Pith. sign in

REVIEW 4 major objections 6 minor 44 references

Web Intellectual Property at Risk: Preventing Unauthorized Real-Time Retrieval by Large Language Models

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A defense that embeds iteratively optimized policy cues in HTML can prevent retrieval-enabled language models from disclosing web content, raising defense success from 2.5% to 88.6% across tested models.

desk verdict A clever defensive reframing of prompt injection with real engineering value, but the headline DSR overclaims because it is measured on fictitious unique-content pages and does not show prevention of disclosure on real indexed content. read the letter →

arxiv 2505.12655 v2 pith:CWGW3EMM submitted 2025-05-19 cs.CR cs.AI

Yisheng Zhong , Yizhu Wen , Junfeng Guo , Mehran Kafai , Heng Huang , Hanqing Guo , Zhuangdi Zhu This is my paper · ORCID
classification cs.CRcs.AI
keywords real-timeLLMretrievalwebintellectualpropertyprotectionadversarialHTMLpolicyblack-boxmin-maxoptimizationdefensesuccessraterobots.txtalternativesretrieval-augmentedgenerationprompt-injection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that content creators can stop retrieval-enabled large language models from summarizing or copying their webpages by embedding specially optimized policy text directly in the page's HTML. The policy text is invisible to human readers but is read by the LLM when it fetches the page, and it instructs the model to refuse, to reveal only a permitted subset, or to redirect the user to the owner's chosen URL. The authors frame the task as a min-max game between an adversarial user and the defender, and solve it by iteratively querying the target LLM and refining the embedded policy with a proxy language model. Across tested models this raises the defense success rate from roughly 2.5% to 88.6%, and it survives follow-up attempts to bypass the policy better than a manually written notice or robots.txt. If true, this gives individual publishers a proactive, provider-independent way to protect web content from AI extraction.

What carries the argument

The central object is a hidden HTML policy string z, produced by the iteration loop, that is appended to the page source w to give w⊕z while preserving the visible rendering, that is, φ(w)=φ(w⊕z). It works because LLMs read raw HTML and weigh early tokens more heavily; policies are placed at the top of the file and phrased as direct instructions with strict, repeated constraints. The optimization machinery is the min-max objective in Eq. (2): an inner maximization finds an adversarial user query q that would extract content, and an outer minimization finds a policy z that defeats that query, solved in practice by black-box feedback between the attacker LLM and the proxy policy generator.

What would settle it

Run the same optimized policies on a sample of real, indexed web pages under fresh, human-written queries that were not used during optimization, and measure how often the LLM discloses substantive content anyway. If the defense success rate drops to the level of a plain privacy notice or robots.txt on those pages, the reported 2.5%-to-88.6% improvement is an artifact of the synthetic pages and query templates rather than a general property of the embedded HTML policy.

Watch

Extended reading notes

Core claim

The central claim is that the gap between the HTML source of a page and its rendered appearance—many different HTML documents can render identically—can be used as a channel for a semantic defense. The defender appends a hidden policy z to raw HTML so that the rendered page is unchanged, while retrieval-enabled LLMs, which consume the raw HTML, are steered by the policy. The paper's disclosed mechanism is iterative: simulate the worst-case user query, ask the retrieval LLM, evaluate the response against the defense objective, and feed the failure back to a proxy LLM that generates a stronger policy. Two strategic patterns emerge from this process: instruction-guided response templates (the policy tells the LLM exactly what it may and may not say) and proactive bypass prevention (repeated strict constraints that anticipate attempts to ignore the policy). The paper reports that this turns near-zero baseline compliance into 70 to 100 percent defense success on refusal, masking, and redirection goals, and that the iterated policy beats robots.txt on both regular and reasoning models.

Load-bearing premise

The load-bearing premise is that the way retrieval-enabled LLMs followed embedded policies on ten fictitious pages, when asked a handful of fixed query templates, is representative of how they will behave on real indexed sites with the full variety of human questions.

