pith. machine review for the scientific record. sign in

arxiv: 2604.05793 · v1 · submitted 2026-04-07 · 💻 cs.CR · cs.CV

Recognition: no theorem link

BodhiPromptShield: Pre-Inference Prompt Mediation for Suppressing Privacy Propagation in LLM/VLM Agents

Bo Ma , Jinsong Wu , Weiqi Yan
Authors on Pith no claims yet

Pith reviewed 2026-05-10 20:03 UTC · model grok-4.3

classification 💻 cs.CR cs.CV
keywords privacy propagationLLM agentsprompt mediationsensitive spansde-identificationVLM agentstool callsmemory security
0
0 comments X

The pith

BodhiPromptShield detects sensitive spans in prompts and routes them through placeholders or abstractions to block cross-stage leaks in LLM and VLM agents.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper sets out to show that privacy risks in agent systems arise because raw user content travels into retrieval queries, memory writes, and tool calls even after initial checks. It introduces a pre-inference mediation layer that identifies sensitive parts and replaces them with typed placeholders, semantic abstractions, or symbolic mappings until restoration is allowed at specific points. If this holds, agents could handle private details without those details spreading through every internal step. The approach adds explicit control over when and where sensitive content is restored, unlike standard document redaction that stops at input boundaries. Controlled tests on their benchmark report lower propagation rates across stages while preserving task performance.

Core claim

BodhiPromptShield is a policy-aware framework that detects sensitive spans, routes them via typed placeholders, semantic abstraction, or secure symbolic mapping, and delays restoration to authorized boundaries. This supplies explicit propagation-aware mediation and treats restoration timing as a controllable security variable. On the Controlled Prompt-Privacy Benchmark, stage-wise propagation falls from 10.7 percent to 7.1 percent across retrieval, memory, and tool stages, with a privacy error rate of 9.3 percent, accuracy of 0.94, and task success rate of 0.92, exceeding generic de-identification.

What carries the argument

The BodhiPromptShield mediation layer, which identifies sensitive spans at prompt entry and substitutes them with placeholders, abstractions, or mappings before any downstream stage processes the content.

If this is right

  • Sensitive user content stays out of retrieval queries and memory stores until explicitly restored at allowed points.
  • Tool calls receive only non-sensitive versions of the prompt, reducing the chance of external services receiving private data.
  • Task success remains high because the mediation preserves semantic meaning through abstraction and mapping rather than simple removal.
  • Restoration timing becomes an explicit design choice that can be tuned to match different security policies.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same placeholder and abstraction technique could be applied to multi-turn conversations where privacy context must persist across several exchanges.
  • Symbolic mapping might allow later integration with encrypted storage so that even the agent itself never sees raw sensitive values during intermediate steps.
  • If the method scales to longer contexts, it could reduce the volume of data that must be audited after agent runs are complete.

Load-bearing premise

That measured drops in propagation on the Controlled Prompt-Privacy Benchmark are caused by the mediation steps rather than by benchmark design or other unstated factors.

What would settle it

Running the same prompts through an agent system without the mediation layer but with identical downstream components and finding no difference in measured privacy propagation would indicate the reductions are not due to the proposed mechanisms.

Figures

Figures reproduced from arXiv: 2604.05793 by Bo Ma, Jinsong Wu, Weiqi Yan.

Figure 1
Figure 1. Figure 1: Architectural overview of prompt privacy mediation for LLM/VLM-based agents. The diagram is a systems-design summary rather than an empirical [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Stage-wise propagation profiles derived from Table V. The proposed [PITH_FULL_IMAGE:figures/full_fig_p013_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Pareto-style visual summary of privacy–utility operating regimes in [PITH_FULL_IMAGE:figures/full_fig_p015_3.png] view at source ↗
Figure 1
Figure 1. Figure 1: Repository-backed CPPB benchmark composition overview derived from the bundled manifest and accounting records. [PITH_FULL_IMAGE:figures/full_fig_p022_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Repository-backed supporting view of two mechanism-specific trade [PITH_FULL_IMAGE:figures/full_fig_p023_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Supplementary deployment-oriented summary derived from the main [PITH_FULL_IMAGE:figures/full_fig_p030_3.png] view at source ↗
read the original abstract

