{"as_of":"2026-08-04T10:45:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:14ebc9f089d4a81bb38a388ccd1fa488b3e3723c965caf9e366ddb55b2d0a63d","coverage":[{"denominator":20,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":20,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-08T03:07:21.524834Z","state":"measured"},{"denominator":22,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":22,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-04T06:34:03.388597+00:00","state":"measured"},{"denominator":2,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":2,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T06:40:05.033819Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.24118","snapshot_observed_at":"2026-08-01T06:40:05.033819Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization.arXiv preprint arXiv:2604.24118, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.21824","last_updated":"2026-07-23T21:21:01Z","snapshot_observed_at":"2026-08-03T13:24:25.607685Z","submitted_at":"2026-07-23T21:21:01Z","title":"Protocol-Level Attacks on Agentic Commerce Platforms: A Cross-Platform Taxonomy, AIP-Bench, and Unified Defense","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-01T06:40:05.033819Z"},"links":{"cited_paper":"/paper/2604.24118","citing_paper":"/paper/2607.21824"},"observation_digest":"sha256:31d190b95fb1b4e3f2d881962e592cf92ca0cf2735f76a2c14d48b4658a35b5d","observation_id":"14d6e910-31d5-4ba8-be7a-354f80c8d7c1","resolution":{"observed_at":"2026-08-01T06:40:05.033819Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.24118","snapshot_observed_at":"2026-07-31T17:44:15.652372Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.24343","last_updated":"2026-07-31T11:27:14Z","snapshot_observed_at":"2026-08-04T10:23:25.682409Z","submitted_at":"2026-07-27T12:21:18Z","title":"Beyond Aggregate Risk: Role-Stratified Conformal Risk Control for LLM Tool Calls","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-07-31T17:44:15.652372Z"},"links":{"cited_paper":"/paper/2604.24118","citing_paper":"/paper/2607.24343"},"observation_digest":"sha256:45b2026943264b5e1669475ce793f09521b5a4210149dae149fde3b9ba1bc788","observation_id":"e14d8970-0c9e-4951-a1ca-0975bdcf0c74","resolution":{"observed_at":"2026-07-31T17:44:15.652372Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2604.24118/citation-record","integrity":"/paper/2604.24118/integrity","json":"/paper/2604.24118/citation-record.json","paper":"/paper/2604.24118"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2507.07974","last_updated":"2025-08-25T16:49:10Z","snapshot_observed_at":"2026-07-06T21:55:17.277337Z","submitted_at":"2025-07-10T17:51:05Z","title":"Defending Against Prompt Injection With a Few DefensiveTokens","version":2},"cited_work":{"arxiv_id":"2507.07974","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2507.07974","snapshot_observed_at":"2026-07-04T00:59:20.691622Z","title":"Defending against prompt injection with a few defensive tokens","venue":null,"work_id":"4f729650-c7f8-4e91-b5ed-4250fe884098","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2507.07974","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:366dfee123989dc4d6fdfa37a242882c7dcb3a29b000cb16e0489c69ae1e8876","observation_id":"38648840-d053-4eb0-be8d-b05dcf8a8c4b","resolution":{"observed_at":"2026-05-11T22:16:31.049398Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"https://docs.cloud.google","venue":null,"work_id":"942fe375-94bf-4667-a4dc-64f465c41768","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:dfc79667d434ece71808c11b89ace88ff7505d33bd91274418dc5f20d4acb702","observation_id":"6f7c90b8-2c6b-441a-8fe3-e71e38211f9d","resolution":{"observed_at":"2026-05-26T22:23:09.359110Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":"2403.14720","doi":"10.48550/arxiv.2403.14720","metadata_source":"pith","pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","venue":"cs.CR","work_id":"c18cd975-e731-4e0f-a99f-a37d846cdd31","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:705b841a7d583001460e3b919387195fa2b0f3cd9f0f98f8a928be17bd23cfbd","observation_id":"a98aa8a6-22a5-46c6-9d90-c4fbcc500f1f","resolution":{"observed_at":"2026-05-14T22:28:55.556742Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.21276","last_updated":"2024-10-25T17:43:01Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-25T17:43:01Z","title":"GPT-4o System Card","version":1},"cited_work":{"arxiv_id":"2410.21276","doi":"10.1177/15248380231178756","metadata_source":"pith","pith_arxiv_id":"2410.21276","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"GPT-4o System