Editorial extensions

If this is right

  • Websites can publish content normally and still block LLM redistribution: search engines and human readers see an unaltered page.
  • Publishers get three dials of control: full refusal, release only an allowed summary, or steer users to a specified URL.
  • The defense does not depend on AI companies choosing to honor robots.txt, so it remains effective even against providers that ignore crawler directives.
  • With the bypass-prevention iteration, the defense keeps most tested models from disclosing content even when users explicitly tell the LLM to ignore site policies.
  • Because the raw HTML is modified rather than the visible page, the method can be layered on top of existing legal or configuration-based measures.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the defense steers the LLM through instruction-following rather than any API-specific hook, the same policy text could plausibly influence AI agents and voice assistants that fetch the page, not just chat LLMs.
  • The method is dual-use: the same min-max loop that produces protective policies could produce deceptive web content that silently misleads future retrieval models, so publishers and platform designers may need ways to authenticate page-owner policies.
  • A publisher could automate the loop, regenerating the policy whenever content changes, since the policy generator is an offline LLM and the only requirement is HTML controlled by the publisher.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a defense against real-time retrieval by LLMs: the defender embeds LLM-generated policy text inside a webpage's HTML so that a retrieval-augmented LLM declines to disclose the page's content. The authors formulate the defense as a min-max optimization (Eq. 2), approximate the inner maximization with adversarial user queries, and approximate the outer minimization by iteratively refining HTML policy cues with a proxy LLM. They evaluate three defense goals (refusal to answer, partial masking, redirection) on ten fictitious websites and two real homepages against GPT-4o, GPT-4o mini, Gemini, and ERNIE 4.5 Turbo, reporting defense success rates rising from near 0% to 70–100% for single queries and improved follow-up robustness for their Iteration-3 policy. They also compare against robots.txt and study the effects of policy position and visibility.

Significance. The problem is timely and the proposed direction—using the semantic understanding of the LLM itself as a provider-independent protection mechanism—is a useful complement to robots.txt and post-hoc enforcement. The paper makes a concrete practical contribution in showing that carefully worded HTML policy prompts can steer current retrieval LLMs, and the three-goal formulation (refusal, masking, redirection) plus the sensitivity analysis on policy position and visibility are valuable. The authors also commit to releasing datasets and scripts. However, the evidence as presented does not establish the paper's central claim that the defense prevents unauthorized real-time retrieval of real, indexed web content: the experiments measure instruction-following on mostly fictitious pages whose content is unique to the protected page, and the evaluation protocol is underspecified.

major comments (4)
  1. [Sec. 5.1–5.2] The DSR metric conflates instruction-following with actual prevention of information disclosure. On the ten fictitious websites, the content appears nowhere else on the web and is absent from pretraining data, so a refusal to quote the page is equivalent to withholding the information. On real, indexed content, the same facts are typically available from multiple pages and from the model's parametric memory; a hidden policy on one page cannot prevent the LLM from answering from other retrieved documents or internal knowledge. The paper should evaluate on real content with redundant coverage and measure information leakage (e.g., whether the answer contains facts present only on the protected page) rather than only whether the prescribed refusal string or template was followed.
  2. [Sec. 3.2–3.3] The min-max problem in Eq. (2) is not actually solved. The practical method is a heuristic loop: generate adversarial queries, collect attacker responses, and ask a proxy LLM to refine the injected HTML policy. There is no convergence guarantee, no coverage guarantee over the space of user queries, and no justification that the proxy LLM's iterative feedback approximates the outer minimization of Eq. (2). Because the queries used during optimization are the same fixed templates used in evaluation, the reported success may reflect overfitting to those templates. The paper should either provide a principled analysis of the optimization or explicitly reframe the contribution as a heuristic prompt-optimization method, and it should test robustness on unseen query phrasings and adversarial paraphrases.
  3. [Sec. 5.1, Table 1, Abstract] The headline improvement "2.5% to 88.6%" cannot be traced to the reported tables. Averaging the Baseline cells in Table 1 does not yield 2.5%, and the 88.6% value is not labeled as a specific condition or model. Moreover, Gemini is evaluated only on two real homepages, with all fictitious-site and Heroku cells omitted, yet the abstract claims the method works "on different LLMs." The DSR evaluation protocol is also unspecified: no details are given on whether DSR was scored automatically or manually, whether scoring was blinded, how partial credit was handled, or whether multiple trials were run. The paper should report per-condition tables with confidence intervals or significance tests and a complete, reproducible evaluation protocol for DSR and FDSR.
  4. [Table 4 / Figure 4] The generalization claim is weakened by unreported failures in the appendix. In Table 4, ERNIE 4.5 Turbo under the Iteration-3 policy achieves 0% FDSR for both Partial Protect and Redirection on GitHub, yet the appendix text states that Iteration 3 "led to near-perfect FDSRs in almost all settings." This inconsistency should be explained, and the claim of consistent robustness across models and goals should be tempered accordingly.
minor comments (6)
  1. [Table 3] The model labels "GPT-4∗" and "GPT-o∗" in Table 3 are undefined; the exact model versions tested should be specified in the caption or text.
  2. [Figure 4] The y-axis in Figure 4 extends to 150%, which is misleading for percentage bars that cannot exceed 100%; the axis should be capped at 100%.
  3. [Sec. 5.3] The statement that "Gemini and ERNIE show limitations in following more fine-grained instructions" is only partially supported because Table 2 contains '-' entries for Gemini on Partial Masking and Redirection; the text should discuss only the cells that were actually measured.
  4. [Appendix A.2] The appendix shows visible and invisible HTML prompt examples, but it never specifies exactly which prompts were used in which table, and it does not clarify whether invisible prompts (display:none) are still present in the raw HTML fetched by the LLM or whether they affect search-engine indexing; this should be stated explicitly.
  5. [Sec. 1, Sec. 5.3, References] There are several presentation issues: "reinforcedinequality" in Sec. 1, inconsistent hyphenation such as "Heroku-hosted webpages," and reference formatting inconsistencies (e.g., incomplete author lists and missing access dates). These should be cleaned up.
  6. [Table 4] The table note says Gemini is omitted because it does not provide sufficient evidence under synthetic settings, but the caption could state this more prominently so that readers do not infer Gemini was tested in all multi-round conditions.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the defense policy is the optimization output, and DSR measures the stated defense goal rather than a renamed fitted input.

