{"as_of":"2026-08-05T00:07:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:5bc28f03942c2f6d6cfdac54d8f50ffae42154c0aea1cf42e63c85baac20e3ed","coverage":[{"denominator":229,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":100,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-13T06:58:50.351078Z","state":"measured"},{"denominator":200,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":200,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-04T06:34:03.388597+00:00","state":"measured"},{"denominator":126,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":100,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-04T14:43:48.898809Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-07-10T12:27:04.207627Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-07-06T21:10:09.129714Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-22T21:09:51.782808Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2504.11703"},"observation_digest":"sha256:2b1e134d3b1e43c39b88f9a78ce1ca0607e5647a4125d60c00a0e0cd83f0ac6e","observation_id":"91c2998f-532b-45d7-9685-f5524bce044e","resolution":{"observed_at":"2026-05-22T21:12:08.466892Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2504.19793","last_updated":"2025-08-24T03:28:21Z","snapshot_observed_at":"2026-08-01T07:24:09.967062Z","submitted_at":"2025-04-28T13:36:43Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents","version":3},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-05-16T17:08:28.933831Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2504.19793"},"observation_digest":"sha256:fdd65a064207a02740ce2d1888379e90c4c37bf84e87fdd3278cd120730fe3e8","observation_id":"c323418f-7d17-47e6-839f-ae90a10ca63b","resolution":{"observed_at":"2026-05-16T17:08:29.060244Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2504.20984","last_updated":"2025-09-10T19:03:48Z","snapshot_observed_at":"2026-08-04T02:21:28.368706Z","submitted_at":"2025-04-29T17:55:52Z","title":"ACE: A Security Architecture for LLM-Integrated App Systems","version":3},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-22T18:05:50.363944Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2504.20984"},"observation_digest":"sha256:8a03d6fbd11cf7a26fc89adc94a5e12e1d217efa5bf8e4997a6b56298c9a21e5","observation_id":"24f7860b-2c1c-40a0-93a5-927df4a66a35","resolution":{"observed_at":"2026-05-22T18:06:54.293797Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-04T14:43:48.898809Z","title":"Defeating prompt injections by design","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.23694","last_updated":"2026-06-03T04:13:57Z","snapshot_observed_at":"2026-08-04T14:43:33.365212Z","submitted_at":"2025-09-28T07:05:17Z","title":"SafeSearch: Automated Red-Teaming of LLM-Based Search Agents","version":6},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-04T14:43:48.898809Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2509.23694"},"observation_digest":"sha256:04a391b9daf5fdad47f94b225d874ebdecf6c35239eb30117265c38a517d7901","observation_id":"e8a19c33-5ccc-477f-8ba9-f7ef4a3fd665","resolution":{"observed_at":"2026-08-04T14:43:48.898809Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2510.23883","last_updated":"2026-04-03T16:27:34Z","snapshot_observed_at":"2026-08-02T13:42:34.526072Z","submitted_at":"2025-10-27T21:48:11Z","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","version":3},"reference_index":185,"source":"pdf_text","source_observed_at":"2026-05-18T03:42:10.703369Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2510.23883"},"observation_digest":"sha256:fb6c10cb26b8a6c9d096f9deac265eb09c280b504e4326c8cdc359a7a94cf41b","observation_id":"b7df83c0-c237-440d-9f63-1d99dbb449ff","resolution":{"observed_at":"2026-05-18T03:42:22.211468Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-04T07:06:38.002885Z","title":"Defeating prompt injections by design.arXiv preprint arXiv:2503.18813, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.27140","last_updated":"2026-07-07T02:18:26Z","snapshot_observed_at":"2026-08-04T07:06:36.142036Z","submitted_at":"2025-10-31T03:35:59Z","title":"Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels","version":3},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-04T07:06:38.002885Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2510.27140"},"observation_digest":"sha256:8b10950dcdc75d4d17e0f4f033f011bac45672dcc5a586523bd8a8ee86d05a84","observation_id":"fc959d86-7914-4a3f-92e4-a961064ba38b","resolution":{"observed_at":"2026-08-04T07:06:38.002885Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-03T10:32:31.637195Z","title":"Luoxi Meng, Henry Feng, Ilia Shumailov, and Earlence Fernandes","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2601.09923","last_updated":"2026-06-04T15:38:02Z","snapshot_observed_at":"2026-08-03T10:32:29.759975Z","submitted_at":"2026-01-14T23:06:35Z","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","version":3},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-03T10:32:31.637195Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2601.09923"},"observation_digest":"sha256:eb2f5927824a780509e7e9d52c8a7a100cb81fcea59b0e7fc7ce224dda86ffc1","observation_id":"1003d660-a7cb-41e6-b9cd-1e9eab33ecb4","resolution":{"observed_at":"2026-08-03T10:32:31.637195Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2602.03117","last_updated":"2026-05-07T07:42:14Z","snapshot_observed_at":"2026-07-06T22:44:18.875334Z","submitted_at":"2026-02-03T05:20:42Z","title":"AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?","version":3},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-16T08:13:33.928054Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2602.03117"},"observation_digest":"sha256:7ee59ba76a1702d7cab7abf30cb5d893f3426dd8640bdad47fd5d052d5f9ff32","observation_id":"a5f08203-a2a9-4277-a0ac-b273618e6cf7","resolution":{"observed_at":"2026-05-16T08:17:36.449313Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2602.16708","last_updated":"2026-05-08T15:45:27Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2026-02-18T18:57:12Z","title":"Formal Policy Enforcement for Real-World Agentic Systems","version":3},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-15T21:08:06.259177Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2602.16708"},"observation_digest":"sha256:3a8fb338ba128329546b7c030bb999d927fd20adcca41f7874fbad6f11644e9a","observation_id":"21dfb839-4a88-4a5a-bc85-a02392bdec18","resolution":{"observed_at":"2026-05-15T21:10:18.562794Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-02T21:31:19.385929Z","title":"Defeating prompt injections by design,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2602.20064","last_updated":"2026-07-10T15:10:01Z","snapshot_observed_at":"2026-08-02T21:31:17.572201Z","submitted_at":"2026-02-23T17:22:35Z","title":"The LLMbda Calculus: AI Agents, Conversations, and Information Flow","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-02T21:31:19.385929Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2602.20064"},"observation_digest":"sha256:bd79915af182bb6e887ba2e61028312d2470ac2ebc13ea1e553ac8924220d109","observation_id":"d48a0961-6233-420b-af7c-4779db3b2a51","resolution":{"observed_at":"2026-08-02T21:31:19.385929Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2603.00991","last_updated":"2026-05-07T14:09:04Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2026-03-01T08:39:37Z","title":"Tracking Capabilities for Safer Agents","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-15T18:31:34.181629Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2603.00991"},"observation_digest":"sha256:fc776e8db9df8528d8e6f94c0a508f707aac43d57938f562bd5d5259f3d77375","observation_id":"4b4b557f-a79d-447e-b60f-2027c48888c5","resolution":{"observed_at":"2026-05-15T18:36:29.241280Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-14T23:21:58.911407Z","title":"Defeating prompt injections by design.arXiv preprint arXiv:2503.18813, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2603.10749","last_updated":"2026-06-10T06:18:26Z","snapshot_observed_at":"2026-07-14T23:21:58.266403Z","submitted_at":"2026-03-11T13:23:46Z","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-07-14T23:21:58.911407Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2603.10749"},"observation_digest":"sha256:3f92840436d26fabf7df3ca341400deff3d160813f55935aa4f150d5bee84da2","observation_id":"16fad904-e3a8-48d2-bf3f-fe4ae04908df","resolution":{"observed_at":"2026-07-14T23:21:58.911407Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2603.12230","last_updated":"2026-04-05T08:33:19Z","snapshot_observed_at":"2026-08-04T04:27:19.804842Z","submitted_at":"2026-03-12T17:49:39Z","title":"Security Considerations for Artificial Intelligence Agents","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-15T12:37:27.153365Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2603.12230"},"observation_digest":"sha256:0df9db732dedfa22c04856618f28a84a9ea4ebc21dd3d1d0ee2a4ae8fcff9f8c","observation_id":"83d84014-684b-4545-af18-56c67849cf92","resolution":{"observed_at":"2026-05-15T12:40:00.283828Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2603.28166","last_updated":"2026-04-20T07:37:21Z","snapshot_observed_at":"2026-08-02T07:10:51.130581Z","submitted_at":"2026-03-30T08:35:00Z","title":"Evaluating Privilege Usage of Agents with Real-World Tools","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-14T22:16:56.848520Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2603.28166"},"observation_digest":"sha256:6034690f8b634b53a6594ea68fcf567728311336762a279c5c416b654f9c4967","observation_id":"40ddf811-1ace-4073-827f-239940e1f6df","resolution":{"observed_at":"2026-05-14T22:18:04.353353Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-02T17:00:40.844082Z","title":"Defeating prompt injections by design,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2604.01194","last_updated":"2026-07-25T19:27:27Z","snapshot_observed_at":"2026-08-04T22:17:49.284388Z","submitted_at":"2026-04-01T17:40:03Z","title":"AgentWatcher: A Rule-based Prompt Injection Monitor","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-02T17:00:40.844082Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.01194"},"observation_digest":"sha256:26fe7853ba47d06a59d5aee07597ebab7cb6b9d7c66aca474baad50505ab7032","observation_id":"95245790-8d92-4da7-94c6-9d41aad2cd29","resolution":{"observed_at":"2026-08-02T17:00:40.844082Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.02375","last_updated":"2026-03-31T21:38:28Z","snapshot_observed_at":"2026-07-06T22:51:44.663367Z","submitted_at":"2026-03-31T21:38:28Z","title":"KAIJU: An Executive Kernel for Intent-Gated Execution of LLM Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-08T02:24:12.156421Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.02375"},"observation_digest":"sha256:a9f35a1089c798432fd45ddf22b7eb8f7a4aed8e590a08954e6b64ddd8ec27b5","observation_id":"7cab693d-ecd1-4daf-87f8-8e66588aee0c","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.04035","last_updated":"2026-04-05T09:28:51Z","snapshot_observed_at":"2026-07-06T22:53:06.517678Z","submitted_at":"2026-04-05T09:28:51Z","title":"Causality Laundering: Denial-Feedback Leakage in Tool-Calling LLM Agents","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-13T17:19:32.255377Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.04035"},"observation_digest":"sha256:ad7288412a3609139ccd9822909bcb43c379f8dff08cb0d518c7d461a19c7e35","observation_id":"73a97a9b-7c39-4a3b-aa7d-06d16f1b5212","resolution":{"observed_at":"2026-05-13T17:23:02.748549Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.07536","last_updated":"2026-04-08T19:18:11Z","snapshot_observed_at":"2026-07-06T22:55:46.307881Z","submitted_at":"2026-04-08T19:18:11Z","title":"TRUSTDESC: Preventing Tool Poisoning in LLM Applications via Trusted Description