{"as_of":"2026-08-19T11:59:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:27447d1ea38495028b1c997bf7cfe318e19629df9ab0ae91e1b3923c50da4079","coverage":[{"denominator":68,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":68,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-11T23:43:28.649948Z","state":"measured"},{"denominator":68,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":68,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-19T06:32:44.657259+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.03821/citation-record","integrity":"/paper/2607.03821/integrity","json":"/paper/2607.03821/citation-record.json","paper":"/paper/2607.03821"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"React: Synergizing reasoning and acting in language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:4edc17fc5324d4b737236a927c9a4103dfd85d30befa4700f41b6e1e69c2a416","observation_id":"dca2c3c6-1186-4ef0-a358-88a3e2d19e33","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Toolformer: Language models can teach themselves to use tools,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:47cedc36f575f96dc3a7ca4171cf43f6392dd4ba82454523985396f288c228fa","observation_id":"f3df4cbe-6537-4127-942f-ed0f89a3d12b","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Chatgpt plugins,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:fa59c85d3cded9b71aa551c3ca44951d8c81ed42636da56c6812700b63fb7d14","observation_id":"434c079f-6475-441c-a699-2cbe8987a82f","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"What is microsoft 365 copilot?","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:505791fc77ae99e3f6ef55713838df4f5c9191a136fe2bc253c49d38dfc40716","observation_id":"fa066d97-c493-496f-9d38-ce2f24e60067","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Model context protocol,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:0c0b4b1d70cf0e7dc40796f3aec407d8a46b9fd51e4f428ccf52c19185afa864","observation_id":"9879d03f-dc8f-4606-a15a-8b8f2f7c63f9","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"OpenClaw,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:e3aa4a2b8e89c8ac5af447eaa4676d783bc5d182ee1789e81c5a017764ba0707","observation_id":"ead459a0-2ad3-4d4a-8e37-0cb00c4a2fde","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:a6c039e05868a3741f449832559d7f9710ff24c6648f5722e9eddbd35da0111d","observation_id":"26126fcb-a15b-4847-83e1-def2d2878b26","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Formalizing and benchmarking prompt injection attacks and defenses,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:f4fc7b55cc06f28e9e3b4b2816540104a7d05376cd132675b5d2184a1bbf17f5","observation_id":"d773cc28-72dc-49d7-ad30-e32eb3087cdf","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:75486d9d40c723b6e6682ced4d53e313f07d0220a13315039c0e0a269474dc41","observation_id":"fff67a2c-b9bf-4c3f-bfd6-99c019a402a8","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"The dual llm pattern for building ai assistants that can resist prompt injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:6236d8de334e9762c523e0d14a2a84aae5bc716b2a26aae4a88d75d7036a88da","observation_id":"8d91d6c0-f02f-4ed7-a99c-811fb6efcc2b","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.15547","last_updated":"2025-04-21T02:10:14Z","snapshot_observed_at":"2026-08-16T12:49:29.040180Z","submitted_at":"2025-03-17T05:27:57Z","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.15547","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Prompt flow integrity to prevent privilege escalation in llm agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2503.15547","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:d0e2173498c0a0bf54fbf89424597248117585f919332fee559bdc64ec8980b2","observation_id":"fb69f65f-e882-4682-a943-47ac5c597be1","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-17T17:40:10.591866Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Defeating prompt injections by design,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:749bbf2dd2385b552fa87d7d379ed88c145198e2f1f94c69182468cb29561064","observation_id":"285c5605-fad3-49bf-a22a-ee7a420b26e3","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.23643","last_updated":"2025-09-03T12:30:47Z","snapshot_observed_at":"2026-07-06T21:33:02.686798Z","submitted_at":"2025-05-29T16:50:41Z","title":"Securing AI Agents with Information-Flow Control","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.23643","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Securing ai agents with information-flow control,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2505.23643","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:c0affdaac6e495a97c9a2de8f1277c139d6da77d0f6751b60c1ac562588bfa06","observation_id":"ceaed338-de00-46f2-8064-13fc404bdf2f","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"PinchBench,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:088fcd04fd72a2b82aa69e0d22f2ff5f9884763ecf38881af6c899e9a1006402","observation_id":"5b3d927d-6f33-4b1a-bc75-2ee3e65bea9c","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Demystifying