Hsu, and Pin-Yu Chen","venue":null,"work_id":"221ee6dc-7e15-42e3-8297-94e03fcdfaa6","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.462733Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:8971576cbecaff6741d114aa96c8077aee383ea599755d15e3709a9a1bf93f96","observation_id":"d088d12e-97e2-4e94-84ee-a5c23731e5fa","resolution":{"observed_at":"2026-08-07T23:09:37.912281Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.466778Z","title":"Baseline defenses for adversarial attacks against aligned language models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.466778Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:02456403107d8bf8b2184091cefdd1b08458f4d0554dfcdff51bdc71d65ba60a","observation_id":"a93606bd-3a57-4202-8a3c-f9586bcbb707","resolution":{"observed_at":"2026-08-07T23:09:36.466778Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1902.10186","last_updated":"2019-05-08T18:05:56Z","snapshot_observed_at":"2026-08-17T21:23:58.792685Z","submitted_at":"2019-02-26T19:59:15Z","title":"Attention is not Explanation","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1902.10186","snapshot_observed_at":"2026-08-07T23:09:36.480915Z","title":"Attention is not explanation","venue":null,"work_id":null,"year":1902},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.480915Z"},"links":{"cited_paper":"/paper/1902.10186","citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:9e6ad5fa9b36204382f15b9dde152a18247e917bb035d6efa31f1536d66c6623","observation_id":"a361fb81-b883-4481-841a-5331f4807b00","resolution":{"observed_at":"2026-08-07T23:09:36.480915Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.888777Z","title":"Iden- tifying and mitigating vulnerabilities in llm-integrated applications, 2023","venue":null,"work_id":"6cede344-a731-4612-8c40-df787d876b1a","year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.498194Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:876e9f972a3fcd59652fe4cbeb139798726c8f9897ab23087ec65c78cfc93cf9","observation_id":"bd732fbc-0ffa-4316-b853-56dc583b0b98","resolution":{"observed_at":"2026-08-07T23:09:37.893626Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.877796Z","title":"Propile: Probing privacy leakage in large language models","venue":null,"work_id":"fb46644d-a30c-4e05-ba84-b78e12da17b4","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.516075Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:2e806621f62fc6c71264d874bb836de8741cfe0908c78c985cfd5bad8ac5c022","observation_id":"bd7ba25c-f073-490c-9044-a99a3b664077","resolution":{"observed_at":"2026-08-07T23:09:37.881491Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.531254Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.531254Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:ac008b02fd77c8cc4c78f5dd2fe038dd0e78b570cc00bab7ac536d4f52316655","observation_id":"643956ae-a16b-47d1-8ab3-d9bfa238dba2","resolution":{"observed_at":"2026-08-07T23:09:36.531254Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.721975Z","title":"Prompt in- jection attack against llm-integrated applications, 2024","venue":null,"work_id":"129aade0-f769-4888-9daa-b83ae6efd523","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.546916Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:8b205e4aff07648b7e376d401bd45772084cfcecafb7bb0251dc6fe709e64473","observation_id":"669a9f26-99a7-4ff6-86c2-9d4d2ec6b6bc","resolution":{"observed_at":"2026-08-07T23:09:37.778707Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.709896Z","title":"Formalizing and benchmarking prompt injection attacks and defenses","venue":null,"work_id":"37813170-e8a6-42c4-ab73-4e404d489bb1","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.550686Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:d09fbda36d4d321101cfcf5748f4973ccf7c2df637a06e5b39952627b3bceedf","observation_id":"307f4e19-8225-4418-8466-48f7b2321021","resolution":{"observed_at":"2026-08-07T23:09:37.714493Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.554017Z","title":"The landscape of emerging ai agent architectures for reasoning, planning, and tool calling: A