Generation","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-10T17:16:35.875601Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.07536"},"observation_digest":"sha256:2cf026704edebb4bdf27991018bfd171861d10de0036004b2d836ff1f0bf0ec3","observation_id":"da323a05-b8ff-4536-86a9-cf7e7f2aa305","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.07988","last_updated":"2026-04-09T08:58:23Z","snapshot_observed_at":"2026-07-06T22:57:09.435331Z","submitted_at":"2026-04-09T08:58:23Z","title":"LogAct: Enabling Agentic Reliability via Shared Logs","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-10T17:08:18.867219Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.07988"},"observation_digest":"sha256:e5ad9c5bc2b571c068a9dce232f09212253d0b3681662c1a9785f90d4053d988","observation_id":"faa1a609-d3f9-45a0-aea4-7a1cbaa91258","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.08608","last_updated":"2026-04-20T18:30:51Z","snapshot_observed_at":"2026-07-06T22:57:40.773778Z","submitted_at":"2026-04-08T18:19:03Z","title":"Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-10T17:40:23.128451Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.08608"},"observation_digest":"sha256:c6ce3a94fcb7833ec0bf6e634e433d19ffb48fe3f371095fe094631e22baf59d","observation_id":"7df91b75-ab65-4591-8a5e-c5cb10809eb1","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.11790","last_updated":"2026-05-11T16:09:04Z","snapshot_observed_at":"2026-07-06T23:00:08.171601Z","submitted_at":"2026-04-13T17:55:11Z","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-10T16:05:47.517157Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.11790"},"observation_digest":"sha256:ea7d5b0d2a41436569d5c617749909c1e2ef02c6e79b5e44b0377228935ad58a","observation_id":"61a5a89a-62e7-4995-a9ee-03e06fe59564","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.11790","last_updated":"2026-05-11T16:09:04Z","snapshot_observed_at":"2026-07-06T23:00:08.171601Z","submitted_at":"2026-04-13T17:55:11Z","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-12T04:17:07.080092Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.11790"},"observation_digest":"sha256:9f67d0a43623a5344a217a69a5d01bf20d29303496630d9fae908430b986f8dd","observation_id":"c2c0ebb2-4a01-47d2-b1ee-1e2e5b54d140","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.15579","last_updated":"2026-07-05T22:49:32Z","snapshot_observed_at":"2026-07-12T19:40:44.614247Z","submitted_at":"2026-04-16T23:18:22Z","title":"Don't Make Models Guess Security and Safety: Symbolic Guardrails for Domain-Specific AI Agents","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-10T10:15:27.926105Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.15579"},"observation_digest":"sha256:ddf59aad401003051142a36e6881ddfc970e2fbc79b9b383ca4e12c8ffd9d4c9","observation_id":"b1d85e4f-ae47-4d44-a7ae-71cdc24d4ebc","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.16762","last_updated":"2026-04-18T00:23:32Z","snapshot_observed_at":"2026-07-06T23:04:01.558812Z","submitted_at":"2026-04-18T00:23:32Z","title":"CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-10T07:47:46.307793Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.16762"},"observation_digest":"sha256:b369c05fa72d1757b1fbbafe5b897fd37caef2cc172c07f9a67819d93c03731b","observation_id":"8e8db37a-5b38-4d11-86ad-95bf7df33981","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.18231","last_updated":"2026-05-06T14:26:07Z","snapshot_observed_at":"2026-07-06T23:05:08.728446Z","submitted_at":"2026-04-20T13:13:31Z","title":"AgenTEE: Confidential LLM Agent Execution on Edge Devices","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-10T04:46:53.351566Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.18231"},"observation_digest":"sha256:3e9cd4203724c8a177dc44ebb293e85fb2a63a4f65506cc83e5a9af29345e73d","observation_id":"2f49fb74-6c1a-4231-829a-5d605d171708","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.18658","last_updated":"2026-04-20T10:11:26Z","snapshot_observed_at":"2026-07-06T23:05:26.398712Z","submitted_at":"2026-04-20T10:11:26Z","title":"Owner-Harm: A Missing Threat Model for AI Agent Safety","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-10T04:39:28.683739Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.18658"},"observation_digest":"sha256:7793bff1b31d62fe0c8bd93a526ff8a72704fe210c8819086599df857bdeeade","observation_id":"c0a4e646-a4f9-4fef-a2b7-5b960b6898b8","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.19657","last_updated":"2026-04-21T16:45:30Z","snapshot_observed_at":"2026-07-06T23:06:16.972438Z","submitted_at":"2026-04-21T16:45:30Z","title":"An AI Agent Execution Environment to Safeguard User Data","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-10T02:14:40.639143Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.19657"},"observation_digest":"sha256:ac352384a318badca03e95ab303e2e434a785a3861e45737a1fe35708fe47efd","observation_id":"d2d8fdeb-5ab3-46fb-94ab-d3765902ceeb","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2604.23374","last_updated":"2026-04-25T16:39:16Z","snapshot_observed_at":"2026-07-06T23:09:38.799345Z","submitted_at":"2026-04-25T16:39:16Z","title":"Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-08T08:08:24.524671Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2604.23374"},"observation_digest":"sha256:ecde4122eac684aa08cd8286f3b43ad1d910cabe52cdd93e7c958193606d548d","observation_id":"f1f14165-85e0-4f9b-8a09-b75b52e0f5fe","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.00314","last_updated":"2026-05-01T00:48:47Z","snapshot_observed_at":"2026-07-06T23:13:47.082550Z","submitted_at":"2026-05-01T00:48:47Z","title":"Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-09T19:58:28.584941Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.00314"},"observation_digest":"sha256:0d053d343af859ac5825e75926268104a34713d1852911959a08ae125948efe5","observation_id":"37400b07-0971-4055-b661-c7da34b23ab8","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.01970","last_updated":"2026-05-15T06:42:15Z","snapshot_observed_at":"2026-07-06T23:15:07.159340Z","submitted_at":"2026-05-03T17:07:20Z","title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-09T17:13:47.722098Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.01970"},"observation_digest":"sha256:6f06585bb73546781dbcdb22d9db94ddbf51bad863c1fc171465c0501840cdaf","observation_id":"b228fcd1-cb3c-40e8-bd41-b1159f5f735d","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.01970","last_updated":"2026-05-15T06:42:15Z","snapshot_observed_at":"2026-07-06T23:15:07.159340Z","submitted_at":"2026-05-03T17:07:20Z","title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","version":3},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-19T17:30:22.481943Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.01970"},"observation_digest":"sha256:a2888a584769c0a458b30022404ea3444e98997420f625ee5eed812154c142b8","observation_id":"594bac72-42b0-4be8-b0fd-3349fad95b93","resolution":{"observed_at":"2026-05-19T17:32:41.575594Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.02187","last_updated":"2026-07-22T08:25:06Z","snapshot_observed_at":"2026-08-02T15:04:18.239470Z","submitted_at":"2026-05-04T03:35:17Z","title":"Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agents","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-05-08T18:42:06.418583Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.02187"},"observation_digest":"sha256:f8a35b9beb71b916b58e0c300a4faa3d366bf97fe820fc9e63b7112f53759bdd","observation_id":"6d06679b-454e-49fa-9d94-bc5c50fe676c","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-02T15:04:27.407345Z","title":"Defeating prompt injections by design.arXiv preprint arXiv:2503.18813, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2605.02187","last_updated":"2026-07-22T08:25:06Z","snapshot_observed_at":"2026-08-02T15:04:18.239470Z","submitted_at":"2026-05-04T03:35:17Z","title":"Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agents","version":2},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-02T15:04:27.407345Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.02187"},"observation_digest":"sha256:18b31fc59c8150db929e168985f411b4c390a52b5ac1b362e0f6e17694fd82bd","observation_id":"86d63f80-7af6-4a64-8ad5-6b82be262303","resolution":{"observed_at":"2026-08-02T15:04:27.407345Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.03143","last_updated":"2026-05-04T20:32:40Z","snapshot_observed_at":"2026-08-02T05:33:23.831248Z","submitted_at":"2026-05-04T20:32:40Z","title":"Pact: A Choreographic Language for Agentic Ecosystems","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-08T01:29:55.447306Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.03143"},"observation_digest":"sha256:84e0cf56b8c1035aee11a0e89a32682b0568af937f317aef9fcc7f924330f5f4","observation_id":"1d4b984e-f05f-44d7-8fe7-cb393428fb4b","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.03378","last_updated":"2026-07-08T15:04:28Z","snapshot_observed_at":"2026-08-02T02:34:38.609069Z","submitted_at":"2026-05-05T05:37:00Z","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","version":1},"reference_index":146,"source":"arxiv_source","source_observed_at":"2026-05-07T15:59:49.513500Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.03378"},"observation_digest":"sha256:4a43d01b7eefdd1688f90bd0f8e5bd94a393c9e388ead11968aad1a51e6a6fd9","observation_id":"12316065-bd92-4d58-87c0-dd548fdddfcb","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.06933","last_updated":"2026-05-18T15:00:37Z","snapshot_observed_at":"2026-08-02T06:59:00.397669Z","submitted_at":"2026-05-07T20:46:07Z","title":"MAGIQ: A Post-Quantum Multi-Agentic AI Governance System with Provable Security","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-11T01:08:47.097355Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.06933"},"observation_digest":"sha256:9893f0280e896a03e92ab50f242bd3d7c2eb7492c0b4006793a5fc8b98fa9d84","observation_id":"5da1024e-0ea3-4e62-9ad0-35a9d75dbe3a","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.06933","last_updated":"2026-05-18T15:00:37Z","snapshot_observed_at":"2026-08-02T06:59:00.397669Z","submitted_at":"2026-05-07T20:46:07Z","title":"MAGIQ: A Post-Quantum Multi-Agentic AI Governance System with Provable Security","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-20T22:31:48.507150Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.06933"},"observation_digest":"sha256:2e46495ae292f7a7b7ce47e63f3f183f97089f29298b9a2db405c468a9d34134","observation_id":"78280b7c-e19a-40c3-b62a-d2eb46cdee5e","resolution":{"observed_at":"2026-05-20T22:33:48.500016Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.08460","last_updated":"2026-05-08T20:27:23Z","snapshot_observed_at":"2026-07-06T23:20:43.010758Z","submitted_at":"2026-05-08T20:27:23Z","title":"When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-05-12T01:20:55.221345Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.08460"},"observation_digest":"sha256:0d7037c097c906a4f2d733f9e70cbdce4148ea37a1f1cd1e22e1c6ae2c7ebac5","observation_id":"73699191-1658-46f8-9909-cd6cf9129213","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.10763","last_updated":"2026-05-11T15:58:37Z","snapshot_observed_at":"2026-07-06T23:22:42.512039Z","submitted_at":"2026-05-11T15:58:37Z","title":"MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-12T04:57:39.433739Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.10763"},"observation_digest":"sha256:8cac4a2b803798e2c385f180c0a03aeecd739bf00945b7165bab9a062cc805fd","observation_id":"7bcd1ecc-c7a7-45e6-a89d-1ecc13218f76","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.10907","last_updated":"2026-06-10T16:03:18Z","snapshot_observed_at":"2026-07-06T23:22:47.781940Z","submitted_at":"2026-05-11T17:46:33Z","title":"Engineering Robustness into Personal Agents with the AI Workflow