In LLM/VLM agents, prompt privacy risk propagates beyond a single model call because raw user content can flow into retrieval queries, memory writes, tool calls, and logs. Existing de-identification pipelines address document boundaries but not this cross-stage propagation. We propose BodhiPromptShield, a policy-aware framework that detects sensitive spans, routes them via typed placeholders, semantic abstraction, or secure symbolic mapping, and delays restoration to authorized boundaries. Relative to enterprise redaction, this adds explicit propagation-aware mediation and restoration timing as a security variable. Under controlled evaluation on the Controlled Prompt-Privacy Benchmark (CPPB), stage-wise propagation suppresses from 10.7\% to 7.1\% across retrieval, memory, and tool stages; PER reaches 9.3\% with 0.94 AC and 0.92 TSR, outperforming generic de-identification. These are controlled systems results on CPPB rather than formal privacy guarantees or public-benchmark transfer claims. The project repository is available at https://github.com/mabo1215/BodhiPromptShield.git.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

1 major / 2 minor

Summary. The manuscript proposes BodhiPromptShield, a policy-aware pre-inference mediation framework for LLM/VLM agents that detects sensitive spans in prompts and routes them using typed placeholders, semantic abstraction, or secure symbolic mapping, with restoration delayed to authorized boundaries. This aims to suppress privacy propagation across retrieval, memory, and tool stages. Under controlled evaluation on the authors' Controlled Prompt-Privacy Benchmark (CPPB), it reports suppressing stage-wise propagation from 10.7% to 7.1%, with Privacy Exposure Rate (PER) reaching 9.3% alongside Accuracy (AC) of 0.94 and Task Success Rate (TSR) of 0.92, outperforming generic de-identification approaches. The results are explicitly framed as controlled systems experiments on CPPB rather than formal privacy guarantees or claims of transfer to public benchmarks.

Significance. If the observed reductions hold under independent validation, the work addresses an important gap in handling cross-stage privacy risks in agentic LLM systems, where raw user data can leak through multiple components. The framework's explicit handling of propagation-aware mediation and restoration timing adds a security dimension beyond standard redaction. The availability of a project repository supports potential reproducibility. However, the custom nature of the benchmark and lack of broader validation temper the current significance.

major comments (1)
  1. [Evaluation] The central empirical claim rests on results from the newly introduced Controlled Prompt-Privacy Benchmark (CPPB). The reported suppression of stage-wise propagation from 10.7% to 7.1% and PER of 9.3% (with AC 0.94, TSR 0.92) could be influenced by how the benchmark scenarios were constructed around sensitive-span injection and cross-stage flows (retrieval/memory/tool), which align closely with the mediation routes in BodhiPromptShield. The abstract itself qualifies these as 'controlled systems results on CPPB' without public-benchmark transfer, so attribution of gains to the framework rather than benchmark design requires explicit independent validation experiments.
minor comments (2)
  1. [Evaluation] The numeric results lack error bars, confidence intervals, or details on the number of runs, which would help assess robustness of the 3.6-point drop and metric values.
  2. [Abstract] The abstract and introduction could more explicitly contrast the proposed restoration timing mechanism with existing enterprise redaction pipelines to highlight the incremental contribution.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for the constructive review and the opportunity to address concerns about our evaluation. We respond point-by-point to the major comment below.

read point-by-point responses

  1. Referee: [Evaluation] The central empirical claim rests on results from the newly introduced Controlled Prompt-Privacy Benchmark (CPPB). The reported suppression of stage-wise propagation from 10.7% to 7.1% and PER of 9.3% (with AC 0.94, TSR 0.92) could be influenced by how the benchmark scenarios were constructed around sensitive-span injection and cross-stage flows (retrieval/memory/tool), which align closely with the mediation routes in BodhiPromptShield. The abstract itself qualifies these as 'controlled systems results on CPPB' without public-benchmark transfer, so attribution of gains to the framework rather than benchmark design requires explicit independent validation experiments.

    Authors: We appreciate the referee's careful analysis of the evaluation design. The CPPB was constructed specifically to enable controlled measurement of privacy propagation by injecting labeled sensitive spans and tracing their flow through retrieval, memory, and tool stages—elements absent from standard public benchmarks. This controlled construction is what permits precise attribution of effects to our mediation routes (typed placeholders, semantic abstraction, secure symbolic mapping) and delayed restoration. The reported gains are measured relative to generic de-identification baselines evaluated on the identical benchmark and scenarios, which helps isolate the contribution of BodhiPromptShield's propagation-aware mechanisms. We have explicitly framed all claims in the abstract and manuscript as controlled systems results on CPPB without public-benchmark transfer or formal privacy guarantees. In the revised manuscript we will expand the benchmark construction section with additional details on scenario generation and randomization procedures to further address potential alignment concerns, and we will add an explicit limitations subsection discussing benchmark dependency and the value of future independent validation. This is a partial revision; new large-scale validation experiments on external benchmarks cannot be completed within the current revision cycle but will be noted as planned future work. revision: partial