RCE vulnerabilities in LLM-integrated apps,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:cb53e2a34bcb55f9341ca94bfb51cf7493e269d62e0cf74ddfaf26f0594f0651","observation_id":"9de6ba4a-ebbc-4602-aaf6-104919081a38","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Agent security bench (ASB): Formalizing and benchmarking attacks and defenses in LLM-based agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:8dbdf39b40c620541e2fad25f33ce28bd01631651be417a8ca8fe9cb8e76f8dd","observation_id":"c6aca727-7578-49d2-9ab4-51ae5ef4f0f8","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"AGENTVIGIL: Automatic black- box red-teaming for indirect prompt injection against LLM agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:7c4b84fe3e3b328a89f0aa1dcdfeedf413bf2e2cb0f8a4dfccca1373437eac32","observation_id":"cf24e6b1-21f0-4818-8fea-888e4bea5f7f","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.14197","last_updated":"2025-01-27T08:51:16Z","snapshot_observed_at":"2026-08-16T18:17:43.393858Z","submitted_at":"2023-12-21T01:08:39Z","title":"Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.14197","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Benchmarking and defending against indirect prompt injection attacks on large language models,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2312.14197","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:9091c4ed560662e4cb55a6991f67f52426c8a6076ec66ee06dd7a3577bd05887","observation_id":"882da221-d8ed-4050-bd80-7898a459ec4b","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:c7934f51cd6c3a00df092879c10103dcabea3075a4212e0c6a6d74cc185ec2ee","observation_id":"f174e6b4-bfa6-450a-9827-d0adc68dbdaa","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Overcoming the retrieval barrier: Indirect prompt injection in the wild for LLM systems,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:86f892329a5b317c43a5d37fb5e5ee2bad25eeb25a387bfea87f4138cc4f526d","observation_id":"7c95462f-3b54-482b-b0bc-636a2eca3ec3","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"ObliInjection: Order-oblivious prompt injection attack to LLM agents with multi-source data,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:aa49f623a846748d2a2abf2f070ddb62eb5338a44b26b895414eab04e3e96fe2","observation_id":"6e35e460-a5a2-4942-b7f3-4ca0e8c0aea4","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Les dissonances: Cross-tool harvesting and polluting in pool-of-tools empowered LLM agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:0c2ab3442d3f35210478c619a151134cd2a9a4d8bf0f9794eec2e0cac89c0ba2","observation_id":"882e2567-952c-4882-928f-b03f29063928","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Prompt injection attack to tool selection in LLM agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:558ff503a2475d266589b7516c5e1e3a3a2595fe146a2bf7aa48e29c2e1a9ae9","observation_id":"4b80a929-e222-4a6c-955f-7360eef6b3f3","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Available: https://www.ndss-symposium.org/ndss- paper/prompt-injection-attack-to-tool-selection-in-llm-agents/","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:42e7209365aa435a5a4c64fb128c22e35575c55bf8259904cabaf9219dbdc40a","observation_id":"5b945dab-86de-41f1-96b2-ec684a6a57f4","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"SpAIware: Uncovering a novel artificial intelligence attack vector through persistent memory in LLM applications and agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:ee4c052e6a25e14aead67c3c932e0a5cfded35fbba95747e2b19ae5a913aaed3","observation_id":"707ad5aa-4db5-4f6b-b2c0-4196f9d91028","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Memory injection attacks on LLM agents via query-only interaction,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:76538e492d5e2cbdfda7196a77d6b42b500cacb87dd7c3359e4261ed05adf11c","observation_id":"ae153de8-5f30-405f-820d-7432d7acf9c5","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.07283","last_updated":"2024-10-09T11:01:29Z","snapshot_observed_at":"2026-08-11T20:32:18.138792Z","submitted_at":"2024-10-09T11:01:29Z","title":"Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.07283","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Available: https://arxiv.org/abs/2410.07283","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2410.07283","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:45837196a762682e9dfef58a2323adba4f5e519a7cc36f9ada7d80aa25135a88","observation_id":"c5e7cd97-a3b9-4f4a-81e2-0ecb909374ef","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"AirGapAgent: Protecting privacy-conscious conversational agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:bea5536e51030ae8de2abc316c7324eb2a44ee42efc83ad66eb9e33a3e216925","observation_id":"95266bf2-06bb-47ca-9c77-f4ae6bd75ff0","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.19091","last_updated":"2024-10-10T15:29:07Z","snapshot_observed_at":"2026-08-18T16:25:23.964035Z","submitted_at":"2024-09-27T18:41:58Z","title":"System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.19091","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"System-level