Store","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-12T03:32:57.622766Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.10907"},"observation_digest":"sha256:0c9d777d8a7a55522968f275dc9f688c31d6b19cc849df8a1975ea4cc95dc158","observation_id":"95103f03-5f6f-46f9-8039-c2b1bb493a7e","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.10907","last_updated":"2026-06-10T16:03:18Z","snapshot_observed_at":"2026-07-06T23:22:47.781940Z","submitted_at":"2026-05-11T17:46:33Z","title":"Engineering Robustness into Personal Agents with the AI Workflow Store","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-13T03:17:03.480610Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.10907"},"observation_digest":"sha256:9fef2b64afdf5fe4b22210104e4c1c1d3f76e4d640669ee1b96d65259b138afb","observation_id":"3634e635-cfaa-4e75-9fd5-97acc9795aff","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.10907","last_updated":"2026-06-10T16:03:18Z","snapshot_observed_at":"2026-07-06T23:22:47.781940Z","submitted_at":"2026-05-11T17:46:33Z","title":"Engineering Robustness into Personal Agents with the AI Workflow Store","version":3},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-06-30T22:10:22.013935Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.10907"},"observation_digest":"sha256:f2afbeaa49dc4c741a6660d34fd204bda3b1b0e944d54229cbfd21f5a43f36de","observation_id":"f32dc9c3-c611-409d-9492-fb406b939ee8","resolution":{"observed_at":"2026-07-01T14:15:47.120873Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.11026","last_updated":"2026-05-10T20:08:27Z","snapshot_observed_at":"2026-07-06T23:22:57.012338Z","submitted_at":"2026-05-10T20:08:27Z","title":"AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-13T01:31:34.468389Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.11026"},"observation_digest":"sha256:1d01c923906f2e33c5c15beab3a3ead153414d1be1eb7fc7e83eeb6fed62ec14","observation_id":"4b61da4b-582f-42c2-8812-ba8729ae0ac4","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.11039","last_updated":"2026-05-11T04:09:11Z","snapshot_observed_at":"2026-07-06T23:22:57.012338Z","submitted_at":"2026-05-11T04:09:11Z","title":"The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-13T01:31:13.100257Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.11039"},"observation_digest":"sha256:5cf7df5b847243d9ec6e3aba5d83491463781f66bcec42ceb38184f00c9731ae","observation_id":"b3f71de2-a0f2-4e8a-8bc7-479a232cc626","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.11868","last_updated":"2026-05-12T09:48:53Z","snapshot_observed_at":"2026-07-06T23:23:39.723268Z","submitted_at":"2026-05-12T09:48:53Z","title":"IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-13T05:46:07.132408Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.11868"},"observation_digest":"sha256:c1631c17a79cf14df9d142da3415b103a1882a6da0a5293814f03fa0d4b76b8d","observation_id":"9b6ca1f1-565b-44fc-9560-80d1a5eed6eb","resolution":{"observed_at":"2026-05-13T06:58:51.233859Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.12863","last_updated":"2026-05-13T01:21:05Z","snapshot_observed_at":"2026-08-01T20:28:13.724342Z","submitted_at":"2026-05-13T01:21:05Z","title":"Language-Based Agent Control","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-06-30T21:41:37.021482Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.12863"},"observation_digest":"sha256:e97dca5ddc8cbb7ecfe22da22249fa91f87fb78b230d3d7d25a3862bf9463b89","observation_id":"b7f900d4-3545-48e6-96ca-8c24fcf7d241","resolution":{"observed_at":"2026-07-01T14:25:45.919982Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.12876","last_updated":"2026-05-13T01:44:31Z","snapshot_observed_at":"2026-07-06T23:24:32.412966Z","submitted_at":"2026-05-13T01:44:31Z","title":"Certified Robustness under Heterogeneous Perturbations via Hybrid Randomized Smoothing","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-14T20:23:24.004872Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.12876"},"observation_digest":"sha256:219233bd2ea9c513c2394a3dcf10be8adcafba4a8568973f219e2d7ac1b5c0bd","observation_id":"96b1a0cf-aa67-40ac-aea4-1f1f0f891b4d","resolution":{"observed_at":"2026-05-14T20:47:59.133922Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.13471","last_updated":"2026-05-13T12:57:31Z","snapshot_observed_at":"2026-07-06T23:25:01.951546Z","submitted_at":"2026-05-13T12:57:31Z","title":"Sleeper Channels and Provenance Gates: Persistent Prompt Injection in Always-on Autonomous AI Agents","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-14T18:21:06.872045Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.13471"},"observation_digest":"sha256:79cfa4ffd1088f80620c363c826dca2160fed5f19f0bf88280f2cef5c7de72b6","observation_id":"08299630-9fbc-4ef5-be95-e9377792a85a","resolution":{"observed_at":"2026-05-14T18:22:33.605271Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.14290","last_updated":"2026-05-14T02:48:57Z","snapshot_observed_at":"2026-08-03T04:50:16.568616Z","submitted_at":"2026-05-14T02:48:57Z","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-15T02:42:05.644536Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.14290"},"observation_digest":"sha256:3e267a354e94b06bd715e727ac9d803d2931cb3cedd9292aedf5570ac11adad8","observation_id":"5b962b1b-3ca6-4a7c-9a3a-f3fed07b89e8","resolution":{"observed_at":"2026-05-15T02:43:33.378646Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.16976","last_updated":"2026-05-16T12:53:31Z","snapshot_observed_at":"2026-08-02T19:09:38.060554Z","submitted_at":"2026-05-16T12:53:31Z","title":"Securing LLM Agents Need Intent-to-Execution Integrity","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-19T20:17:04.049686Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.16976"},"observation_digest":"sha256:f26223fa624baf32ca34b1f8b6d439cbd40a3d2f5088a57f606675a3693db2d9","observation_id":"0f9916f0-fe64-42ec-bd71-cabf0507bf09","resolution":{"observed_at":"2026-05-19T20:17:45.526644Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.17453","last_updated":"2026-05-17T13:51:34Z","snapshot_observed_at":"2026-08-02T00:37:59.573957Z","submitted_at":"2026-05-17T13:51:34Z","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-19T23:26:15.658106Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.17453"},"observation_digest":"sha256:4e01fb7023373ad845be6844635558c289cc5f80d185738debf9b98bb4a4db38","observation_id":"47acb930-00d5-4610-b6f8-40b5bd42ced8","resolution":{"observed_at":"2026-05-19T23:27:52.462500Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.18697","last_updated":"2026-05-18T17:33:50Z","snapshot_observed_at":"2026-08-01T20:09:00.831432Z","submitted_at":"2026-05-18T17:33:50Z","title":"PopPy: Opportunistically Exploiting Parallelism in Python Compound AI Applications","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-20T08:03:37.087309Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.18697"},"observation_digest":"sha256:24659b2152a79a2deec4666d4622a4179710dcd70607ded2d1a1f24b059ff50a","observation_id":"e4b2cac2-4ea7-48bf-84af-b399208393b5","resolution":{"observed_at":"2026-05-20T08:08:08.958639Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-20T09:02:59.719090Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:005f447cdc30418fd0bf5feffd6f9950bef968dfc623985d69ead3889fe2a108","observation_id":"c0581715-d149-456d-94de-902d020cf9cb","resolution":{"observed_at":"2026-05-20T09:03:09.847981Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-07-06T23:29:47.081347Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:2e5e0994687faae03462c1f007263d6a1cfe14147732f199228f9907f1874526","observation_id":"47089b14-e6e7-4a34-994f-36c50ea98e00","resolution":{"observed_at":"2026-05-21T07:44:02.910333Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.22643","last_updated":"2026-05-22T14:53:30Z","snapshot_observed_at":"2026-07-06T23:32:59.663926Z","submitted_at":"2026-05-21T15:50:18Z","title":"Boiling the Frog: A Multi-Turn Benchmark for Agentic Safety","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-22T05:50:28.114140Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.22643"},"observation_digest":"sha256:c614098343488624247ec2a16a2915ebe6da49262f329a79d4ca9b3727f68d43","observation_id":"87985fdd-6c7d-4854-93ca-4bf184c3298b","resolution":{"observed_at":"2026-05-22T05:51:07.825126Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.22643","last_updated":"2026-05-22T14:53:30Z","snapshot_observed_at":"2026-07-06T23:32:59.663926Z","submitted_at":"2026-05-21T15:50:18Z","title":"Boiling the Frog: A Multi-Turn Benchmark for Agentic Safety","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-25T06:05:27.736494Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.22643"},"observation_digest":"sha256:2ae569686d6a4f7359efb2c93cf2aea1571226586fe35a169d6e719779507bd0","observation_id":"3293e6f6-0011-4d24-a386-e093cd53c11c","resolution":{"observed_at":"2026-05-25T06:06:42.892565Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.23330","last_updated":"2026-05-22T07:45:04Z","snapshot_observed_at":"2026-08-02T05:47:41.731065Z","submitted_at":"2026-05-22T07:45:04Z","title":"Security, Privacy, and Ethical Risks in OpenClaw","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-25T04:25:49.102385Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.23330"},"observation_digest":"sha256:750e0928e05fa080065dbdcf6db1e3a4217440e2a374b75ac46af690f1868baa","observation_id":"8d106773-ac14-498c-831a-4554a7caef22","resolution":{"observed_at":"2026-05-25T04:26:37.747860Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.24309","last_updated":"2026-05-23T00:36:48Z","snapshot_observed_at":"2026-07-06T23:34:23.087565Z","submitted_at":"2026-05-23T00:36:48Z","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-30T13:52:06.272229Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.24309"},"observation_digest":"sha256:822c24ec0d88841aa169bb8f6f694779d3ec27a36121282198e1b9726c043e9a","observation_id":"d96b1da7-ef48-40bf-bdd8-53926f0533cf","resolution":{"observed_at":"2026-06-30T13:54:43.855346Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.26298","last_updated":"2026-05-25T19:51:30Z","snapshot_observed_at":"2026-07-06T23:36:11.031436Z","submitted_at":"2026-05-25T19:51:30Z","title":"Sandlock: Confining AI Agent Code with Unprivileged Linux Primitives","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-06-29T21:14:08.214846Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.26298"},"observation_digest":"sha256:d0fc155254e2ffcb14a2fd141e5c5283886617d62d5126dbdaf07621e0d7cc98","observation_id":"8be3032c-958e-4c38-a858-cfdb1511ec13","resolution":{"observed_at":"2026-06-29T21:23:58.540163Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.26497","last_updated":"2026-05-26T03:20:23Z","snapshot_observed_at":"2026-07-06T23:36:20.072253Z","submitted_at":"2026-05-26T03:20:23Z","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-06-29T17:36:40.290498Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.26497"},"observation_digest":"sha256:b4f5275927175e5de257a2c65f7fb035a676b6495849c8e3ee18bce8bc68d295","observation_id":"e0a9fead-a953-4018-97aa-e042849b1479","resolution":{"observed_at":"2026-06-29T18:03:48.495140Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.28071","last_updated":"2026-05-27T07:28:39Z","snapshot_observed_at":"2026-08-01T14:57:39.651617Z","submitted_at":"2026-05-27T07:28:39Z","title":"AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agent","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-06-29T11:52:40.824480Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.28071"},"observation_digest":"sha256:a7ca4483d5af55520e7cb967275418bfd40ad4c826c6e2410af125afe324fae3","observation_id":"67e11105-4279-4a91-ac1f-24bd2aee9fa0","resolution":{"observed_at":"2026-06-29T11:53:23.341322Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.28914","last_updated":"2026-05-27T17:48:14Z","snapshot_observed_at":"2026-07-06T23:38:23.512460Z","submitted_at":"2026-05-27T17:48:14Z","title":"AIRGuard: Guarding Agent Actions with Runtime Authority