survey, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.554017Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:ca72aec91957b03493f47608571aae9c24b5e817dce5d7687c6a7d2a260b7a3e","observation_id":"53dbaf05-7e9e-403a-9a5b-9ddb620f2a5e","resolution":{"observed_at":"2026-08-07T23:09:36.554017Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.610228Z","title":"Conversational ai in banking: Chatbots, use cases, examples, Dec 2024","venue":null,"work_id":"19834cd0-a561-4c90-92a4-da24cc800d33","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.557495Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:00c90412885b9624935a38929c880a4e1dbab59b33b06afb5d51824a8ce52f10","observation_id":"7ea758ee-1485-4c2c-9752-ab094a1a0e50","resolution":{"observed_at":"2026-08-07T23:09:37.653847Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.598712Z","title":"Are sixteen heads really better than one? In H","venue":null,"work_id":"ae569fc5-ce2b-47de-82e7-087b5e24a9b2","year":2019},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.560880Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:42bc57c0aff1d8dc2c3951caa4eac106997efe459e3b01b9a70d7b5bfac4534c","observation_id":"90f1339d-80ee-43f4-be19-674ef4375be7","resolution":{"observed_at":"2026-08-07T23:09:37.603146Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.587600Z","title":"Myers and Barbara Liskov","venue":null,"work_id":"d1349e27-9df2-43b4-9180-efb021315e8c","year":2000},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.564921Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:297c21264db23adc28178476f30c1091c16cc806664d06ad6865d6f2581fdb8c","observation_id":"99fe8290-5dea-4064-9802-2459881d5cf8","resolution":{"observed_at":"2026-08-07T23:09:37.591607Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.576768Z","title":"Dynamic taint analysis for automatic detection, analysis, and sig- naturegeneration of exploits on commodity software","venue":null,"work_id":"69a5d08c-2c02-427a-bee4-48cf42321b44","year":2005},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.568872Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:c78425402a06f27c23c5b054eeac095e79e227219c3fad2516d9a014cbfe961a","observation_id":"1fc3565a-079d-473f-94fb-632786911c54","resolution":{"observed_at":"2026-08-07T23:09:37.580275Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.566280Z","title":"Introducing gpts, 2023","venue":null,"work_id":"7fbb9f41-d930-4177-a026-6c0cb338b555","year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.571663Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:3cb6ac8a4b1af88f0759cf03175505b2eec799d6031cbca8e6a97c62f12e1b90","observation_id":"14498474-5b8f-4f3e-914e-47f53dbe1b7f","resolution":{"observed_at":"2026-08-07T23:09:37.569845Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.555865Z","title":"Optimizing instructions and demonstrations for multi-stage language model programs, 2024","venue":null,"work_id":"3f751acf-c7e1-40d3-b01a-77d73de3ee66","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.574741Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:5f83622d5ca886a1a0c13fe0ba00bab7b76262aa2ec9bc3cceff5c6fb8586b2b","observation_id":"349ac449-19b0-416e-a684-57f55961b870","resolution":{"observed_at":"2026-08-07T23:09:37.559001Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.577890Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.577890Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:2c147013ef06dd169e2658dc1b12697d3d920abe7947834869dc959a9f33a457","observation_id":"fde53ec2-b66d-480a-9c86-f088b3d7905c","resolution":{"observed_at":"2026-08-07T23:09:36.577890Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.519772Z","title":"OW ASP Top 10 for LLM Applications, 2025","venue":null,"work_id":"2dabd323-2ea4-4ec0-a413-91adad2a3bb5","year":2025},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.581153Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:d4af2055c5b7d348fa8f01b048a4f56e03b7e5ba555143bac33f6c2fbcea533f","observation_id":"1e7b2b9f-4916-46ff-a82e-6cced1c144b9","resolution":{"observed_at":"2026-08-07T23:09:37.543385Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.390061Z","title":"Jatmo: Prompt injection defense by task-specific finetuning, 2024","venue":null,"work_id":"8d382c7c-f3c0-406c-aefc-a3305a1e6b26","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.584073Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:edeccccadd6ca9683b910f4bb492f56ad482c52f12f580ca8bdd5ec76a15b0b3","observation_id":"ad33e7eb-0532-46d2-9b55-486fa2d82691","resolution":{"observed_at":"2026-08-07T23:09:37.452481Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.298456Z","title":"Fine-tuned