full rationale

I walked the derivation chain from Eq. (1) through Eq. (2) to the evaluation in Sec. 5. The defender minimizes the similarity between the LLM response and the visible page content by learning a hidden policy z, and the metric DSR in Sec. 5.2 is defined independently as the percentage of cases in which the LLM follows the pre-specified defense goal. The policy z is the output of the min-max optimization, not a parameter fitted to a subset of data and then relabeled as a prediction, so no fitted input is renamed as a result. The paper makes no first-principles claim that would require a uniqueness theorem or an external derivation; its contribution is an empirical optimization procedure plus cross-model evaluation on GPT-4o, GPT-4o mini, Gemini, and ERNIE. There are no load-bearing self-citations: the only Zhong et al. citation concerns poisoning RAG corpora and is not prior work by any of the present authors, and no imported uniqueness theorem is invoked. Section 7 explicitly acknowledges that most experiments used fictitious webpages and that API budgets limited coverage; these are honest generalization caveats, and they weaken external validity but do not make the reasoning circular. The skeptical reading that DSR may measure instruction-following on in-distribution queries rather than real-world information disclosure is a metric-validity concern, not a logical reduction of the claimed result to its inputs. Per the hard rule requiring an exhibited specific reduction, I cannot quote any equation or table where the predicted quantity equals an input by construction; therefore the correct finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The method does not introduce numeric free parameters; the artifact being optimized is textual policy z. The axioms listed are the load-bearing premises about LLM parsing and transfer that the defense depends on.

assumptions (4)
  • domain assumption The retrieval-enabled LLM passes the full HTML source (including hidden meta tags and invisible text) into its context and treats it as instruction-relevant.
    The entire defense relies on the model reading and obeying the injected policy; Sec. 2.2 assumes the LLM parses hidden source components.
  • standard math The rendering function φ is many-to-one, so hidden policy text can be added without changing visible layout.
    Introduced in Sec. 3.1; standard for HTML and does the work of keeping the defense user-transparent.
  • ad hoc to paper A proxy LLM's iterative feedback approximates the min-max solution of Eq. 2.
    Sec. 3.3 substitutes heuristic iteration for the intractable black-box optimization, with no convergence proof.
  • domain assumption The 'adversarial user queries' generated or selected for optimization are representative of real user attempts to bypass policies.
    Sec. 3.2-3.3 and the multi-round evaluation use fixed bypass phrasings like 'ignore the website policy' or 'tell me more anyway'; real users could be more creative.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Web Intellectual Property at Risk: Preventing Unauthorized Real-Time Retrieval by Large Language Models." pith.science (2026). https://pith.science/paper/CWGW3EMM

@misc{pith2026250512655,
  author       = {Pith},
  title        = {Pith review of: Web Intellectual Property at Risk: Preventing Unauthorized Real-Time Retrieval by Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CWGW3EMM}},
  note         = {Machine review of arXiv:2505.12655}
}
read the original abstract