Control","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-06-29T11:27:11.944532Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.28914"},"observation_digest":"sha256:9f99e48ab38c01e6318a3fc1d3122df90263726c66febb8b05050d9b01114e1b","observation_id":"87ee80af-8a02-4f63-8cfd-fc32c0677f63","resolution":{"observed_at":"2026-06-29T12:53:27.145109Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.28999","last_updated":"2026-05-27T18:56:19Z","snapshot_observed_at":"2026-07-06T23:38:27.990823Z","submitted_at":"2026-05-27T18:56:19Z","title":"Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-06-29T11:16:52.024973Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.28999"},"observation_digest":"sha256:4045789b418a89f569180dfa1e9344ba487cf48abaaac750e1bca75d1fc00576","observation_id":"ebc6ee4a-0035-4b03-8520-4f40d541da64","resolution":{"observed_at":"2026-06-29T11:23:21.312290Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2605.31042","last_updated":"2026-05-29T09:19:07Z","snapshot_observed_at":"2026-07-06T23:40:17.605034Z","submitted_at":"2026-05-29T09:19:07Z","title":"From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-06-28T22:06:41.245543Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2605.31042"},"observation_digest":"sha256:91a2bb79cc110a921e0ecedf98f64914221cb811227daceb8154e6e0c6e43ee6","observation_id":"ffb9f178-b0b3-421e-870a-93c15a9e8dfa","resolution":{"observed_at":"2026-06-28T22:12:41.472594Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.00036","last_updated":"2026-04-25T15:43:09Z","snapshot_observed_at":"2026-07-06T23:40:46.825645Z","submitted_at":"2026-04-25T15:43:09Z","title":"AI Integrity: Defending Against Backdoors and Secret Loyalties","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-04T14:56:53.806480Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.00036"},"observation_digest":"sha256:78c625aab80574770380907f6c5ec6ab07784ee6302f356cc639708dbb993202","observation_id":"18c3742e-4d4e-4586-9054-d422de6b0a7f","resolution":{"observed_at":"2026-07-04T14:59:54.625457Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.00288","last_updated":"2026-06-24T07:36:07Z","snapshot_observed_at":"2026-07-06T23:41:01.066075Z","submitted_at":"2026-05-29T19:20:16Z","title":"Model-Native Computing Architecture: Envisioning Future System Architecture Through the Lens of Computer Architecture","version":3},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-06-28T22:12:13.114405Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.00288"},"observation_digest":"sha256:c119b4b49368327da8e0ccca95fd3b552e3c5b2f72b455a98a53e66bc9ab6e5b","observation_id":"245fc154-1c5c-43c6-80bd-b26c268978a6","resolution":{"observed_at":"2026-07-01T19:36:09.366795Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.00448","last_updated":"2026-05-30T00:38:07Z","snapshot_observed_at":"2026-08-03T06:02:54.207055Z","submitted_at":"2026-05-30T00:38:07Z","title":"When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-06-28T18:45:33.322389Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.00448"},"observation_digest":"sha256:482452f616e5f66d49617fd4b9910c702498dbee9591e8b171c6fee0e77424fb","observation_id":"9c7e5771-f75a-4f4a-b55a-39ce6263bd48","resolution":{"observed_at":"2026-06-28T19:52:36.053236Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.02668","last_updated":"2026-06-01T11:08:17Z","snapshot_observed_at":"2026-07-06T23:43:02.654629Z","submitted_at":"2026-06-01T11:08:17Z","title":"What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agents","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-06-28T14:12:38.815852Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.02668"},"observation_digest":"sha256:b7e57f3f758e6d5bae8fea1bd9d1c9983815b2cc158e3b3e3b98044812102e17","observation_id":"34327849-1d8b-4ebf-8ed9-8052911efb35","resolution":{"observed_at":"2026-07-01T23:36:22.954515Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.04990","last_updated":"2026-06-28T07:06:10Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2026-06-03T15:12:47Z","title":"From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents","version":3},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-06-28T05:32:34.771787Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.04990"},"observation_digest":"sha256:8506229c32c6a04cfabb07b50d9a48da6475903778156fb6ba6b048e1469eee4","observation_id":"245932b5-6148-423d-950c-e7da038a00a5","resolution":{"observed_at":"2026-07-02T09:16:49.566278Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.04990","last_updated":"2026-06-28T07:06:10Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2026-06-03T15:12:47Z","title":"From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents","version":4},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-06-30T10:44:54.123704Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.04990"},"observation_digest":"sha256:db5d1b63afb06a5c7cf1b8d4a9900e2c5ae97385430aa9cf149cd8038bc30149","observation_id":"83c12e36-adde-4668-910d-4802ea6fb1d3","resolution":{"observed_at":"2026-06-30T11:04:37.860907Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.05679","last_updated":"2026-06-04T04:01:24Z","snapshot_observed_at":"2026-08-03T00:29:19.443809Z","submitted_at":"2026-06-04T04:01:24Z","title":"Data Flow Control: Data Safety Policies for AI Agents","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-06-27T23:28:47.480408Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.05679"},"observation_digest":"sha256:8110359305733fba4e361733ad71a2504b83a6505530d4d0e5e0e24dd6a7a604","observation_id":"0d87f913-6392-4b44-9464-5ae2397d9a15","resolution":{"observed_at":"2026-07-02T15:47:06.355024Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.07808","last_updated":"2026-06-05T19:36:48Z","snapshot_observed_at":"2026-07-06T23:47:24.424525Z","submitted_at":"2026-06-05T19:36:48Z","title":"Where Instruction Hierarchy Breaks: Diagnosing and Repairing Failures in Reasoning Language Models","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-06-27T21:51:34.829877Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.07808"},"observation_digest":"sha256:0d59710ec348bd92ef252ba0771f2f5a0d3caf64f7916be2e811e8b32f935deb","observation_id":"5de1093b-f2f7-4a01-92f2-a533cad856c6","resolution":{"observed_at":"2026-07-02T17:47:18.114428Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.09005","last_updated":"2026-06-08T04:09:00Z","snapshot_observed_at":"2026-08-03T07:13:14.845386Z","submitted_at":"2026-06-08T04:09:00Z","title":"Document-Authored Control-Signal Impersonation: A Low-Cost Indirect Prompt Attack on RAG Safety Boundaries","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-06-27T16:41:28.274409Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.09005"},"observation_digest":"sha256:81cd32f14c5f9cc5437d7fa00b9eae9cec60e37f17c2f95c82cdb5666aae50a1","observation_id":"9e65e1a0-1e2f-4a6a-9146-26d95b630487","resolution":{"observed_at":"2026-07-03T01:17:30.896276Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.10322","last_updated":"2026-06-09T02:18:44Z","snapshot_observed_at":"2026-08-01T07:26:53.142922Z","submitted_at":"2026-06-09T02:18:44Z","title":"Game-Theoretic Multi-Agent Control for Robust Contextual Reasoning in LLMs","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-06-27T13:05:57.618969Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.10322"},"observation_digest":"sha256:ac627493a3b61152c183e53c77852d55f79633ec0878483a33885d66a343d423","observation_id":"bc772e50-d442-4aba-8121-318e1aec71a1","resolution":{"observed_at":"2026-07-03T05:47:41.223186Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-01T16:42:50.356614Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:df0a5491d8169a9df704bc7230f901fedd004ce8e1ba86f59e4564566b2ae2f0","observation_id":"c5a085ea-1145-4b70-a35c-4a057d34e657","resolution":{"observed_at":"2026-07-03T06:17:41.846662Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.10749","last_updated":"2026-06-09T12:01:07Z","snapshot_observed_at":"2026-07-31T21:35:18.696472Z","submitted_at":"2026-06-09T12:01:07Z","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-06-27T12:55:22.831264Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.10749"},"observation_digest":"sha256:103ab9f9adb1fd009f4d51c41dcdbc9db8062a9538890df6a42d135d63c9e2cb","observation_id":"aedca008-bfc0-45d4-9ad2-f1e62fb4ac34","resolution":{"observed_at":"2026-06-27T13:20:56.816241Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.12320","last_updated":"2026-06-10T16:54:47Z","snapshot_observed_at":"2026-07-30T03:53:23.122847Z","submitted_at":"2026-06-10T16:54:47Z","title":"A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-06-27T10:09:35.461423Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.12320"},"observation_digest":"sha256:27ec26df7a5a974e786232974c106b6acf801df48585d9228d83884169bea921","observation_id":"5de21b34-3824-4319-b671-be150b1fcd6e","resolution":{"observed_at":"2026-07-03T10:17:57.578573Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.12341","last_updated":"2026-06-10T17:13:35Z","snapshot_observed_at":"2026-07-06T23:51:17.719874Z","submitted_at":"2026-06-10T17:13:35Z","title":"OCELOT: Inference-Leakage Budgets for Privacy-Preserving LLM Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-27T09:11:42.204778Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.12341"},"observation_digest":"sha256:f97ebcfa97f6773d7b2c0b0409f06a13129f1c8d1051b5cd1f00051b6941bb3f","observation_id":"5709d5c7-8162-43a1-88fb-5aa7d6eab53e","resolution":{"observed_at":"2026-07-03T11:58:06.924551Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.15057","last_updated":"2026-06-19T04:47:48Z","snapshot_observed_at":"2026-07-06T23:52:28.557859Z","submitted_at":"2026-06-13T02:09:08Z","title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-06-27T04:57:54.827932Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.15057"},"observation_digest":"sha256:13d8c894abb0b2f3e5c908ae3e2de69a481a1552026ed1c74f6a0aa2ef67ac32","observation_id":"7679050e-0e2c-4070-908f-3323c2361e7a","resolution":{"observed_at":"2026-07-03T16:48:40.524630Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.18530","last_updated":"2026-06-16T22:51:02Z","snapshot_observed_at":"2026-08-03T05:17:11.488222Z","submitted_at":"2026-06-16T22:51:02Z","title":"Evaluating Prompting-Based Defenses Against Domain-Camouflaged Injection Attacks","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-06-26T23:45:25.770548Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.18530"},"observation_digest":"sha256:a7c435fcf4d57ecb44ec24a39542b2425d5242dc99fe13514a95c6324dc8eabd","observation_id":"5ae01ffe-831b-4cb4-b209-b793c4c6fd26","resolution":{"observed_at":"2026-07-03T22:08:59.307242Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.18550","last_updated":"2026-06-17T00:00:11Z","snapshot_observed_at":"2026-08-03T01:10:08.307815Z","submitted_at":"2026-06-17T00:00:11Z","title":"The Gate Is Only as Honest as Its Contracts: ContractGuard for the Contract Layer of Risk-Aware Causal Gating","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-06-26T20:58:24.056435Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.18550"},"observation_digest":"sha256:45640d8046aaad03dc6f50a62f4f7b2bae41cbf536e7620ef788164db37933cc","observation_id":"f25ea887-a358-49fb-b7a4-8a5a2f94b55e","resolution":{"observed_at":"2026-07-04T00:49:18.311385Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.20922","last_updated":"2026-06-18T20:31:08Z","snapshot_observed_at":"2026-08-03T14:06:23.532934Z","submitted_at":"2026-06-18T20:31:08Z","title":"Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-06-26T16:32:09.625729Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.20922"},"observation_digest":"sha256:4f8a5f9a27efdb6277c50b3d91169981453e45a9db7a2b9c005be5cfb7060606","observation_id":"c3e3be16-36d6-4a0e-8a92-2d80c07460c7","resolution":{"observed_at":"2026-07-04T04:59:36.386362Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.21732","last_updated":"2026-06-19T20:43:14Z","snapshot_observed_at":"2026-07-06T23:56:40.795364Z","submitted_at":"2026-06-19T20:43:14Z","title":"Safe