large language mod- els (llms): Improved prompt injection attacks detection, 2024","venue":null,"work_id":"efb7004d-fd49-4897-945a-17beff6216af","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.587617Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:483922f4d11a83f987cf09c67a66caaa158b07bc663d31eb27f5936cd7e7d783","observation_id":"cf247929-b6ae-451b-926a-4b1c6a06e787","resolution":{"observed_at":"2026-08-07T23:09:37.341044Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.289180Z","title":"Self-reflection in llm agents: Effects on problem-solving performance, 2024","venue":null,"work_id":"252277a0-c1ed-41ef-a357-7641295277c6","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.591196Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:5e2eb73301c299e8c443946b9237b3958315fe143ee8a4af5f024ee63cc6b9ea","observation_id":"7ad20ce3-e439-4df0-9663-f1e95f898154","resolution":{"observed_at":"2026-08-07T23:09:37.292535Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.279705Z","title":"Sabelfeld and A.C","venue":null,"work_id":"cfade699-593e-4c16-8d91-e4d497f8170a","year":2003},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.594695Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:bcc052737c0667ff0e6bd3f8abff58f3ce32d786c8f054fa44f10feb4e35b7f6","observation_id":"c5e5a337-de9d-4be1-a041-f217da88b4f9","resolution":{"observed_at":"2026-08-07T23:09:37.283008Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.270084Z","title":"Sandwitch defense","venue":null,"work_id":"d495ce9c-3543-43b1-90a4-50cd744995e2","year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.598260Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:5e1f8368678a557d9e07921c2a5cd7d2c0f4891caecc34a42ec8b86a058c4546","observation_id":"9a974c7d-2388-4fd4-a7db-e3c039c7a488","resolution":{"observed_at":"2026-08-07T23:09:37.273123Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.258937Z","title":null,"venue":null,"work_id":"92b3822f-5466-4b8d-b591-6b3a104dbe0a","year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.601503Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:5d5ace95fb4cad1d775f303f9ccd49a3d95584b8f1675308721167757ef012ea","observation_id":"e20a033a-da37-4265-9839-4901a618ceaf","resolution":{"observed_at":"2026-08-07T23:09:37.262823Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.245093Z","title":"Permissive information-flow anal- ysis for large language models, 2024","venue":null,"work_id":"a927dfe4-219d-490f-8e3c-98f8162a7e29","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.605467Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:e0b2eff97611107dc5a98272d25fd0558508db5b4d163647c12022ac824a3073","observation_id":"1ba44f4c-1179-4f47-a6d7-b5f8b0a633b5","resolution":{"observed_at":"2026-08-07T23:09:37.251821Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.146230Z","title":"Papillon: Pri- vacy preservation from internet-based and local lan- guage model ensembles, 2024","venue":null,"work_id":"15ffeba0-0443-424e-846a-cfb0ddb06a94","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.608649Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:ba8b015f9797eae503ff73162ed48440c411e4f62f1f3e225011849f49d04c36","observation_id":"b0d308da-186f-43d3-aa39-13593de1f67d","resolution":{"observed_at":"2026-08-07T23:09:37.200667Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.136300Z","title":"Policygpt: Automated analysis of privacy policies with large language models, 2023","venue":null,"work_id":"a9782d89-e7be-40c8-bbd0-f5c5c578454e","year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.623644Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:bd366d0282336263cb286abd01186ad08dd81298053f986fe12ef4bb5f03e49c","observation_id":"fe75a609-bbf4-4a7e-889e-fa69a37c22e6","resolution":{"observed_at":"2026-08-07T23:09:37.139916Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.638028Z","title":"Attention is all you