Circularity Check

0 steps flagged

No significant circularity detected in derivation or evaluation chain.

full rationale

The provided manuscript text (abstract and context) introduces BodhiPromptShield and reports results on the custom CPPB benchmark, but contains no equations, parameter fits, or self-citations that reduce any central claim to its own inputs by construction. No self-definitional mappings, fitted inputs renamed as predictions, uniqueness theorems, or ansatzes appear. The abstract explicitly qualifies outcomes as 'controlled systems results on CPPB' without public-benchmark transfer or formal guarantees, avoiding overclaim. The evaluation uses a new benchmark, but this does not constitute circularity under the enumerated patterns because no specific reduction (e.g., metric definition forcing the reported 10.7% to 7.1% drop) is exhibited in the text. The derivation chain remains self-contained against external benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 2 invented entities

The central claim rests on the ability to detect sensitive spans reliably, on the semantic adequacy of the chosen routing methods (placeholders, abstraction, symbolic mapping), and on the representativeness of the custom CPPB benchmark for real propagation risks.

axioms (2)
  • domain assumption Sensitive spans in prompts can be detected with sufficient accuracy for downstream agent tasks.
    The framework begins with detection of sensitive spans before any routing occurs.
  • domain assumption Typed placeholders, semantic abstractions, and symbolic mappings preserve enough task-relevant information while hiding private content.
    The routing options are presented as functional substitutes for raw sensitive content.
invented entities (2)
  • BodhiPromptShield mediation framework no independent evidence
    purpose: Pre-inference routing of sensitive spans with delayed restoration
    New named system combining detection, typed routing, and timing control.
  • Controlled Prompt-Privacy Benchmark (CPPB) no independent evidence
    purpose: Evaluation environment for measuring cross-stage privacy propagation
    Benchmark used to produce the reported numeric results.

pith-pipeline@v0.9.0 · 5494 in / 1619 out tokens · 98538 ms · 2026-05-10T20:03:50.212724+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

40 extracted references · 3 canonical work pages · 3 internal anchors

  1. [1]

    ReAct: Synergizing reasoning and acting in language models,

    S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y . Cao, “ReAct: Synergizing reasoning and acting in language models,” in International Conference on Learning Representations (ICLR), 2023

    2023

  2. [2]

    Toolformer: Language models can teach themselves to use tools,

    T. Schick, J. Dwivedi-Yu, R. Dess `ı, R. Raileanu, M. Lomeli, L. Zettle- moyer, N. Cancedda, and T. Scialom, “Toolformer: Language models can teach themselves to use tools,” inAdvances in Neural Information Processing Systems, 2023

    2023

  3. [3]

    Extracting training data from large language models,

    N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-V oss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson, A. Oprea, and C. Raffel, “Extracting training data from large language models,” inProceedings of USENIX Security, 2021

    2021

  4. [4]

    Quantifying privacy risks of masked language models using membership inference attacks,

    F. Mireshghallah, K. Goyal, A. Uniyal, T. Berg-Kirkpatrick, and R. Shokri, “Quantifying privacy risks of masked language models using membership inference attacks,” inProceedings of EMNLP, 2022

    2022

  5. [5]

    Ignore previous prompt: Attack techniques for language models,

    F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,” inAdvML-Frontiers Workshop at NeurIPS, 2022

    2022

  6. [6]

    Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection,” inAISec Work- shop at CCS, 2023

    2023

  7. [7]

    The algorithmic foundations of differential privacy,

    C. Dwork, A. Rothet al., “The algorithmic foundations of differential privacy,”Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014. 18

    2014

  8. [8]

    Differentially private empirical risk minimization,

    K. Chaudhuri, C. Monteleoni, and A. D. Sarwate, “Differentially private empirical risk minimization,”Journal of Machine Learning Research, vol. 12, no. Mar, pp. 1069–1109, 2011

    2011

  9. [9]

    A privacy-preserving word embed- ding text classification model based on privacy boundary constructed by deep belief network,

    B. Ma, J. Wu, E. Lai, and W. Yan, “A privacy-preserving word embed- ding text classification model based on privacy boundary constructed by deep belief network,”Multimedia Tools and Applications, 2021, mTAP- D-21-04123R1

    2021

  10. [10]

    Universal and Transferable Adversarial Attacks on Aligned Language Models

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” inarXiv preprint arXiv:2307.15043, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  11. [11]

    Beyond memoriza- tion: Violating privacy via inference with large language models,

    R. Staab, M. Vero, M. Balunovi ´c, and M. Vechev, “Beyond memoriza- tion: Violating privacy via inference with large language models,” in Proceedings of the IEEE Symposium on Security and Privacy (S&P), 2024