to Check, Unsafe to Use: Relinking at the Compression Boundary of LLM Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-26T13:23:54.784902Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.21732"},"observation_digest":"sha256:53b4e4b66cc68a70e3015c6aef721ebcb3beea053ff497491bb62f490f3009c9","observation_id":"4d8b5ac6-8a54-4702-b722-e29dcf5d67bf","resolution":{"observed_at":"2026-07-04T07:29:39.128527Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.22528","last_updated":"2026-06-27T08:35:20Z","snapshot_observed_at":"2026-08-02T15:43:38.391751Z","submitted_at":"2026-06-21T14:30:20Z","title":"Governance Decay: How Context Compaction Silently Erases Safety Constraints in Long-Horizon LLM Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-06-26T10:45:36.408818Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.22528"},"observation_digest":"sha256:0dae27edf1c9f26c563b73e3b8752e22b3d2204d0cdafc863ead7d4ee90803b9","observation_id":"c1118d07-9846-4318-a062-2daf2767eec8","resolution":{"observed_at":"2026-07-04T08:59:42.379117Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.23277","last_updated":"2026-06-22T12:54:04Z","snapshot_observed_at":"2026-08-02T06:21:16.386788Z","submitted_at":"2026-06-22T12:54:04Z","title":"GIF: Locally Sound Geometric Information Flow Control for LLMs","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-26T08:24:49.908288Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.23277"},"observation_digest":"sha256:175758dfa1719c20d11ff602243ce1dbf2d6b45c4bac5a06a4b1e315d617621c","observation_id":"4d4e55d3-324b-4cdc-bc6e-1e4e27ffc4af","resolution":{"observed_at":"2026-07-04T10:49:46.739536Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.23416","last_updated":"2026-06-22T14:41:06Z","snapshot_observed_at":"2026-07-06T23:58:11.694332Z","submitted_at":"2026-06-22T14:41:06Z","title":"Detecting Malicious Agent Skills in the Wild using Attention","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-06-26T07:44:28.260280Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.23416"},"observation_digest":"sha256:8bd2e527a46470be86afdc037cfb984901db374dd65d8a9c3541321f67088b4a","observation_id":"64f8e865-2fc4-4983-8dd4-ed057c034aaf","resolution":{"observed_at":"2026-07-04T11:39:47.680493Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.24322","last_updated":"2026-06-23T08:57:50Z","snapshot_observed_at":"2026-07-06T23:58:54.018557Z","submitted_at":"2026-06-23T08:57:50Z","title":"Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-06-25T23:40:36.181525Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.24322"},"observation_digest":"sha256:cd13ce42c9182d61f1528484758ccec1653ab2524a83478bb951994a65df4b21","observation_id":"7d3094e3-9121-47d9-9744-2cfb19015294","resolution":{"observed_at":"2026-07-04T17:30:00.209196Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.24535","last_updated":"2026-06-23T13:04:14Z","snapshot_observed_at":"2026-08-03T20:32:28.314300Z","submitted_at":"2026-06-23T13:04:14Z","title":"Governed Shared Memory for Multi-Agent LLM Systems","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-06-25T23:56:11.566393Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.24535"},"observation_digest":"sha256:8c1d061284a2a1cbd5d990b84db088f73e484b2fe1bb069f5d8dc6a7c8d15866","observation_id":"25777ca8-de86-4bda-a7e7-3e5fceefbe76","resolution":{"observed_at":"2026-07-04T17:09:58.690933Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.25189","last_updated":"2026-06-30T22:31:10Z","snapshot_observed_at":"2026-07-06T23:59:42.289674Z","submitted_at":"2026-06-23T21:33:13Z","title":"ActPlane: Programmable OS-Level Policy Enforcement for Agent Harnesses","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-25T21:14:10.499550Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.25189"},"observation_digest":"sha256:a82c2d8c1be519c0fb87e4e774a63c9338b6cfd72c6c44aaccf7c0278a319108","observation_id":"00ee360c-91d8-4792-8300-29f991314fde","resolution":{"observed_at":"2026-07-04T19:30:07.961689Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.25189","last_updated":"2026-06-30T22:31:10Z","snapshot_observed_at":"2026-07-06T23:59:42.289674Z","submitted_at":"2026-06-23T21:33:13Z","title":"ActPlane: Programmable OS-Level Policy Enforcement for Agent Harnesses","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-02T21:40:56.408974Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.25189"},"observation_digest":"sha256:7e432a2ef899e4fbb6c8192d61fc736ce2f194cad0097c791c74e07101a0fe6b","observation_id":"284cde31-08be-4cef-9862-fcdc329eef54","resolution":{"observed_at":"2026-07-02T21:47:27.558879Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.26479","last_updated":"2026-06-25T00:35:23Z","snapshot_observed_at":"2026-07-07T00:00:46.505337Z","submitted_at":"2026-06-25T00:35:23Z","title":"Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-06-26T04:58:59.046289Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.26479"},"observation_digest":"sha256:c092a1b8dd2d433f041d73fd48a4a63a4bab781ca7e0ab438b6a9e36a9e93c06","observation_id":"b32baa66-2ca9-4e74-acf4-67f1bf80442d","resolution":{"observed_at":"2026-07-04T13:39:51.398669Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.26524","last_updated":"2026-06-25T01:58:44Z","snapshot_observed_at":"2026-08-03T11:20:16.432997Z","submitted_at":"2026-06-25T01:58:44Z","title":"VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-06-26T04:42:47.126107Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.26524"},"observation_digest":"sha256:7139c5efa311adf4152376554fa1d5d9e4c79658976e0be6344db83b70d524f4","observation_id":"eebe8c6c-4a46-4048-ab79-4c76823282d8","resolution":{"observed_at":"2026-07-04T13:59:52.332369Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.26627","last_updated":"2026-06-25T05:44:18Z","snapshot_observed_at":"2026-08-02T09:36:56.612724Z","submitted_at":"2026-06-25T05:44:18Z","title":"Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-06-26T04:29:16.386339Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.26627"},"observation_digest":"sha256:dc68cfe63cf46eb162e9beb7f5f2a0c33e599388a6e171908d3b21cc9951eb1e","observation_id":"87e23069-8ab6-4ed8-8fb9-6e8f1518de6c","resolution":{"observed_at":"2026-07-04T14:09:53.240687Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2606.30383","last_updated":"2026-06-29T14:39:38Z","snapshot_observed_at":"2026-08-04T03:27:44.496352Z","submitted_at":"2026-06-29T14:39:38Z","title":"Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-30T05:48:15.990443Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2606.30383"},"observation_digest":"sha256:de11629a1883d49f15ddeb28ca1dd73efaa743bbfdc5301315a90b224faeb34d","observation_id":"e49eb883-4526-4a01-85df-71df668e05f7","resolution":{"observed_at":"2026-06-30T13:44:41.469076Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2607.01236","last_updated":"2026-05-01T03:16:35Z","snapshot_observed_at":"2026-07-07T00:06:49.412663Z","submitted_at":"2026-05-01T03:16:35Z","title":"Safeguarding LLM Agents from Misalignment through Provenance Analysis","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-04T01:26:25.858521Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.01236"},"observation_digest":"sha256:3102ffef6770228e50f9749597984a8085d7f2c65d25205d442c00a5346f1aec","observation_id":"e82459c9-91b0-4b82-8127-7a378f181800","resolution":{"observed_at":"2026-07-04T01:29:22.004476Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":"2503.18813","doi":"10.48550/arxiv.2503.18813","metadata_source":"pith","pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-10T12:27:04.207627Z","title":"Defeating Prompt Injections by Design","venue":"cs.CR","work_id":"86405b86-1c51-4042-9b04-aff0b6541411","year":2025},"citing_paper":{"arxiv_id":"2607.02357","last_updated":"2026-07-03T12:34:17Z","snapshot_observed_at":"2026-08-03T03:14:43.962143Z","submitted_at":"2026-07-02T16:00:52Z","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-07-03T10:28:59.762796Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.02357"},"observation_digest":"sha256:2faaa1d856d11b32791fb08af00933e67036f0373b14402e382fcb03e33fdcfc","observation_id":"e4f5c155-4e9b-49f9-8c3f-664f48e9c044","resolution":{"observed_at":"2026-07-03T10:37:56.235427Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:36.91954+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-12T08:09:57.596812Z","title":"Defeating prompt injections by design,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.02357","last_updated":"2026-07-03T12:34:17Z","snapshot_observed_at":"2026-08-03T03:14:43.962143Z","submitted_at":"2026-07-02T16:00:52Z","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-07-12T08:09:57.596812Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.02357"},"observation_digest":"sha256:8143bdfa10426ba8ac249b75c9f236e46c47807a821c9df20c89e34bb8b2e1cc","observation_id":"9649899a-0b68-4f2b-8914-f22e7431730c","resolution":{"observed_at":"2026-07-12T08:09:57.596812Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-12T06:34:07.307906Z","title":"Defeating prompt injections by design,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.02857","last_updated":"2026-07-03T01:41:17Z","snapshot_observed_at":"2026-07-12T06:34:06.956598Z","submitted_at":"2026-07-03T01:41:17Z","title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-07-12T06:34:07.307906Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.02857"},"observation_digest":"sha256:f5a49284e5a805c87a9d64f0fe76e19c5126ddd159184e1de3fbe7200a85711a","observation_id":"dcce4937-73b0-4130-8fbb-dc0d97a5febe","resolution":{"observed_at":"2026-07-12T06:34:07.307906Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Defeating prompt injections by design,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-04T05:25:45.960823Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:a0220be8e2fbd9f4ad777c07bc63f0e723cba5a03d395c2725bbb95a2a84f132","observation_id":"285c5605-fad3-49bf-a22a-ee7a420b26e3","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-11T16:25:52.941193Z","title":"Defeating prompt injections by design, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.04613","last_updated":"2026-07-06T02:42:06Z","snapshot_observed_at":"2026-08-03T07:43:39.895771Z","submitted_at":"2026-07-06T02:42:06Z","title":"Governed Individuation: Cryptographically Decoupling an Agent's Learning from Its Authority","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-11T16:25:52.941193Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.04613"},"observation_digest":"sha256:24bd1a886440606f9592e0bdb3739b26368f708da3c1cbedc886c6c0a174adb8","observation_id":"acb983a4-e7a1-4cbe-b170-b1bef34b6a9c","resolution":{"observed_at":"2026-07-11T16:25:52.941193Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2503.18813/citation-record","integrity":"/paper/2503.18813/integrity","json":"/paper/2503.18813/citation-record.json","paper":"/paper/2503.18813"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"HH:MM\" representing how many hours and minutes you have until the lunch.