Card","venue":"cs.CL","work_id":"f37bf1c7-4964-4e56-9762-d20da8d9009f","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2410.21276","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:ce276ceb1801425f8fe792505b0bc65fe59e1e1854792c0eb1a501c57df01415","observation_id":"e46d2afd-0c0a-4d35-9f59-2d5818011af4","resolution":{"observed_at":"2026-05-11T22:16:31.475909Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.12252","doi":"10.48550/arxiv.2510.12252","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Promptlocate: Localizing prompt injection attacks","venue":null,"work_id":"247fa04e-9000-4d54-8e25-538bf1645f81","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:2c882ba2b236494cb51d39aed1c150faaf53c5a9e2df810493b7951f18b3f66b","observation_id":"5acdecc0-a3ec-40b9-9e28-78be41ea06be","resolution":{"observed_at":"2026-05-11T22:16:30.056074Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"InProceedings of the 2024 conference on empirical methods in natural language processing: industry track, pages 371–385","venue":null,"work_id":"2fd193d0-561f-483c-b4e3-f0e02cb1f8c0","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:deda8709af5f57e7497c304b5a72414aa89031987685219487e038ebc62bee10","observation_id":"62cb19c6-20ab-4dd7-b231-467f86a45c7c","resolution":{"observed_at":"2026-05-26T22:23:09.353350Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04957","last_updated":"2024-03-07T23:46:20Z","snapshot_observed_at":"2026-07-06T17:41:19.171822Z","submitted_at":"2024-03-07T23:46:20Z","title":"Automatic and Universal Prompt Injection Attacks against Large Language Models","version":1},"cited_work":{"arxiv_id":"2403.04957","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2403.04957","snapshot_observed_at":"2026-07-04T14:09:53.868428Z","title":"Automatic and universal prompt injection attacks against large language models","venue":null,"work_id":"0bf3ec19-0162-44f2-855f-1b7fdb565de2","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2403.04957","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:09c0fd1d5059804495ceb720a33e68433c6ca8c7b85435dfdca350f135f38e42","observation_id":"0758cb4a-9c1a-4ce4-84da-61f3390ff217","resolution":{"observed_at":"2026-05-11T22:16:30.268382Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"In 2025 IEEE Symposium on Security and Privacy (SP), pages 2190–2208","venue":null,"work_id":"1c98e182-b7b9-4ba1-97d3-2f164d98471c","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:5e8f84ade5376a34a303425604b1d7416983acbc28bdba53a4127e6d41863e8f","observation_id":"f6f6a1bc-9684-4b1f-b6a5-71b586ac4d02","resolution":{"observed_at":"2026-05-26T22:23:09.350682Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-07-06T18:55:11.576666Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":"2407.21783","doi":"10.1016/s0749-0720(15","metadata_source":"pith","pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"The Llama 3 Herd of Models","venue":"cs.AI","work_id":"1549a635-88af-4ac1-acfe-51ae7bb53345","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:2645cf4b9cf5e74256f512d972367a46dfa5204bd9a45230cbd0aef59fe34831","observation_id":"0488dda1-cd25-4591-854a-0876e3cecff1","resolution":{"observed_at":"2026-05-11T22:16:30.755496Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2512.12594","doi":"10.48550/arxiv.2512.12594","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:47:50.623075Z","title":"cellmate: Sandboxing browser ai agents","venue":null,"work_id":"3994ee1f-f65b-4f8b-93e9-6ec20a5e0988","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:e5a3e58a57aa1a79273ab875875cac09cf73a4820ccf0fb0dd51c8a1398633e4","observation_id":"f4c90596-ae9a-4b7c-b243-ae36149a6b88","resolution":{"observed_at":"2026-05-11T22:16:32.359050Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-07-06T14:19:47.424778Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":"2211.09527","doi":"10.48550/arxiv.2211.09527","metadata_source":"pith","pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","venue":"cs.CL","work_id":"a7c5b6ec-3407-4330-96c8-3fc58e7d410b","year":2022},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:2f23994d48a75ecd2607695690b76d00657cb82ea2bec150cda10f4dd555cb03","observation_id":"37cbf9f3-494f-449a-a4fe-5cfa6f0b6dd7","resolution":{"observed_at":"2026-05-11T22:16:32.209358Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-05-24T11:53:03.018758+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T11:53:03.018758+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2512.04367","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:47:50.377516Z","title":"9 Gerald J Popek and Robert P Goldberg","venue":null,"work_id":"3da25218-8494-4377-9eee-6d114f2231af","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:e38c91e2263d657472048a63a985221b955e8f6a2c5b3a8256d208ab47d5f87b","observation_id":"27d3cb5b-29fd-4acd-80eb-021290cad666","resolution":{"observed_at":"2026-05-11T22:16:29.937787Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Secu- rity, pages 