    2024

  12. [12]

    Automated de-identification of free-text medical records,

    I. Neamatullah, M. M. Douglass, L.-w. Lehman, A. Reisner, M. Villar- roel, W. J. Long, P. Szolovits, G. B. Moody, R. G. Mark, and G. D. Clifford, “Automated de-identification of free-text medical records,” BMC Medical Informatics and Decision Making, vol. 8, no. 1, p. 32, 2008

    2008

  13. [13]

    De-identification of patient notes with recurrent neural networks,

    F. Dernoncourt, J. Y . Lee, O. Uzuner, and P. Szolovits, “De-identification of patient notes with recurrent neural networks,”Journal of the American Medical Informatics Association, vol. 24, no. 3, pp. 596–606, 2017

    2017

  14. [14]

    Evaluating the state-of-the- art in automatic de-identification,

    O. Uzuner, Y . Luo, and P. Szolovits, “Evaluating the state-of-the- art in automatic de-identification,”Journal of the American Medical Informatics Association, vol. 14, no. 5, pp. 550–563, 2007

    2007

  15. [15]

    Extracting information from textual documents in the electronic health record: A review of recent research,

    S. M. Meystre, G. K. Savova, K. C. Kipper-Schuler, and J. F. Hurdle, “Extracting information from textual documents in the electronic health record: A review of recent research,”Yearbook of Medical Informatics, vol. 19, no. 1, pp. 128–144, 2010

    2010

  16. [16]

    k-anonymity: A model for protecting privacy,

    L. Sweeney, “k-anonymity: A model for protecting privacy,”Interna- tional Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, vol. 10, no. 5, pp. 557–570, 2002

    2002

  17. [17]

    A systematic review of re-identification attacks on health data,

    K. El Emam and L. Arbuckle, “A systematic review of re-identification attacks on health data,”PLoS ONE, vol. 6, no. 12, p. e28071, 2011

    2011

  18. [18]

    Ethical and social risks of harm from Language Models

    L. Weidinger, J. Mellor, M. Rauh, C. Griffin, J. Uesato, P.-S. Huang, M. Cheng, A. Glaese, B. Balle, A. Kasirzadehet al., “Ethical and social risks of harm from language models,”arXiv preprint arXiv:2112.04359, 2021

    work page internal anchor Pith review arXiv 2021

  19. [19]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” inProceedings of the IEEE Symposium on Security and Privacy, 2017

    2017

  20. [20]

    Analyzing leakage of personally identifiable information in language models,

    N. Lukas, A. Salem, R. Sim, S. Tople, L. Wutschitz, and S. Zanella- B´eguelin, “Analyzing leakage of personally identifiable information in language models,” inProceedings of the IEEE Symposium on Security and Privacy (S&P), 2023

    2023

  21. [21]

    Jailbroken: How does llm safety training fail?

    A. Wei, N. Haghtalab, J. Steinhardtet al., “Jailbroken: How does llm safety training fail?”Advances in Neural Information Processing Systems, 2023

    2023

  22. [22]

    On the Opportunities and Risks of Foundation Models

    R. Bommasani, D. A. Hudson, E. Adeli, R. Altman, S. Arora, S. von Arx, M. S. Bernstein, J. Bohg, A. Bosselut, E. Brunskillet al., “On the opportunities and risks of foundation models,”arXiv preprint arXiv:2108.07258, 2021

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  23. [23]

    On the dangers of stochastic parrots: Can language models be too big?

    E. M. Bender, T. Gebru, A. McMillan-Major, and S. Shmitchell, “On the dangers of stochastic parrots: Can language models be too big?” Proceedings of FAccT, 2021

    2021

  24. [24]

    Model cards for model reporting,

    M. Mitchell, S. Wu, A. Zaldivar, P. Barnes, L. Vasserman, B. Hutchin- son, E. Spitzer, I. D. Raji, and T. Gebru, “Model cards for model reporting,” inProceedings of the Conference on Fairness, Accountability, and Transparency, 2019, pp. 220–229

    2019

  25. [25]

    Datasheets for datasets,

    T. Gebru, J. Morgenstern, B. Vecchione, J. W. Vaughan, H. Wallach, H. Daum ´e III, and K. Crawford, “Datasheets for datasets,”Communi- cations of the ACM, vol. 64, no. 12, pp. 86–92, 2021

    2021

  26. [26]

    Retrieval-augmented generation for knowledge-intensive nlp tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K”uttler, M. Lewis, W.-t. Yih, T. Rockt”aschel, S. Riedel, and D. Kiela, “Retrieval-augmented generation for knowledge-intensive nlp tasks,” inAdvances in Neural Information Processing Systems, 2020