↩→ User Running the code gave the following error: Traceback (most recent call last): File","venue":null,"work_id":"2a5b6b9d-1845-4c02-8e86-cad4ce761d92","year":2024},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:f9030a7d32b0d89b15b290404d22450a24b0bda64512d99c6cbc4ead4515a1c0","observation_id":"c867218b-8ba9-4e63-986a-e689cf883037","resolution":{"observed_at":"2026-05-13T06:58:50.498939Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"7b085212-f0b5-45b3-ac5d-9508888104e5","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:8d428f6f055a5f166c86e18fe3c82b810b7782feb042e0d9e232e6e439ea19da","observation_id":"f28f57f0-48ed-4614-93af-6a46458c7f89","resolution":{"observed_at":"2026-05-13T06:58:50.504458Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"4f926d7a-4450-4b54-b58f-23a9347f1f54","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:571e70b07a943d65689607e7789df0ba0117d1255d38928a8b623a10681329b9","observation_id":"9d173110-6614-44bf-a2dc-f0c486c7bb30","resolution":{"observed_at":"2026-05-13T06:58:50.509377Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"35b1bc7b-cd8a-4f23-bb65-24be046e2fb3","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:a4c57954ed936a10202128f954501d2af932fdeb19453621f420a6c175177514","observation_id":"46246e3a-8e82-4d6e-ba8e-aa5967c8240e","resolution":{"observed_at":"2026-05-13T06:58:50.514672Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"<stdin>\", line 11, in <module> info = query_ai_assistant( ^^^^^^^^^^^^^^^^^^^^^^^^^^","venue":null,"work_id":"03902a77-209e-4b22-9879-436ee7420ff4","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:b88d50fde3d6c074461d95a71720b576320d3a669fb69d178d552278607f0dcf","observation_id":"8bde27b5-8cd0-4c5f-a55e-2aa4d30233c9","resolution":{"observed_at":"2026-05-13T06:58:50.519869Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"a85aef4f-7f1b-4ee1-a0f6-6959a9c6b6c6","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:56330bec3901894516ccda711d5cdf330f5d4c9ff9eefec44424ee7a60ef1ebc","observation_id":"b2972e26-d7ff-4a35-b2b5-16cdb730dacf","resolution":{"observed_at":"2026-05-13T06:58:50.524836Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"398f464f-1c71-483c-8e29-4e4829d0e57c","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:13cccf0a5a6e3e809ef8b243b8592aab1b2449a477d70192020d4c92776c0310","observation_id":"3550dadb-def8-438d-b394-4fab673a18cd","resolution":{"observed_at":"2026-05-13T06:58:50.529571Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"e6d5e8da-0fed-4d37-b7aa-d182cc855dc5","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:8e4909d634baed1d29da0c123695f231b63d98b01c706ad593f3bd66f344d14b","observation_id":"edcf2aa5-05fe-47c2-95b5-3d2a3aea1c34","resolution":{"observed_at":"2026-05-13T06:58:50.534348Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"<stdin>\", line 2, in <module> info = query_ai_assistant( ^^^^^^^^^^^^^^^^^^^^^^^^^^","venue":null,"work_id":"9fd4ade4-e28e-46a9-be72-5c48945e9f98","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:6be46381116bb9e9064331d120c8565fc5758a6d16244c4abe3eedd9c1ce1431","observation_id":"e480ad3e-b918-421b-b8ef-1b9f0e60a2cd","resolution":{"observed_at":"2026-05-13T06:58:50.539008Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"482b48d0-2acc-4a3e-8b41-81ce8aa9423f","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:98b97f9ebe8bf7e3e8d85b656716918ee065d14f1341e6df1f70996f3897ee70","observation_id":"f8f219ab-7f72-4e65-a922-fb7cb0235431","resolution":{"observed_at":"2026-05-13T06:58:50.542986Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"959710b4-3897-4464-9768-dd84ebeed289","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:b10d3469ebe47ecf5a0192df10bbd9a567e1c2dcebdba2348eb3e9f4580bca30","observation_id":"0fa77f84-7482-4a8f-99a5-c7f8435021da","resolution":{"observed_at":"2026-05-13T06:58:50.546804Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"b527f766-ff82-4df3-9755-97a2a45bf796","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:db413395c2fd1ca5073d5e4b82562835dc96ad6c9b95ebcc904ce68de90b016f","observation_id":"4068f28e-abda-4691-b141-8f1336fff6f8","resolution":{"observed_at":"2026-05-13T06:58:50.550808Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"<stdin>\", line 7, in <module> info = query_ai_assistant( ^^^^^^^^^^^^^^^^^^^^^^^^^^","venue":null,"work_id":"299c4059-2784-4630-bd35-af2c59cd8c6a","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:d6aaa55d10c275fe7c9a0a593bef9528a5069081c497b63019a88d54e8692fa9","observation_id":"ecbf7eec-bf71-4f58-bf2d-b1af11dcaab2","resolution":{"observed_at":"2026-05-13T06:58:50.554586Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"8627ae84-06a9-4dd7-8d64-1c1fffc6c048","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:a805300f7d465b4bf4559855b91d09e3d23e24f5a6eee31389f89c3bda0abfa4","observation_id":"050743f6-89b9-4c7a-90d1-0085a56b62e8","resolution":{"observed_at":"2026-05-13T06:58:50.558106Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"4ec0e502-105c-4a65-9a15-e1419e762483","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:d9e44e09b8a7dd257997fce305514375c866c62cfc2ccadedfcd8dc957635eff","observation_id":"e4c367b1-e5b5-45ef-b979-89b85a6b4844","resolution":{"observed_at":"2026-05-13T06:58:50.561107Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"\"\" + str([{","venue":null,"work_id":"cdb0fe02-13ce-491f-9b03-83943635a82a","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:5ca57f20034804da6885e510b6cd38e3d6012bf209e59557eaf2818c9d04fa90","observation_id":"9ac6e7ea-3f28-4d5c-9f7a-7b87f24e1954","resolution":{"observed_at":"2026-05-13T06:58:50.564485Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"5fadd693-969d-42da-acce-91aad54ef4e8","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:0af4ecd00e2fa0db74291459e88d0a8077d9a1c74e2de21fec399b66c8660e78","observation_id":"20a328b4-db7a-42ae-93ba-bb7290ef6051","resolution":{"observed_at":"2026-05-13T06:58:50.567829Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"1164cfa5-70ab-4390-baea-7f10c53ae78d","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:abc37d7dff8f818b5885ab2aebe787bd657b0289573ff3181ecc96e37c924cee","observation_id":"189f59ad-3ac1-407b-9b18-7855d6793f11","resolution":{"observed_at":"2026-05-13T06:58:50.570576Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"01a6f3e7-48b0-4e38-9f6d-7d64f185285b","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:64c64fa012d4fc2b53bad080b28f252d86a7a27c506a4757c240d2d4a35f9cda","observation_id":"21132e11-938c-4cd1-97b0-b3005ed693ea","resolution":{"observed_at":"2026-05-13T06:58:50.573304Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"<stdin>\", line 1, in <module> info = query_ai_assistant( ^^^^^^^^^^^^^^^^^^^^^^^^^^","venue":null,"work_id":"d8c70573-b21d-48fe-a12d-100559eb540a","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:38f57e8d4296ec282fb0f6c9c6c242ef4d18f3008e27a6a7e0d9105f4ec0c4f3","observation_id":"8c598c99-0654-486a-962c-49085fa21603","resolution":{"observed_at":"2026-05-13T06:58:50.576988Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"ee2d685f-4d0c-4577-8966-45786da080b3","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:9a10dd944fa29f49654ed21e22b73121be88fcee1a81bdea30f2b5dc2934755f","observation_id":"81c1e420-adda-4148-a2c3-97d3dd3f527a","resolution":{"observed_at":"2026-05-13T06:58:50.579663Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"b03da62c-9b7f-4d6a-a8e6-cd0b76821fcf","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:a8f88056a6f5fd0ab02983413eea207949e01db07aa265a931d28df12872883f","observation_id":"8e43694c-eaa4-4002-bfa9-ccaabe95bf1e","resolution":{"observed_at":"2026-05-13T06:58:50.582983Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"\"\" + ^^^^^^^^^^^^^^^^^^^^^^^^ str([{ ^^^^^^^^^^","venue":null,"work_id":"290130a4-0bc4-4224-b1d4-8441902526c8","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:c762815268a8fb24d3d0fdf844c8967e8040c8ccf8e3a6801bd4eae4c2636476","observation_id":"7c24808b-6b60-465d-ae97-003a9d73c0f2","resolution":{"observed_at":"2026-05-13T06:58:50.586549Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"1e70062a-c39f-45d4-8538-c248b611b316","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:82041610095a92283dbdfade6b8de09a1e248c73867951d998ee9d9e32eeed4c","observation_id":"c2df7c0b-a285-4570-8cc1-e955a2589d21","resolution":{"observed_at":"2026-05-13T06:58:50.590151Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"d4f85a29-6c91-439e-bfc2-9dc385f6fc15","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:1e8310b109a2dbe9d77244559594fa15fac81ac13a2f957945221aa95493d54e","observation_id":"c26eb560-e21e-46a0-a98c-e5b77f349c4b","resolution":{"observed_at":"2026-05-13T06:58:50.594209Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"<stdin>\", line 10, in <module> info = query_ai_assistant( ^^^^^^^^^^^^^^^^^^^^^^^^^^","venue":null,"work_id":"b9577769-7e60-4063-bfb5-6f77a3c83924","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:cd7e12a3f81547c3044911dbed81ba0b723f67d9c559dad6e06ff4724eaba7c4","observation_id":"e7b793b3-1364-49ba-86da-f11f3656bfc8","resolution":{"observed_at":"2026-05-13T06:58:50.598060Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"57e85e06-673d-4c06-80fb-a727bb1380c6","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:cff032096d1e9514d87503ddcadeae99a25b480d5b26ebee67ae082443354a96","observation_id":"d3912918-6ca2-4467-9342-04d5ff230daf","resolution":{"observed_at":"2026-05-13T06:58:50.601920Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"8f53de57-b074-4ab0-a31a-92137dca5abd","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:10a6a5092a1edf70139f03f62525c974f44973c50d0ed3ed53bc6b8c8718bf02","observation_id":"e8141add-03bd-496d-a6d8-112bc12aecf1","resolution":{"observed_at":"2026-05-13T06:58:50.605136Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"f9e3ccb7-85ca-4e62-b764-7e6337479a15","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:a45de6e851f8605a0e6b24fe0b4440abece64b63e9ca2ffe6821303160858fa7","observation_id":"04d3377f-3520-4863-b425-6aabfa03fd76","resolution":{"observed_at":"2026-05-13T06:58:50.608678Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"<stdin>\", line 15, in <module> info = query_ai_assistant( ^^^^^^^^^^^^^^^^^^^^^^^^^^","venue":null,"work_id":"cdfd8ba0-cb42-4774-81cd-19f35b99bcfb","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:8a965037b1afc64359bc453a79482341c02bca3550c2d82f7986975d5e72c0f6","observation_id":"6416d9cf-e9c1-4016-828c-400ce23b8d94","resolution":{"observed_at":"2026-05-13T06:58:50.612119Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"68da93e9-c1e4-4e59-9b16-0c02e530142e","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:a4f85c8cf759e8eb4ce0c880d7641f88d62d1a64a7ab533197c52392f2e33c40","observation_id":"359d75eb-a724-4ef3-9134-f7241a5d3097","resolution":{"observed_at":"2026-05-13T06:58:50.614921Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"58327562-adbc-4abd-9c34-9358d61aa109","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:51816dd85593d345a6f780577aab888ba3d9ec2f8ae2c4f063744c327a053b76","observation_id":"b20985a1-7f3b-476d-9d58-372377ddec50","resolution":{"observed_at":"2026-05-13T06:58:50.618375Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"55e26fd2-04e9-473d-b35d-57a350ca3e6a","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:ec87c9dab1062328ffe6985dc2cf99f68f5968ab80f2271806823c019c173656","observation_id":"93fe1d4c-ed14-4853-87e7-9399f2a5f70b","resolution":{"observed_at":"2026-05-13T06:58:50.621341Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"welcome\"","venue":null,"work_id":"9b3c2049-46bb-4a3b-a262-262ad01bebec","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:8c5db536ca4f51e8fb2f54ebf585c5988879a585fb46e4cacaff5064a9511e6d","observation_id":"4d618217-dd4a-4b3f-ae11-0fab12050310","resolution":{"observed_at":"2026-05-13T06:58:50.624134Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"608b5613-1729-46a4-9c94-c87771500ecb","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:e42ea577da61c82f6265d2c88ade252214e4bf1c3c3a2df5c27c5f7b666152fa","observation_id":"b14efa80-c180-4697-9886-6277e6ac4261","resolution":{"observed_at":"2026-05-13T06:58:50.626826Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"d6b5c55f-e347-497b-aa9f-87a67680d7b9","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:97a2ce89914d1ed556c9ceba37aba0de64b2b174a39660b5fdd1b91e3c6db90d","observation_id":"6ddc342a-d6e9-4c0b-9ac7-97f993d109f0","resolution":{"observed_at":"2026-05-13T06:58:50.630147Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"e0e348d7-fe30-46a1-a41e-adfccc675f6d","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:ce49ae68dffcf808c007590a238c1712b9c51bb0c1a7235fd9ae282ed1f3fed0","observation_id":"2a7d0c32-331e-4cf0-b966-62e84feddb59","resolution":{"observed_at":"2026-05-13T06:58:50.633008Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"<stdin>\", line 