defense against indi- rect prompt injection attacks: An information flow control perspective,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2409.19091","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:49419c9fcca351debcf211216945e883bd1f4bc61173b7412c5222ac4c950f57","observation_id":"d7fed1e6-e116-497d-bf6d-2365e4c49738","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"ACE: A security architecture for LLM-integrated app systems,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:fafa9e1107e76d25400d37871847b1b514bbd6b7e3195be3991d9129ec4fd160","observation_id":"8c59a475-771f-49d2-810a-9549a5b4cd9f","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-08-18T00:11:55.170013Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Ignore previous prompt: Attack techniques for language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:c9c7b9188e83ef6d86d6d87cb87631bec0f53ddee2f4e8aae904ef9322683cb0","observation_id":"c92e960b-82e4-47d8-80d9-bb68f10c45a3","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-08-15T10:16:52.688429Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Jailbroken: How does LLM safety training fail?","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:f67abede2d38e91e46de0deda5e578d976ea5deb6994f4f82d2747e88fdf71e9","observation_id":"ec6240b4-9108-4cff-a289-c1be0999ecda","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Universal and transferable adversarial attacks on aligned language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:1efd26f7cfd4139e6b04ed999797e3c95810d5a878efa63f3c8cd2ca50e18569","observation_id":"4c46affd-ac84-44db-9733-cc5622be7f73","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-11T23:45:02.178667Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"The instruction hierarchy: Training LLMs to prioritize privileged instructions,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:fdfc32238b426c08995fcd7d345c3bfc8ff714e5f6ae337c74f76c5f51cdc3a0","observation_id":"7249f692-e771-40e3-9be6-ae7690e9d25c","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-08-16T14:19:54.814069Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"StruQ: Defending against prompt injection with structured queries,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:2a1b4f82253df07a36a5c3709110c05148438d098cecca2efb03a7e0c1135e3b","observation_id":"cc8c9450-ca6d-4062-b6bc-fd841cec45ce","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"SecAlign: Defending against prompt injection with preference optimization,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:11c068b028fcafb58e1d9ecdd232bf4fff60f369b3b02d7bc420774463a55965","observation_id":"48306b39-cf50-4f26-a56f-c4788fb4604e","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Llama Prompt Guard 2,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:08e25aa625271dcad18dc16f6fbd4216bffe882e6e3d3bb75c666f61b1008bf1","observation_id":"618748e7-8306-4956-9a7c-a5ab2d650a3e","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.03574","last_updated":"2025-05-06T14:34:21Z","snapshot_observed_at":"2026-08-15T23:45:54.048231Z","submitted_at":"2025-05-06T14:34:21Z","title":"LlamaFirewall: An open source guardrail system for building secure AI agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.03574","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"LlamaFirewall: An open source guardrail system for building secure AI agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2505.03574","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:29654ec43e4af26c1c8462a73b2e61bedbbd813697e5794e9d870f79e4817f17","observation_id":"52445bad-392b-4d91-ba0f-481e686e6f3e","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"DataSentinel: A game-theoretic detection of prompt injection attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:c7264e78c82dccd65a9afe79267e240704e85a15bf9b71a3a3947a0d3cc6bd15","observation_id":"17091683-d763-4054-a35a-96ecbc467d19","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-08-18T16:24:31.099895Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Defending against indirect prompt injection attacks with spotlighting,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:237ce961e299f9e9593a8ab69bebf88ff71f3ffc77b0b918c9ec192758ff652e","observation_id":"42c9e19f-6ee2-42ba-a3e7-7a02360d692e","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Attention is all you need to defend against indirect prompt injection attacks in LLMs,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:38c7d1f07e6ba8558badea925fcd962242f35faacb08691cb37f07d79a7e3e3c","observation_id":"bd9e7f4e-d0a8-4f3d-8535-63d5d01ef2ca","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-19T00:43:34.703842Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"MELON: Provable defense against indirect prompt injection attacks in AI agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:7e89cc40ddc6acc7d802f84940f0ebfe7848c57a25c6c16f23a9382ca7d7eb0e","observation_id":"fa054f62-2795-4ad7-98c8-6a2a4f9a53cc","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in LLM agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:5ec39219557c59705f6ab232b80c7671429f83f3740effdb48b80d3fd80b3c1d","observation_id":"a5a2d4c3-80de-4f1d-a254-4f1d356c252e","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"DRIFT: Dynamic rule-based defense with injection isolation for securing LLM agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:a4fe658c55345b7f21528c4c602b9030f7d4a61dd96b49c1c92a0e79b9de01e4","observation_id":"d0a1c60e-41b9-4762-a575-6d9a2457a781","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"ShieldAgent: Shielding agents via verifiable safety policy reasoning,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:6b2566f84b9e3a1eba57552c5e7e4f9858970236716f468f9e2cb349c7be798b","observation_id":"759734b3-9ed2-43c2-ac3d-c918a3d29ada","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.09187","last_updated":"2025-05-29T03:09:05Z","snapshot_observed_at":"2026-07-06T18:30:23.849880Z","submitted_at":"2024-06-13T14:49:26Z","title":"GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.09187","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"GuardAgent: Safeguard LLM agents by a guard agent via knowledge- enabled reasoning,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2406.09187","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:32e0903905e6c5888af8516756c1a3565c9adddb0f7754e1c8a463ffce4dba99","observation_id":"d20f98ca-a415-40ce-93d9-2e11d463a69f","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18666","last_updated":"2025-07-31T04:00:48Z","snapshot_observed_at":"2026-08-13T11:09:53.274921Z","submitted_at":"2025-03-24T13:31:48Z","title":"AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18666","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"AgentSpec: Customizable runtime enforcement for safe and reliable LLM agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2503.18666","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:8950c3184aaa979179c756760f3e5ac7693a9a57ac397e90a95371a7b695c53e","observation_id":"dcbd94a6-d90b-4cb3-8eee-1c3c723c46bf","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-07T23:01:30.196995Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"RTBAS: Defending LLM agents against prompt injection and privacy leakage,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:161894fc317ba86f810e9892f846c54dcf6b735d3b3ff98f98cdfcbeab7dbf27","observation_id":"6fc5b00d-74af-4ecc-8d8f-5b149157070e","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Permissive information-flow analysis for large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:17132cb96792e737f342d6454fafb2edebcbfdc55629dfd0beebeeae6be15245","observation_id":"2041e5f4-7221-4875-b358-6eff8b6afffe","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Optimization-based prompt injection attack to LLM-as-a-judge,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:0171647c1e90df18f5cb35e1c27b5c6ca62719ca1a9e1719f3cff4934a18b2e9","observation_id":"db07bc48-7ebe-4ebe-bc99-76253403e426","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"OpenShell: A safe, private runtime for autonomous AI agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:6e51a392ebe154dd36bc65f6564bde1d69d57dfd82fb14deb26ecb291af88b72","observation_id":"59e95052-ea3e-4f48-9713-2a54f41b84dc","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Webhooks,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:c7747af5c02a7076b992f89515a1c3bce66e862f8d67025b42d5d80ba0b9599c","observation_id":"37419af9-99c8-45a0-be4c-ba9465a6fde7","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Configuration,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:1b10d0650016fece26cecab9925030693277b70bf097f7ff5c7365d9e42c732f","observation_id":"f781b8ee-0b2a-4233-ad64-777a60019a19","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:111bbeba7f4b36c52bf282de85e15cf8585dfbb524af87ecb0f1946b04ae1983","observation_id":"c76b4449-a21d-4b33-b24d-1e9dcf3bcdc0","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"gws: Google Workspace CLI,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:709074d84a4086a6616f7cce25c7d45d8d74f18f7bc548195bf874b9a5979ab8","observation_id":"7bb34070-789e-490d-8c82-77e285f646f2","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"GitHub CLI,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:7d1b3358bb7bfbfe2747f318227dc5fd4506ce6ab71328d4e7b4e2b92ee8c75b","observation_id":"040810cc-e61f-42db-a35a-2eb2519ed57b","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.14923","last_updated":"2024-10-22T00:53:48Z","snapshot_observed_at":"2026-08-16T13:07:52.644668Z","submitted_at":"2024-10-19T01:00:57Z","title":"Imprompter: Tricking LLM Agents into Improper Tool Use","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.14923","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Imprompter: Tricking LLM agents into improper tool