    2020

  27. [27]

    Aug- mented language models: A survey,

    G. Mialon, R. Dess `ı, M. Lomeli, M. Etemad, S. Joty, C. Meister, A. Mohta, B. Moulin, F. Rudzicz, L. Bandarkar, T. Scialomet al., “Aug- mented language models: A survey,”Transactions of the Association for Computational Linguistics, vol. 12, pp. 531–550, 2024

    2024

  28. [28]

    Owasp top 10 for llm applications 2025,

    OW ASP Foundation, “Owasp top 10 for llm applications 2025,” https://owasp.org/ www-project-top-10-for-large-language-model-applications/, 2025, accessed 2026-03-26

    2025

  29. [29]

    Extracting training data from diffusion models,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Extracting training data from diffusion models,” inProceedings of the 32nd USENIX Security Symposium, 2023

    2023

  30. [30]

    Gpt-4v(ision) system card,

    OpenAI, “Gpt-4v(ision) system card,” https://openai.com/research/ gpt-4v-system-card, 2023

    2023

  31. [31]

    Holistic evaluation of language models,

    P. Liang, R. Bommasani, T. Lee, D. Tsipras, D. Soylu, M. Yasunaga, Y . Zhang, D. Narayananet al., “Holistic evaluation of language models,” Transactions on Machine Learning Research, 2023

    2023

  32. [32]

    Beyond the imitation game: Quantifying and extrapolating the capabilities of language models,

    A. Srivastava, A. Rastogi, A. Raoet al., “Beyond the imitation game: Quantifying and extrapolating the capabilities of language models,” Transactions on Machine Learning Research, 2023

    2023

  33. [33]

    The text anonymization benchmark (TAB): A dedicated cor- pus and evaluation framework for text anonymization,

    I. Pil ´an, P. Lison, L. Øvrelid, A. Papadopoulou, D. S ´anchez, and M. Batet, “The text anonymization benchmark (TAB): A dedicated cor- pus and evaluation framework for text anonymization,”Computational Linguistics, vol. 48, no. 4, pp. 1053–1101, 2022

    2022

  34. [34]

    Automated systems for the de-identification of longitudinal clinical narratives: Overview of 2014 i2b2/UTHealth shared task track 1,

    A. Stubbs, C. Kotfila, and O. Uzuner, “Automated systems for the de-identification of longitudinal clinical narratives: Overview of 2014 i2b2/UTHealth shared task track 1,”Journal of Biomedical Informatics, vol. 58, pp. S11–S19, 2015

    2014

  35. [35]

    ICDAR 2019 robust reading challenge on scanned receipts ocr and information extraction,

    N. Zhang, S. Yang, and S. Xiu, “ICDAR 2019 robust reading challenge on scanned receipts ocr and information extraction,” GitHub repository, 2019, dataset includes 1,000 scanned receipts with OCR and key- information annotations

    2019

  36. [36]

    CORD: A consolidated receipt dataset for post-ocr parsing,

    S. Park, S. Shin, B. Lee, J. Lee, J. Surh, M. Seo, and H. Lee, “CORD: A consolidated receipt dataset for post-ocr parsing,”Document Intelligence Workshop at NeurIPS, 2019

    2019

  37. [37]

    Privacylens: Evaluating privacy norm awareness of language models in action,

    Y . Shao, T. Li, W. Shi, Y . Liu, and D. Yang, “Privacylens: Evaluating privacy norm awareness of language models in action,” inAdvances in Neural Information Processing Systems, Datasets and Benchmarks Track, 2024

    2024

  38. [38]

    Fine-tuning pretrained language models: Weight initializations, data orders, and early stopping,

    J. Dodge, G. Ilharco, R. Schwartz, A. Farhadi, H. Hajishirzi, N. A. Smith, and S. Singh, “Fine-tuning pretrained language models: Weight initializations, data orders, and early stopping,” inProceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2020, pp. 9334–9350

    2020

  39. [39]

    Artificial intelligence risk management framework (ai rmf 1.0),

    National Institute of Standards and Technology, “Artificial intelligence risk management framework (ai rmf 1.0),” https://www.nist.gov/itl/ ai-risk-management-framework, 2023

    2023

  40. [40]

    Regulation (eu) 2024/1689 (artificial intelligence act),

    European Union, “Regulation (eu) 2024/1689 (artificial intelligence act),” Official Journal of the European Union, 2024. 1 Appendix This appendix provides the illustrative tables moved out of the main text, the controlled supporting tables that are no longer part of the main-text evidentiary backbone, a compact artifact-availability reproducibility map, f...

    2024