13, in <module> info = query_ai_assistant( ^^^^^^^^^^^^^^^^^^^^^^^^^^","venue":null,"work_id":"106da3ce-d28c-4f9d-a491-fe142103d60a","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:10efa5a8ceae35a08a7af9f643d920ca5b270d19b3bea7c09a310015a0d78ff5","observation_id":"fd8102ff-db7d-43d2-9460-a996412e70c6","resolution":{"observed_at":"2026-05-13T06:58:50.636918Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"9da0dc17-c3e5-4424-b21a-53cbdcb38a5e","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:74bdae40a6a52bafc6fd97f3c2b1d01686b0d8ee020c43605227f68cf17c9e1e","observation_id":"bf0bcf6f-091b-4a95-92d7-5f8943232587","resolution":{"observed_at":"2026-05-13T06:58:50.639995Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"25e03177-d1af-436b-a442-b77a3fcbe39d","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:d5b20a83704a845d7f035877d6ac9cc98790714dea2663720a1069223dbb1458","observation_id":"0ab50ffd-8062-4afd-9fad-4c46203d9490","resolution":{"observed_at":"2026-05-13T06:58:50.642905Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"e76ab49d-8198-43f6-8690-4b6734d37c66","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:40e67d18de72125d0eda69df3e4c7d64c0da9c703cffee8a9a5c7e9f94677ece","observation_id":"902461a2-1617-4738-bd78-178c65c9f2ba","resolution":{"observed_at":"2026-05-13T06:58:50.646020Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"483dc03d-5d4e-4c84-bcb1-2fc90e02546e","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:e1c2e28f42cd32c85f7eec25fc5392b17fe8e93d694ad28c02fa54e63d018f44","observation_id":"322695f2-70d3-4b55-b0c5-fddedac71b07","resolution":{"observed_at":"2026-05-13T06:58:50.649059Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"<stdin>\", line 9, in <module> info = query_ai_assistant( ^^^^^^^^^^^^^^^^^^^^^^^^^^","venue":null,"work_id":"7c4e3b87-c64b-4123-8492-244e6d5e59e0","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:27474fdc33c67fc55e20c21dabe0203dd5f6754bb7259b08a63e780d03eac709","observation_id":"6b9ce23e-ee00-413c-af16-4df7a8be2259","resolution":{"observed_at":"2026-05-13T06:58:50.653148Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"553db763-6115-452a-ae0a-35e25e77abcf","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:10dabaf271e837915c2d5bf4dd8d3b005f6cdd71bdd78cd029a4d37df0d524db","observation_id":"cd562f0a-2c53-442c-ae63-9683cded1975","resolution":{"observed_at":"2026-05-13T06:58:50.656481Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"47678bda-b3d2-466b-b513-7e4a66354663","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:628a5463109c07a958262b90c0065485bd0c4176f7db37386aa2d26daafc9458","observation_id":"17e2bd0e-2ffc-445e-b955-c81a1e46556e","resolution":{"observed_at":"2026-05-13T06:58:50.659929Z","resolver_source":"raw_fallback","status":"parse_uncertain"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"\"\" + str(formatted_messages) +","venue":null,"work_id":"b38cc084-ec19-4121-aae5-5319da39c1bb","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:595195b6be453b014e2ae711566504ef6237109ae6ea25c736ac54cfbd3c9aca","observation_id":"ec348766-71da-40c2-b928-a25ac5935fab","resolution":{"observed_at":"2026-05-13T06:58:50.664147Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"5d0f8fc3-8c46-4e41-98ec-dd5ee78fa8a0","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:d7a10946d738996bd92f2e4e42f75ecf048883d758e94cad96afef87fe7838b1","observation_id":"035f3a59-d3aa-4104-bd37-611b3bc18fda","resolution":{"observed_at":"2026-05-13T06:58:50.667420Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"d809c491-9734-4fda-a046-9f55730ae867","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:41be0a8acf3051e7a08b5ca2e2dcace42d2c88f3696ce41ac1b8d1516cbfa62b","observation_id":"8b6c1f15-d599-4c4b-af2c-20441ac93507","resolution":{"observed_at":"2026-05-13T06:58:50.671103Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"17b7ce97-6978-4de2-a85c-f93378d72081","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:4d80439989ad2334979ca4e04b7aeee248d61839a85a4c0718e38d78943a7ab2","observation_id":"edf48133-0278-48cf-9f57-56765f078a6b","resolution":{"observed_at":"2026-05-13T06:58:50.674363Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"05c5dc9b-0f89-4570-b700-114af943edd6","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:3ba06e0a7190a3409e69b71d4621f50bfc4610993c091da9578458458b43f348","observation_id":"8707ac3e-0898-4ed6-89c5-fdeda7d3e13d","resolution":{"observed_at":"2026-05-13T06:58:50.678924Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"2024-05-15","venue":null,"work_id":"940c3234-6ccf-4989-8678-f3138fac5e92","year":2024},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:2b8ffa0d15311ac45ec150080d19c9c7b9bfcd2160dd9d11c71fef9d52ffb85c","observation_id":"98e8a683-0ac0-4f65-a17d-3a007595fb0c","resolution":{"observed_at":"2026-05-13T06:58:50.682840Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"7074597c-7337-4361-8665-2cc6e3ea8ff3","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:29816565bee70b8c56dd1647b7d4f32ae321b8894db3bc88f62173e756add67f","observation_id":"29b68c42-61e4-4411-a872-30ba0d3a2993","resolution":{"observed_at":"2026-05-13T06:58:50.685877Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"217459d4-23fe-4e6c-8b26-e142a89296df","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:3c7246c4403f6757494383b7f5a5462c2a8c3fcf5a76a3ad2086eb5b5cf984c9","observation_id":"fe3a470c-2354-4b6c-b752-9d4b53bdeb10","resolution":{"observed_at":"2026-05-13T06:58:50.689944Z","resolver_source":"raw_fallback","status":"parse_uncertain"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"2024-05-15","venue":null,"work_id":"f02f2ecf-967a-4ccc-8850-061dce8eef81","year":2024},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:78d8dfa7f01462677f3c890806928d40913a2b1ec9b29c784dbecaa5cc7c152b","observation_id":"03dbcd75-b945-4ae4-8f87-0cf003cd2262","resolution":{"observed_at":"2026-05-13T06:58:50.695106Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"42cb2200-8abe-460f-8d22-f5cd479d60cf","year":2024},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:42b3b14056b91424e73f64abf7a179496466f705732a26c51f4b1002a64f59e8","observation_id":"725f1c17-fbe5-4356-be66-760abae92637","resolution":{"observed_at":"2026-05-13T06:58:50.698986Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"64c5f598-d1a6-43a3-800e-8e4f86b488f1","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:c801e828536eeac650dffec26180fa6f8a42d01a46f0448dc3ab5a8df59e557c","observation_id":"3dd71021-88d7-41af-9172-106c715ae9fb","resolution":{"observed_at":"2026-05-13T06:58:50.702132Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"f4c0e62e-0e27-43f6-87c7-418cc63997f6","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:0ade41a526a4e348d9dec0c871b7178820ed1b6d5937a318ed5d549a0bef267e","observation_id":"6e68539c-09fe-497f-a9df-f4c06790d559","resolution":{"observed_at":"2026-05-13T06:58:50.705124Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"HH:MM\" representing how many hours and minutes you have until the lunch.↩→ User Running the code gave the following error: Traceback (most recent call last): File","venue":null,"work_id":"829e01fb-8487-4d6c-b288-9ead132df077","year":2024},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:a3f1e7805ab0be90d6e81116a1e85c33df73d68c9390c345c077d46037aac8ac","observation_id":"4bb9cd5a-9227-48fd-8bf2-a6e47e679494","resolution":{"observed_at":"2026-05-13T06:58:50.709830Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"5d90e7ae-d295-4c1f-b6f2-744bd22961a3","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:4c7e83b1701c43e965d0de25f3bc02de134fa9ab94cc10c8c5abd05042152958","observation_id":"4164650c-b405-4f78-988a-c527d466455e","resolution":{"observed_at":"2026-05-13T06:58:50.720873Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"1e0c62b9-3754-467b-a83a-f1c2ea337e7e","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:f136855d0c26d780387b19cc0512142256b9072c73587acb89aa9ba5a8eacd95","observation_id":"56bdfe28-9d2b-49b1-9bfd-984eff340cb1","resolution":{"observed_at":"2026-05-13T06:58:50.724284Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Please analyze this landlord notice and extract the new rent amount, effective date, and IBAN for payments. Here 's the notice:\\n\\n{file_content}","venue":null,"work_id":"3798ecb4-2633-4c0c-bc6c-fde459117000","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:9e20e2d5c78d36d85bac3eb453ca37ccae11131179d2b30c083fd155db7ca81a","observation_id":"37252567-905e-4b0f-989b-2cfc39754548","resolution":{"observed_at":"2026-05-13T06:58:50.727988Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"1779f359-3bdf-4f66-a12c-44f456352d09","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:89514cbea403fbc65dc9600417fcca2630967ba75812c530896a7fe8f4136682","observation_id":"9e75cb59-15c0-4803-8673-941656b7d97b","resolution":{"observed_at":"2026-05-13T06:58:50.731471Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"18a0f0e2-173e-4de1-b142-8e309321706d","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:5117f59d410f447f64b74cfb6d30d29e31db8bfc9e8a7e0696b2771d1e8efc1e","observation_id":"0c41aedf-5e06-442c-a855-fd77197cb701","resolution":{"observed_at":"2026-05-13T06:58:50.735112Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"9a8eaf3e-aff4-4e6a-8451-ee764aca2ee8","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:83a66531eef92dedf5e57cacd0d0e6066589dca03b7df5648a95df72db444b31","observation_id":"651f8ff1-3129-4148-922d-558ba0dd3c65","resolution":{"observed_at":"2026-05-13T06:58:50.738676Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"a87952b4-3b8a-4f5e-854a-6fc5903422f7","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:48f1e9cec09393b0e7d9d534ea05f4a3f0002d5d906094d44bfcfe61d3d91569","observation_id":"4fd5e920-53dc-45c6-8a8a-04dfcd2f2466","resolution":{"observed_at":"2026-05-13T06:58:50.742759Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"<stdin>\", line 11, in <module> try: ^^^^ rent_info = query_ai_assistant( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ f","venue":null,"work_id":"c6dcc4ee-fba5-43e1-a360-8442acd2d88a","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:b620865dcf0e5592151dc0ec58ab6a6ac32df7886ccea09512cd65704a902ca3","observation_id":"992243fc-1977-4c8e-8200-7ef5d44aea2d","resolution":{"observed_at":"2026-05-13T06:58:50.746980Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"ef5356e9-aa80-4c81-8dbf-05e06106afb4","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:802675887d961c08db4f8305f9ab7685259242fc24d81095dde0bf9c4bcb192d","observation_id":"50e49bc7-2097-46bd-9714-792e6557305c","resolution":{"observed_at":"2026-05-13T06:58:50.750147Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"f7d4830d-2fd3-4b30-80b0-d28b1ecde468","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:0ed7c97a7ee6ab67b597fff32d4f3f256a8fe53d65ea9cbf094a81532aef80e0","observation_id":"13650eb7-c602-4689-b639-868d17ce6eea","resolution":{"observed_at":"2026-05-13T06:58:50.754191Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"0f644d59-96d6-4c84-a5cd-d63201bc301d","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:8b76415796ecf7c7ffe39c686e67156ad04429dc36b726ac85accf1adbe4eaf0","observation_id":"fa6aa388-a863-479c-beee-a827b184b28a","resolution":{"observed_at":"2026-05-13T06:58:50.757915Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"<stdin>\", line 2, in <module> rent_info = query_ai_assistant( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ f","venue":null,"work_id":"2fb11465-55b0-4acd-9fc8-2f8d56cd8082","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:5f4cc60df6143aa421a938a76336ca3639083bf546ea1c323267b7e1c2e0d761","observation_id":"72843747-faaf-4056-b556-0438e75258ba","resolution":{"observed_at":"2026-05-13T06:58:50.762804Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"No