use,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2410.14923","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:603753e6b26319d770a3a70fdd277ff2561544b0bacc7c13ae286fb7f937a04d","observation_id":"c52f5f5f-d966-4c28-9e05-07c50195f8c3","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Great, now write an article about that: The crescendo multi-turn LLM jailbreak attack,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:a280288837c22d5c9b933952054fc22b1fc6b3f25ccad5f06435998f4a6b4d75","observation_id":"67683645-9ea2-4f0d-ba4b-14659bbfbac6","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:b33a398f1e5eab6c0b8e869491ddad015cedb1945a5cce5aa3f8be87fa3004bd","observation_id":"f82c38fb-2c7f-4e1f-b78c-42d6d185762f","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04960","last_updated":"2025-01-30T22:55:18Z","snapshot_observed_at":"2026-08-16T14:11:47.014972Z","submitted_at":"2024-03-08T00:02:30Z","title":"IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.04960","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"An execution isolation architecture for LLM-based agentic systems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2403.04960","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:2228803170e833afce64cb6804c3ab646589af83d3b25d08b2af5f24539af30b","observation_id":"b6bcc6d7-2155-4201-8c3c-759ac403c9b1","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Optimizing agent planning for security and autonomy,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:5fa4861efe4272919892994c89e38b72db81657bb3157f4fefc29ce37c3151be","observation_id":"f082d9f9-40a2-4a0a-86e3-7febf098484c","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-08-17T13:35:14.591010Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.11703","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Progent: Programmable privilege control for LLM agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2504.11703","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:4b322072a6cc28652bef48588e762a67836e5c7a3d56a32db50e1b620bcba9ac","observation_id":"a214d93e-87bd-495f-ac05-416f1694e95b","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.17070","last_updated":"2025-04-17T17:48:53Z","snapshot_observed_at":"2026-08-16T12:58:34.604195Z","submitted_at":"2025-01-28T16:55:39Z","title":"Contextual Agent Security: A Policy for Every Purpose","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.17070","snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Conseca: Contextual agent security: A policy for every purpose,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"cited_paper":"/paper/2501.17070","citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:a2c3924e5bc51afc1c6b25a2f74c9a03a77beb2946d7e555b6a6eadc42dc7c45","observation_id":"b31e0bc6-77f8-4d07-a83e-586c8767cefd","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"SAGA: A security architecture for governing AI agentic systems,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:0ad3669bf821d910ba6bad2f0d2a33f356ee3afd128abe5ae7e02695e0882f0b","observation_id":"1092bb99-0554-414c-88d7-2399c63618c8","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Claude Code hooks reference,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:f1807b01e513c95090b457b511553a8575a808de629eecc0a8db2b4288943ebb","observation_id":"cf914bd3-be8f-489b-9fce-d95e06632c34","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Hermes Agent: Hooks,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:19bf2d86c91b4c9e70917805797fc765b9de5815d863f1e7843dfc1ddc6ab730","observation_id":"cabf711b-7a39-40a9-87f7-6d5411bce605","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Make agent defeat agent: Automatic detection of Taint-Style vulnerabilities in LLM-based agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:cea115049cf4cb941ad8f81dd754ac6e864aca954bc4409bc0bac364dfdc1bb6","observation_id":"66a8c0fe-fb11-487b-a116-ba50bb894277","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T23:43:28.649948Z","title":"Quarterly report","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-07-11T23:43:28.649948Z"},"links":{"citing_paper":"/paper/2607.03821"},"observation_digest":"sha256:1d344aef9ca5967996fa2cce4759407cf9728c0c52a9d7acd6a9faaa224fab44","observation_id":"a0779c28-2aac-4ee1-9332-1943b60d6d4e","resolution":{"observed_at":"2026-07-11T23:43:28.649948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.03821","last_updated":"2026-07-04T11:12:36Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-17T18:00:22.254459Z","submitted_at":"2026-07-04T11:12:36Z","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents"},"reference_resolution":{"displayed":68,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":68,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":68},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-19T06:32:44.657259+00:00","source":"crossref"},{"observed_at":"2026-08-19T06:32:39.956319+00:00","source":"retraction_watch"}],"thesis":"As of 19 August 2026, this Paper Citation Record lists 68 of 68 outbound references and 0 inbound Pith citation observations for arXiv:2607.03821."}