need","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.638028Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:3fc4a837f0470d4bb50070cda5bcba5b88ea908b8d98ff9dc3d5257eae567d59","observation_id":"407cc61a-465d-4954-8473-8973be29e2d9","resolution":{"observed_at":"2026-08-07T23:09:36.638028Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.651864Z","title":"The instruction hier- archy: Training llms to prioritize privileged instructions, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.651864Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:baef3e9e80155f1f4168f31ebeafae12e1e1af480bc1846556a027a63ebc4bb0","observation_id":"44232aa4-b234-4e22-9857-e43e5905b7fb","resolution":{"observed_at":"2026-08-07T23:09:36.651864Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.14160","last_updated":"2023-12-19T15:13:52Z","snapshot_observed_at":"2026-08-20T04:59:18.244749Z","submitted_at":"2023-05-23T15:26:20Z","title":"Label Words are Anchors: An Information Flow Perspective for Understanding In-Context Learning","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.14160","snapshot_observed_at":"2026-08-07T23:09:36.663757Z","title":"Label words are anchors: An information flow perspective for understanding in-context learning","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.663757Z"},"links":{"cited_paper":"/paper/2305.14160","citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:516b717ff722b292938eb6a743f07eefde88c0f583e76f51f41003430c3f4285","observation_id":"498d6077-4228-4514-9f1d-e2780b85452a","resolution":{"observed_at":"2026-08-07T23:09:36.663757Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:37.082294Z","title":"Plan-and- solve prompting: Improving zero-shot chain-of-thought reasoning by large language models, 2023","venue":null,"work_id":"17569f83-9437-4050-bb47-abdc241b95bf","year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.677981Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:fb2de8d96e450f65eef8f0ae63f0a0ebe7a248ae5a023292781135599429038d","observation_id":"c4d3fe6f-4629-4e63-910a-d0c7f71f7b50","resolution":{"observed_at":"2026-08-07T23:09:37.097968Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.699896Z","title":"Chain-of-thought prompting elicits rea- soning in large language models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.699896Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:761aead224e243562aeddd174fe41e3b0a71bc4b3ed9108786470eaec93a6810","observation_id":"3e1fe6b5-a453-46eb-9c66-c97ff886c663","resolution":{"observed_at":"2026-08-07T23:09:36.699896Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.985467Z","title":"Llm powered autonomous agents, 2023","venue":null,"work_id":"c3e9bd0c-6990-4c42-925c-797993ab0834","year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.703800Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:42227556fa0129d0f98b4b0b1605ebf1a43dd5588acd12c855d3b98309347d1e","observation_id":"7c029dc4-d0f3-45ec-93cd-e3b3ab02f075","resolution":{"observed_at":"2026-08-07T23:09:37.029492Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1908.04626","last_updated":"2019-09-05T14:11:27Z","snapshot_observed_at":"2026-08-19T04:34:08.104261Z","submitted_at":"2019-08-13T13:15:04Z","title":"Attention is not not Explanation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1908.04626","snapshot_observed_at":"2026-08-07T23:09:36.707259Z","title":"Attention is not not explanation","venue":null,"work_id":null,"year":1908},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.707259Z"},"links":{"cited_paper":"/paper/1908.04626","citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:f401fed8bbf71f23a9878c3cf678455d6ed1eed5db2412d9f98ad973608c29e1","observation_id":"de14e05c-11e6-4776-9b47-70b035a4f719","resolution":{"observed_at":"2026-08-07T23:09:36.707259Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.974762Z","title":"Prsa: Prompt stealing attacks against large language models, 2024","venue":null,"work_id":"0d643a71-1207-488c-9aec-c68598458458","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.712052Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:cf4eb4b147d2e667312a6daac8f7c9d6d4c124c75af7ebbb7539970274895a20","observation_id":"4abe83cb-364c-4848-9173-5f675d9570c7","resolution":{"observed_at":"2026-08-07T23:09:36.978796Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.715196Z","title":"React: Synergizing reasoning and acting in language