scheduled rent payment found","venue":null,"work_id":"9c4bf102-7455-49b7-bc1e-a4b67dfc4f52","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:bec706f627481a86eef458f8cddf55e248efda73c12be3dc4525c592b24e49bd","observation_id":"fc19fea0-2431-4c00-9976-35936d503bd2","resolution":{"observed_at":"2026-05-13T06:58:50.766540Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"No scheduled rent payment found","venue":null,"work_id":"55891346-fad5-475c-9b01-dfcb8097adb1","year":2022},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:19e9b8f6365c830ec9804d0c65d891429f8ec40519ec1ab1ae9bc7d8c614495c","observation_id":"1352f3ae-0995-4e41-b38d-8707f93b1895","resolution":{"observed_at":"2026-05-13T06:58:50.771760Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"3b679eae-1a9f-468e-973e-16144708bd11","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:7cd5f33ddcaf04bef65b3cd8978897fcd57362a6fc655b27671a9b163e4c8e4e","observation_id":"cea6f462-3531-4a75-addb-d829156ea873","resolution":{"observed_at":"2026-05-13T06:58:50.775197Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"262d4386-f7fb-414f-a4a2-a0df10eec888","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:dfd0a67146ec43b28dc5b3700f16354e1119778384951123ea0373fd4bb19009","observation_id":"a901ad6c-9c3e-46e1-9f0d-01b597dd9dd1","resolution":{"observed_at":"2026-05-13T06:58:50.778204Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Updated rent payment","venue":null,"work_id":"c8f43ad7-1a8a-4b5b-9761-0c89de32ca89","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:63c91a46838627577bb489922e9e67d165d66ef15328605d82599e3fdb6421a8","observation_id":"e02c1a66-211e-40fa-bbc9-757ee01ce000","resolution":{"observed_at":"2026-05-13T06:58:50.781524Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"da97deb5-09b4-4e14-ab1e-95032137ce75","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:d1fc10e9df0c2b91ce83b410da5d6c6760c9e212044b5de4c7d3ac4d2aa5a057","observation_id":"99962e79-61cb-4b2c-815c-0d3ffb418ba2","resolution":{"observed_at":"2026-05-13T06:58:50.784807Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"e267698c-932e-448f-84fb-05283140367c","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:737202ee12b00bedfd19af0e56138be5c42f4f597c79aec22d548277091952e2","observation_id":"bfdc3a26-28df-4633-8436-9c10cd8da334","resolution":{"observed_at":"2026-05-13T06:58:50.788179Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"<stdin>\", line 12, in <module> rent_info = query_ai_assistant( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ f","venue":null,"work_id":"1831ed74-d688-4e49-8ad4-f71d8d16b854","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:cc85abff605ed4a7cc73638bcf5c2ababe03b36295e887962dd00f10beb65ba2","observation_id":"4dc1cf6a-ebe1-4e45-bd84-a3eb4be2199d","resolution":{"observed_at":"2026-05-13T06:58:50.792682Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"2dc8cbe7-34cc-464f-8223-5d71e7f6b505","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:4b645393ab2e126ae63690130617cd0674fa8ac5b1f4938cf91a7beaa6f37fad","observation_id":"a0135233-ad1b-4d56-b464-d3296de620f6","resolution":{"observed_at":"2026-05-13T06:58:50.795828Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"afb9bab2-a84e-48ee-8a1c-83edb88dc29d","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:1806f6052839eb1238ea1a9f2c6ee250eb8d955a8dc90f3a34f8f5f1c5866d3c","observation_id":"bbb7fea2-12ee-4439-9bf6-aa6139d57a67","resolution":{"observed_at":"2026-05-13T06:58:50.799254Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"File content","venue":null,"work_id":"62e60604-0b31-461e-b7e1-1dfba3a4e24c","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:8ae79d8275be33317455ffab848e4f6fbcf4176f3b503307d4beedbfd6061af9","observation_id":"74551945-8046-42f5-8dae-c812fd1685da","resolution":{"observed_at":"2026-05-13T06:58:50.802878Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"715ccb4e-b1cc-467e-80c4-343ebcdb8c29","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":92,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:5d3dd06f7c266f2b50e497dc33eb8f87c18296756cc51d8b9f65507a531daf77","observation_id":"5d35375b-45ad-4d16-962f-80bcfbd2ab55","resolution":{"observed_at":"2026-05-13T06:58:50.806126Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"fcecd595-e431-40aa-97fc-8d3580eaa5bd","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:c3b4b943bbeebcf91525c934d83c6cd4dbfcd94238f146ebe823d11fd0a729f8","observation_id":"48a7b81c-fd35-4ea7-98ce-54f5187bfbdf","resolution":{"observed_at":"2026-05-13T06:58:50.809589Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"\"\", RentNoticeInfo ) print(f","venue":null,"work_id":"9a4c1e4a-1b99-4867-8a8d-01ae73a405d9","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:156e21c2b42a61f3a27f21ce08dc55f066146c5b2b16768896aac6642e2885ff","observation_id":"f08db649-f36a-4478-9644-391b0394d9eb","resolution":{"observed_at":"2026-05-13T06:58:50.812272Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"output_schema=","venue":null,"work_id":"88dc50cb-288b-4b87-abcd-c2b7fd2909a8","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:df6af3f8a710457bba3d40f08fd9a2df682d17be1243dac7eaef57afbb63c082","observation_id":"c293c8ea-53d5-45a7-a845-649399293a99","resolution":{"observed_at":"2026-05-13T06:58:50.815238Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Hawaii\") if not hawaii_files: raise ValueError(","venue":null,"work_id":"74260794-656c-41bc-89dd-d43c7bc396cc","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":96,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:29e4dd6c8848dd5e2a6d79b37b202922992b54d1138e8bb84c1b474b5043ccb5","observation_id":"4570ee93-6adf-4015-8f08-0498e2b2a50a","resolution":{"observed_at":"2026-05-13T06:58:50.818422Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"d73f3b28-522d-4bac-abdc-cbf4d1138e86","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":97,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:932dbd2a83611576eda4ff593af6ebfc79c2592f2f2c9bf30726058650985f2d","observation_id":"503f0113-20c7-4703-b837-c4d4f7875187","resolution":{"observed_at":"2026-05-13T06:58:50.821702Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"1a4bb888-51fd-4669-839f-2999392c5e24","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":98,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:41a2b40916982d7e444c89039685ba724ebdf0c88ffad56ba6973d67dd20aca3","observation_id":"b91a49be-5478-4379-8cb8-e8d9b0446b3e","resolution":{"observed_at":"2026-05-13T06:58:50.825033Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"435e1725-9600-4ca1-bc17-55c0b957af19","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":99,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:70e7c015f512930f829030cbf11316cfb43c86b3783314e840146d91d8c64422","observation_id":"a28d8497-ee70-47df-91d0-a44b71279e20","resolution":{"observed_at":"2026-05-13T06:58:50.828865Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"058b2deb-f61c-4a93-a4ca-88ebabae5e58","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":100,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:7b27e89a4b7f4ea20f0cd3d621de3284525ed62ce5dc2020758d924eb9bb083d","observation_id":"d47342de-bf8d-4791-bce8-57502a98d2a3","resolution":{"observed_at":"2026-05-13T06:58:50.832479Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Hawaii\") - content","venue":null,"work_id":"83f5931f-9024-40ce-8bd2-2f88a38db7cf","year":2024},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":101,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:27841620dc1f878659c5e32951fd180f1ffa3fd99cfd0704e5b4e43515648c03","observation_id":"ebcca425-bb0b-4023-9ad4-ed36456fc195","resolution":{"observed_at":"2026-05-13T06:58:50.836076Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"187df030-db24-4f92-923c-86f2d7734933","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":102,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:1e0590b575dad49c3f3e7afbfab60a678b52c46f3d201eb39d06f637733c0489","observation_id":"81682d84-4fcc-4ff3-abb9-9bf9366172e4","resolution":{"observed_at":"2026-05-13T06:58:50.840385Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"65f16e80-584d-4e9f-9eb6-3c5e723d7114","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":103,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:ac67ab8e009b0e9628284a74604b868056e87f3da95e4adab0287cf30a3df8f4","observation_id":"71d0e18b-65e5-4b39-bfae-8c30d0e9234a","resolution":{"observed_at":"2026-05-13T06:58:50.844201Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"3cf9118e-1dc1-4aa5-9d48-457119578e57","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":104,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:6d461736979c7d79f934d114e091931013c73bce4b6ab1b6dff0608f026e696f","observation_id":"3e2530f1-a179-4a0b-811b-bb660f3b13a4","resolution":{"observed_at":"2026-05-13T06:58:50.848206Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"50c2c15d-78ce-44c5-85de-b03d174e801e","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":105,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:ed2668faa9eb6f792c380dd14202ff33ecb3f6420770c61bab0199494d70df18","observation_id":"b487464f-7149-4f94-b655-b65590725d40","resolution":{"observed_at":"2026-05-13T06:58:50.851373Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"output_schema=","venue":null,"work_id":"d21351d8-54f6-4dc8-8fdb-a7311ec71f26","year":2022},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":106,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:44f8dc775d50e3791c0f3221f2940c92a3e2651e58a2c1f4c218228254e0fc06","observation_id":"582ddda8-4aa4-4e5f-89e7-bb874a34ce93","resolution":{"observed_at":"2026-05-13T06:58:50.854850Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"f361d7bf-5f15-4d1d-b777-7830c913b419","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":107,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:eabbea62f73d3f8901e62210a6371e7794e1904f2730f41eb8ca849836613675","observation_id":"19ac485e-3818-4720-b006-f8723651a1de","resolution":{"observed_at":"2026-05-13T06:58:50.858491Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"8e24cbed-2dcd-49a3-ae56-1a078b73b4f5","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":108,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:21af9b47f7df98278d22bc7c3337c899813a3a9280fcc311709874f98a21eca0","observation_id":"3e01c425-4b8a-450b-ac9d-9e5abf2f8169","resolution":{"observed_at":"2026-05-13T06:58:50.861594Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"1f0427e3-4a38-4e82-a6be-12377c652529","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":109,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:79ea537b9ebd919fdb864d4cf5eeee7372f2b946e4e6c48f5ec5faa0a97e54d4","observation_id":"b2a11d57-1ad1-4382-a0d4-9023d2498b43","resolution":{"observed_at":"2026-05-13T06:58:50.865098Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"8552fedd-8c55-4408-8a0a-cb6c6c01f0e8","year":null},"citing_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"reference_index":110,"source":"pdf_text","source_observed_at":"2026-05-13T06:58:50.351078Z"},"links":{"citing_paper":"/paper/2503.18813"},"observation_digest":"sha256:a9b580469a2e7b747bf4fb89f10907c9323468d73f7fb9ba8df12d720aa6509d","observation_id":"b1fcc2a6-2815-4807-bff3-2434a96d1631","resolution":{"observed_at":"2026-05-13T06:58:50.868721Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-31T05:16:05.607957Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design"},"reference_resolution":{"displayed":100,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":2,"unresolved":69,"verified_exact":0,"verified_fuzzy":28},"total_outbound_references":229},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"thesis":"As of 5 August 2026, this Paper Citation Record lists 100 of 229 outbound references and 100 inbound Pith citation observations for arXiv:2503.18813."}