660–674","venue":null,"work_id":"a71ee1d3-2c40-4b24-92e1-95c40f1162e4","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:1a993338677c03d819d34c6a5309fa8e4ed89af3f0c5eaa33c4d34fa6a439b2d","observation_id":"dbf93f3b-29a0-4f42-9167-ca6ac4953537","resolution":{"observed_at":"2026-05-26T22:23:09.356257Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.15219","last_updated":"2025-07-21T03:41:44Z","snapshot_observed_at":"2026-07-06T22:00:08.908202Z","submitted_at":"2025-07-21T03:41:44Z","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","version":1},"cited_work":{"arxiv_id":"2507.15219","doi":null,"metadata_source":"pith","pith_arxiv_id":"2507.15219","snapshot_observed_at":"2026-07-11T02:47:49.968301Z","title":"Promptarmor: Simple yet effective prompt injection defenses","venue":"cs.CR","work_id":"a555d845-f54e-4efb-8504-b885d3481efa","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2507.15219","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:601b84392397ec8bea499f8dc3071b840eed85bb5245a51a9319331eb9cae861","observation_id":"0d540643-035f-498a-b251-c718ced57266","resolution":{"observed_at":"2026-05-11T22:16:31.942505Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"InProceed- ings of the 2009 ACM SIGPLAN/SIGOPS interna- tional conference on Virtual execution environments, pages 121–130","venue":null,"work_id":"6d232686-2e38-4a7b-8971-09109b11718b","year":2009},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:98076277622d39a5bcd16b160408736679445d15244809429e959471b22c2897","observation_id":"14c31d71-a508-46a2-988d-8d6d77f1f85a","resolution":{"observed_at":"2026-05-26T22:23:09.362088Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.06471","last_updated":"2025-08-08T17:21:06Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-08-08T17:21:06Z","title":"GLM-4.5: Agentic, Reasoning, and Coding (ARC) Foundation Models","version":1},"cited_work":{"arxiv_id":"2508.06471","doi":"10.48550/arxiv.2508.06471","metadata_source":"pith","pith_arxiv_id":"2508.06471","snapshot_observed_at":"2026-07-11T01:07:44.097694Z","title":"GLM-4.5: Agentic, Reasoning, and Coding (ARC) Foundation Models","venue":"cs.CL","work_id":"5bb4e5d7-985e-431b-bb0d-75576cdc2950","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2508.06471","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:97bdb5a7270149a3ba9d65bf2854358ce6a920df98781605851d31dff4d5fbde","observation_id":"e50554d4-97a1-45c3-a630-a85f144002b1","resolution":{"observed_at":"2026-05-11T22:16:31.245875Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-05-23T05:23:01.474969+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-23T05:23:01.474969+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"In Proceedings of the 33rd ACM International Confer- ence on Multimedia, pages 10955–10964","venue":null,"work_id":"66f3f8cb-4acb-4b49-87b0-f2282d3f4596","year":2023},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:d25eb97d690df0535dcfcd2b7aba30105d2e5f814315b1c8f152f61a6d814128","observation_id":"a6b9a0e8-0b36-4952-a915-54285597f024","resolution":{"observed_at":"2026-05-26T22:23:09.348268Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"fa2bf670-2565-4fc5-91a3-d2f5f0a756ea","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:f21b05b6fca2d4f2d1661e92836c8508a78911f6d85725d1a6299d78222ed51e","observation_id":"51ca2548-2ad7-4fb1-8191-5594169a9fb9","resolution":{"observed_at":"2026-05-26T22:23:09.345363Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-07-06T20:33:01.960703Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-07-11T02:47:50.218642Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:cb1e930ac726a25c4bdef948ab130b33177dc182ec9260de2043bc0577de862f","observation_id":"af9bf477-2843-42a9-acb7-81f110a10627","resolution":{"observed_at":"2026-05-11T22:16:30.500382Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":"2307.15043","doi":"10.48550/arxiv.2307.15043","metadata_source":"pith","pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-07-11T02:47:49.837877Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","venue":"cs.CL","work_id":"3322fa86-1768-4677-8425-dd326b45e078","year":2023},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:45445a35f6ae3858b3b243089b3b03fc126f5749f807b1ac977eb4a7af9a2c6a","observation_id":"6ce32323-bb7a-402c-a512-5d461697239a","resolution":{"observed_at":"2026-05-11T22:16:31.675479Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization"},"reference_resolution":{"displayed":20,"state_counts":{"malformed_identifier":0,"metadata_mismatch":12,"parse_uncertain":0,"unresolved":1,"verified_exact":1,"verified_fuzzy":6},"total_outbound_references":20},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"thesis":"As of 4 August 2026, this Paper Citation Record lists 20 of 20 outbound references and 2 inbound Pith citation observations for arXiv:2604.24118."}