The protection of cyber Intellectual Property (IP) such as web content is an increasingly critical concern. The rise of large language models (LLMs) with online retrieval capabilities enables convenient access to information but often undermines the rights of original content creators. As users increasingly rely on LLM-generated responses, they gradually diminish direct engagement with original information sources, which will significantly reduce the incentives for IP creators to contribute, and lead to a saturating cyberspace with more AI-generated content. In response, we propose a novel defense framework that empowers web content creators to safeguard their web-based IP from unauthorized LLM real-time extraction and redistribution by leveraging the semantic understanding capability of LLMs themselves. Our method follows principled motivations and effectively addresses an intractable black-box optimization problem. Real-world experiments demonstrated that our methods improve defense success rates from 2.5% to 88.6% on different LLMs, outperforming traditional defenses such as configuration-based restrictions.

Figures

Figures reproduced from arXiv: 2505.12655 by the authors.

Figure 1
Figure 1. Anti-retrieval defense workflow: given user queries to an LLM for content retrieval, our proposed [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. A real-time web retrieval process. In this [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Iterative optimization of anti-retrieval web [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Comparing iteration-2 and iteration-3 defense [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Impacts of policy position on defense success. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Effect of policy visibility (visible as transpar￾ent webpage content vs. invisible as HTML meta tag) on DSRs across different LLMs. Defense Visibility: While most of our experi￾ments were conducted using defense policies em￾bedded in HTML meta tags, we also investigate…
Figure 8
Figure 8. Figure 8: Gemini’s Retrieval Behavior on Real vs. Fic [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 7
Figure 7. Figure 7: Impact of query tone on Gemini’s behavior. [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 10
Figure 10. Figure 10: Instruction-guided refusal prompt (Iteration 2) embedded visibly. Guides the model to decline dis￾closure, without enforcing strict policy boundaries. Embedding Prompt z (Partial Mask & In￾visible & Iteration 2) 1 <div style="display: none; position: absolute; visibil…
Figure 11
Figure 11. Figure 11: Partially disclosive HTML prompt embedded [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]
Figure 13
Figure 13. Figure 13: A robots.txt file disallowing AI-specific crawlers. Used to test whether retrieval models respect external crawler restrictions. A.3 Synthetic Website Details [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]
Figure 12
Figure 12. Figure 12: Strictly enforced redirection prompt (Iteration 3) with layered semantic constraints to pre￾vent policy bypass and redirect users to an external site. robots.txt 1 User-agent: OAI-SearchBot 2 Disallow: / 3 4 User-agent: ChatGPT-User 5 Disallow: / 6 7 User-agent: GPTBo…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 13 canonical work pages

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, and 1 others. 2020. Language models are few-shot learners. Advances in neural information processing systems, 33:1877--1901

    2020

  4. [4]

    Google Search Central. 2024. Crawling and indexing. https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag. Accessed: 2025-05-04

    work page 2024

  5. [5]

    Jiawei Chen, Hongyu Lin, Xianpei Han, and Le Sun. 2024. https://doi.org/10.1609/aaai.v38i16.29728 Benchmarking large language models in retrieval-augmented generation . In Proceedings of the Thirty-Eighth AAAI Conference on Artificial Intelligence and Thirty-Sixth Conference on Innovative Applications of Artificial Intelligence and Fourteenth Symposium on...

    doi:10.1609/aaai.v38i16.29728 2024

  6. [6]

    OpenAI Community. 2024 a . https://community.openai.com/t/redefining-the-role-of-robots-txt-in-the-age-of-ai-agents/584800 Redefining the role of robots.txt in the age of ai agents . Accessed: 2024-04-21

    work page 2024

  7. [7]

    Reddit Selfhosted Community. 2024 b . https://www.reddit.com/r/selfhosted/comments/1i154h7/openai_not_respecting_robotstxt_and_being_sneaky/ Openai not respecting robots.txt and being sneaky . Accessed: 2024-04-21

    work page 2024

  8. [8]

    Shahul Es, Jithin James, Luis Espinosa-Anke, and Steven Schockaert. 2025. https://arxiv.org/abs/2309.15217 Ragas: Automated evaluation of retrieval augmented generation . Preprint, arXiv:2309.15217

    arXiv 2025

Show all 44 references
  1. [9]

    Github: Where the world builds software

    GitHub . Github: Where the world builds software. https://github.com

  2. [10]

    Kai Greshake, Safa Abdelnabi, Sandeep Mishra, Christina Endres, Thorsten Holz, and Mario Fritz. 2023. Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. arXiv preprint arXiv:2302.12173

    2023 arXiv

  3. [11]

    Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasupat, and Mingwei Chang. 2020. Retrieval augmented language model pre-training. In International conference on machine learning, pages 3929--3938. PMLR

    2020

  4. [12]

    Heroku: Cloud application platform

    Heroku . Heroku: Cloud application platform. https://www.heroku.com

  5. [13]

    Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, and 1 others. 2024. Gpt-4o system card. arXiv preprint arXiv:2410.21276

    2024 arXiv

  6. [14]

    Martijn Koster. 1996. A standard for robot exclusion. https://www.robotstxt.org/orig.html. Accessed: 2025-05-04

    1996

  7. [15]

    Pratik Kulkarni and Assaf Namer. 2024. Temporal context awareness: A defense framework against multi-turn manipulation attacks on large language models. arXiv preprint arXiv:2503.15560

    2024 arXiv

  8. [16]

    u ttler, Mike Lewis, Wen-tau Yih, Tim Rockt \

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich K \"u ttler, Mike Lewis, Wen-tau Yih, Tim Rockt \"a schel, and 1 others. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in neural informati...

    2020

  9. [17]

    Zeyi Liao, Lingbo Mo, Chejian Xu, Mintong Kang, Jiawei Zhang, Chaowei Xiao, Yuan Tian, Bo Li, and Huan Sun. 2025. https://arxiv.org/abs/2409.11295 Eia: Environmental injection attack on generalist web agents for privacy leakage . Preprint, arXiv:2409.11295

    2025 arXiv

  10. [18]

    Voelker, Ben Y

    Enze Liu, Elisa Luo, Shawn Shan, Geoffrey M. Voelker, Ben Y. Zhao, and Stefan Savage. 2024. https://arxiv.org/abs/2411.15091 Somesite i used to crawl: Awareness, agency and efficacy in protecting content creators from ai crawlers . Preprint, arXiv:2411.15091

    2024 arXiv

  11. [19]

    Xiao Liu, Hanyu Lai, Hao Yu, Yifan Xu, Aohan Zeng, Zhengxiao Du, Peng Zhang, Yuxiao Dong, and Jie Tang. 2023 a . https://arxiv.org/abs/2306.07906 Webglm: Towards an efficient web-enhanced question answering system with human preferences . Preprint, arXiv:2306.07906

    2023 arXiv

  12. [20]

    Yuxuan Liu, Guozhu Deng, Yiyang Li, Kun Wang, Zheng Wang, Haoyu Wang, and Yang Liu. 2023 b . Prompt injection attack against llm-integrated applications. arXiv preprint arXiv:2306.05499

    2023 arXiv

  13. [21]

    Jacob Menick, Maja Trebacz, Vladimir Mikulik, John Aslanides, Francis Song, Martin Chadwick, Mia Glaese, Susannah Young, Lucy Campbell-Gillingham, Geoffrey Irving, and Nat McAleese. 2022. https://arxiv.org/abs/2203.11147 Teaching language models to support answers with verifie...

    2022 arXiv

  14. [22]

    San Murugesan. 2025. https://doi.org/10.1109/MIS.2025.3544940 The rise of agentic ai: Implications, concerns, and the path forward . IEEE Intelligent Systems, 40(2):8--14

    2025

  15. [23]

    Reiichiro Nakano, Jacob Hilton, Suchir Balaji, Jeff Wu, Long Ouyang, Christina Kim, Christopher Hesse, Shantanu Jain, Vineet Kosaraju, William Saunders, Xu Jiang, Karl Cobbe, Tyna Eloundou, Gretchen Krueger, Kevin Button, Matthew Knight, Benjamin Chess, and John Schulman. 2022...

    2022 arXiv

  16. [24]

    OpenAI. 2024. https://platform.openai.com/docs/bots Gptbot user agent information . Accessed: 2024-04-21

    2024

  17. [25]

    July 18, 2024

    OpenAI. July 18, 2024. https://openai.com/index/gpt-4o-mini -advancing-cost-efficient-intelligence/ Gpt-4o mini technical report

    2024

  18. [26]

    May 13, 2024

    OpenAI. May 13, 2024. Gpt-4o technical report. https://openai.com/index/hello-gpt-4o/

    2024

  19. [27]

    Rodrigo Pedro, Daniel Castro, Paulo Carreira, and Nuno Santos. 2025. https://arxiv.org/abs/2308.01990 From prompt injections to sql injection attacks: How protected is your llm-integrated web application? Preprint, arXiv:2308.01990