models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.715196Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:6a45151a227373155dc37558aead08950ea7a54685062ba65ca1908a5dcbeee8","observation_id":"69e4ade0-873f-4430-a46f-b79e7d1f3ea1","resolution":{"observed_at":"2026-08-07T23:09:36.715196Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.958832Z","title":"The shift from mod- els to compound ai systems — bair.berkeley.edu","venue":null,"work_id":"3d7d0b43-77c8-468e-97f9-1c422ebeb6cd","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.718754Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:2b29c65897a3addc4a022ae46deb177e9c10295a09597d1209fe3c7d27b2ddf3","observation_id":"0d82a66b-f299-4a2f-a68a-435ad5ef2954","resolution":{"observed_at":"2026-08-07T23:09:36.962194Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.948381Z","title":null,"venue":null,"work_id":"8f1ed9d6-1d89-4559-9c31-8e9a8272dc15","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.722005Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:5a4ffc666e5e4b76d3d77c4befc90a97c738443c460d716c88df2bd9580df22d","observation_id":"9a95bba1-696b-4cfb-b14d-df9b32eee4e6","resolution":{"observed_at":"2026-08-07T23:09:36.952093Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.935936Z","title":"Injecagent: Benchmarking indirect prompt in- jections in tool-integrated large language model agents, 2024","venue":null,"work_id":"47491add-5684-4db4-bda1-c72d9f7bb012","year":2024},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.725188Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:b77314a7bb2876cf3810ab4447d57d0237761f8b0bda4d6458955a7c9c902c05","observation_id":"4c7dcd7b-c2f5-4d4e-b494-f8a4599dcc09","resolution":{"observed_at":"2026-08-07T23:09:36.939855Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.914465Z","title":"Opt: Open pre-trained transformer language models, 2022","venue":null,"work_id":"223c2a79-054e-4d30-8580-1606b097a32f","year":2022},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.728364Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:0e899a6a7714469d16254d7923163883b382412d8764608a852f90fce3a44895","observation_id":"510b6c59-eda5-4629-bc8c-5eb636a0c583","resolution":{"observed_at":"2026-08-07T23:09:36.928583Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.904281Z","title":"H2o: Heavy- hitter oracle for efficient generative inference of large language models","venue":null,"work_id":"7709f011-0b07-4bdd-9ebb-0ee0b5c9570c","year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.731581Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:babdbe116f876a6043b7c45ae53b572104c9c38d5f9fd7a5d7e611c233d2c075","observation_id":"10033dc6-dae5-411a-9264-0d8fb8245cfe","resolution":{"observed_at":"2026-08-07T23:09:36.907437Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.837085Z","title":"A guide to large language model ab- stractions","venue":null,"work_id":"0e3fcba9-1a87-4068-a284-7b79efb115c6","year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.735076Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:5656a980eded864074580f36eae90711d4604628dadfc4af6a9b06862c44d55c","observation_id":"55b202e1-e0c7-4112-96ee-815150e2b17f","resolution":{"observed_at":"2026-08-07T23:09:36.866773Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T23:09:36.812109Z","title":"amount\":100,date:","venue":null,"work_id":"8bd02486-ac9d-4cef-b9c3-ebcc9cbd7fa9","year":2023},"citing_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-07T23:09:36.738179Z"},"links":{"citing_paper":"/paper/2502.08966"},"observation_digest":"sha256:f834d42d2a685eb0a9e6f8d6dd57a2969098dc87ba9c2733c1456fdc70d6c58d","observation_id":"4091f65a-3be0-467c-97ff-1dac46a2ef37","resolution":{"observed_at":"2026-08-07T23:09:36.820109Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-20T08:17:28.154555Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage"},"reference_resolution":{"displayed":58,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":17,"verified_exact":0,"verified_fuzzy":41},"total_outbound_references":58},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"thesis":"As of 20 August 2026, this Paper Citation Record lists 58 of 58 outbound references and 37 inbound Pith citation observations for arXiv:2502.08966."}