    2025 arXiv

  20. [28]

    Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. 2023. Reflexion: Language agents with verbal reinforcement learning. Advances in Neural Information Processing Systems, 36:8634--8652

    2023

  21. [29]

    Kurt Shuster, Mojtaba Komeili, Leonard Adolphs, Stephen Roller, Arthur Szlam, and Jason Weston. 2022. https://arxiv.org/abs/2203.13224 Language models that seek for knowledge: Modular search & generation for dialogue and prompt completion . Preprint, arXiv:2203.13224

    2022 arXiv

  22. [30]

    Reuters Staff. 2023. https://www.reuters.com/legal/transactional/ny-times-sues-openai-microsoft-infringing-copyrighted-work-2023-12-27/ Ny times sues openai, microsoft for infringing copyrighted works . Accessed: 2025-05-06

    2023

  23. [31]

    Yu Sun, Shuohuan Wang, Shikun Feng, Siyu Ding, Chao Pang, Junyuan Shang, Jiaxiang Liu, Xuyi Chen, Yanbin Zhao, Yuxiang Lu, and 1 others. 2021. Ernie 3.0: Large-scale knowledge enhanced pre-training for language understanding and generation. arXiv preprint arXiv:2107.02137

    2021 arXiv

  24. [32]

    Yu Sun, Shuohuan Wang, Yukun Li, Shikun Feng, Xuyi Chen, Han Zhang, Xin Tian, Danxiang Zhu, Hao Tian, and Hua Wu. 2019. https://arxiv.org/abs/1904.09223 Ernie: Enhanced representation through knowledge integration . Preprint, arXiv:1904.09223

    2019 arXiv

  25. [34]

    Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, and 1 others. 2023. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805

    2023 arXiv

  26. [35]

    Urban, Joe Karaganis, and Brianna Schofield

    Jennifer M. Urban, Joe Karaganis, and Brianna Schofield. 2017. Notice and takedown in everyday practice. Technical report, UC Berkeley Public Law Research Paper No. 2755628. Available at SSRN: https://ssrn.com/abstract=2755628 or http://dx.doi.org/10.2139/ssrn.2755628

    2017 doi

  27. [36]

    Ziqi Wang, Hanlin Zhang, Xiner Li, Kuan-Hao Huang, Chi Han, Shuiwang Ji, Sham M Kakade, Hao Peng, and Heng Ji. 2025. Eliminating position bias of language models: A mechanistic approach. ICLR

    2025

  28. [37]

    Junyan Wei, Xiaoyu Wang, and Yiyang Li. 2024. Dialogue injection attack: Jailbreaking llms through context manipulation. arXiv preprint arXiv:2503.08195

    2024 arXiv

  29. [38]

    Yikai Xue, Yiyang Li, Haoyu Wang, and Yang Liu. 2024. Phantom: General trigger attacks on retrieval augmented generation. arXiv preprint arXiv:2405.20485

    2024

  30. [39]

    Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. 2023. https://arxiv.org/abs/2210.03629 React: Synergizing reasoning and acting in language models . Preprint, arXiv:2210.03629

    2023 arXiv

  31. [40]

    Jiaxin Yi, Yuhang Xie, Bowen Zhu, Emre Kiciman, Guolei Sun, Xing Xie, and Fei Wu. 2023. Benchmarking and defending against indirect prompt injection attacks on large language models. arXiv preprint arXiv:2312.14197

    2023 arXiv

  32. [41]

    Chien yi Chang and Xin He. 2025. https://arxiv.org/abs/2503.06035 The liabilities of robots.txt . Preprint, arXiv:2503.06035

    2025

  33. [42]

    Baolin Zhang, Yiyang Chen, Meng Fang, Zhiyuan Liu, Liqiang Nie, Tao Li, and Zaiqing Liu. 2024. Practical poisoning attacks against retrieval-augmented generation. arXiv preprint arXiv:2504.03957

    2024

  34. [43]

    Zexuan Zhong, Ziqing Huang, Alexander Wettig, and Danqi Chen. 2023. https://arxiv.org/abs/2310.19156 Poisoning retrieval corpora by injecting adversarial passages . Preprint, arXiv:2310.19156

    2023 arXiv

  35. [44]

    Andy Zou, Andy Ju, Tom Goldstein, and Kevin Eykholt. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

  36. [45]

    Yuntao Zou, Yiyang Li, Haoyu Wang, and Yang Liu. 2024. Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation. arXiv preprint arXiv:2402.07867

    2024 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.