Pith. sign in

REVIEW 3 major objections 6 minor 50 references

A declared step contract of projected reads and verified structured patches makes local LLM updates safe on shared workflow state.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-11 07:25 UTC pith:6M4QCS4Z

load-bearing objection Clean systems paper that turns progressive disclosure into a real read/write/patch-source contract; gains are real but sit on a custom trap suite and LLM judge. the 3 major comments →

arxiv 2607.05483 v1 pith:6M4QCS4Z submitted 2026-07-06 cs.LG cs.AIcs.LOcs.MAcs.PL

PatchOptic for Shared-State LLM Workflows with Projected Views and Verified Structured Updates

Zhaoyu Bai , Jiaqi Cai This is my paper
classification cs.LG cs.AIcs.LOcs.MAcs.PL
keywords shared-state workflowsLLM agentsprogressive disclosureprojected viewsJSON Patchaccess controlworkflow verificationPatchOptic
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Agentic workflows share structured state, but limited context forces each model call to see only a fragment—progressive disclosure. Existing tools manage that read side; they do not say when a rewrite proposed from the fragment is valid once applied to the full state. PatchOptic supplies the missing contract: each step declares a projected read view, an authorized write region, and a patch-source region. The actor sees only the projection; a verifier checks the structured patch against the whole state before commit. The same declaration yields path footprints for delegation, composition, and static same-phase reordering certificates. On PatchBench (46 cases across six domains), projected reads cut reported leakage and token cost while preserving accepted-output quality under a strong actor; runtime verification blocks declared contract violations; and patch-source checks reject compromised artifacts that name hidden sources.

Core claim

The paper establishes that coupling projected reads with verified structured patches—under an optic-inspired authority triple of read view, write region, and patch-source region—gives a contract between local LLM rewrites and global validity in shared-state workflows. That contract reduces secret leakage and prompt cost at read time, blocks illegal commits before mutation, and yields footprints that support delegation, sub-workflow composition, and reordering certificates for independent same-phase steps.

What carries the argument

The optic-inspired authority triple (projected-read view, write region, patch-source region), realized as projected actor prompts plus a multi-gate verifier over structured patches (JSON Patch in the prototype), together with a footprint algebra of restriction, union, and a commutation condition for same-phase independence.

Load-bearing premise

The workflow policy author is trusted: if the declared read, write, or patch-source regions (or schemas and phase rules) are wrong or too broad, the runtime will enforce that incorrect contract.

What would settle it

On tasks with known hidden secrets and illegal patch sources, if projected-read plus full verification still leak protected values at rates comparable to full-state baselines, or if the verifier accepts patches that copy, move, or test paths outside the declared patch-source region, the central claim fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Shared-state agent systems can hide fields from the model without relying on the model to self-censor.
  • Wrong-phase, out-of-scope, schema-invalid, and hidden-source patches can be rejected before they mutate global state.
  • Declared footprints support static certificates that independent same-phase steps may be reordered without changing final state.
  • Delegation and packaged sub-workflows can be checked by restriction and composite external footprints rather than reopening internal actors.
  • Compromised patch artifacts that name hidden sources can be rejected even with no live model in the loop.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same projected-read and source-authority split could extend beyond JSON Patch to database updates, file edits, and tool side effects if every operation names its read sources.
  • Footprint commutation certificates open a path to schedule optimization of multi-agent workflows without full re-execution when writes and reads are disjoint.
  • Policy authorship becomes the critical surface; tooling that helps authors write least-privilege footprints may matter as much as the runtime.
  • Contract-valid but fabricated values remain open; combining these boundaries with stronger semantic checkers would close the remaining failure class the paper leaves to the actor.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes PatchOptic, a step interface for multi-step LLM workflows over shared structured state. Each step declares an authority triple (projected-read view Os, write region Ws, patch-source region Ps) plus phase, schema, and invariant checks. At runtime the actor sees only Os(x) and proposes a JSON Patch that is verified against the full state before commit; the same declaration yields a path-level footprint algebra for restriction (delegation), union (composition), and same-phase commutation certificates. Evaluation uses PatchBench (46 hand-authored cases, six domains, levels L0–L5) under six ablations (Unconstrained, Schema Only, FSM+ACL, View Only, Verify Only, PatchOptic), two actors (GPT-5-mini and local Mistral 7B), ten rounds, plus a separate no-model test of nine compromised patches that name hidden sources. Reported findings: projected reads cut leak runs to ~0.1/round and reduce tokens while preserving accepted-output quality under the strong actor (semantic pass ~0.78–0.80 vs ~0.61 full-state); phase/scope verification eliminates unsafe accepts in the audited slice; Verify Only and PatchOptic reject 9/9 hidden-source artifacts via patch_read_scope_violation.

Significance. If the results hold under broader workflows, PatchOptic supplies a concrete, inspectable contract that closes a real gap between progressive-disclosure reads and global write validity in agentic systems—something schema validators and constrained decoding alone do not provide. Strengths that should be credited: (1) clean six-setting ablations that separate structured output, phase/path ACLs, projection, and full verification; (2) explicit separation of live actor runs from no-model compromised-artifact tests; (3) an honest failure model (Table 1) that does not overclaim semantic correctness or policy-authorized disclosure; (4) dual-actor evaluation showing how projection interacts with weak vs strong models; (5) released artifacts and fixed judge prompts that support reanalysis. The footprint algebra, while largely definitional, gives a usable static vocabulary for delegation and reordering that path-prefix ACLs and FSM policies typically lack. The work is a solid systems contribution for shared-state LLM workflows rather than a foundational theoretical result.

major comments (3)
  1. [§4.1, Table 3, §5] §4.1 and Table 3: PatchBench’s 46 cases are hand-authored around L0–L5 levels and tags (hidden-value exfiltration, patch-source smuggling, phase/scope traps) that match the contracts PatchOptic enforces. The quantitative claims in §5 (semantic pass ~0.78–0.80 vs ~0.61; leak runs ~0.1/round; 9/9 rejections) therefore measure performance on traps the design is built to catch. Ablations still isolate mechanisms, but the manuscript should state more clearly that absolute magnitudes are suite-specific and should either (a) add a small held-out or independently authored case set, or (b) reframe headline numbers as mechanism-isolation evidence rather than transferable effect sizes. This is load-bearing for the abstract’s numerical claims.
  2. [§3.2–3.5, Contributions, §6] Contribution (ii) and §3.2–3.5 vs §5–6: The footprint algebra (restriction, union, commutation certificate, composite external footprint σ(P), data-dependent FA(x)) is presented as a main contribution and appears in the abstract, yet §6 states it is “evaluated analytically rather than as a benchmark score.” No PatchBench case exercises delegation restriction, certified reordering, or composite reuse end-to-end. Either add a small static-check suite (e.g., N-actor same-phase reorder certificates and one composite packaging example with measured reuse), or demote the algebra in the abstract/contributions to a supporting static layer whose correctness is definitional under the stated assumptions (§3.4).
  3. [§4.2, §5.1, Table 5] §4.2 and §5.1: GPT-5-mini is both the strong actor and the semantic-quality / leakage-review judge (content score weights fixed; semantic pass requires score ≥0.80 and no reviewed leakage). Under this setup, View Only and PatchOptic preserve content score while cutting leakage—plausible, but judge–actor coupling can inflate accepted-output quality agreement. At minimum, report inter-judge agreement on a subsample with a second model or human raters for the content-score components, and sensitivity of semantic pass to the 0.80 threshold. Without that, the “preserving quality” half of the strong-actor claim is less secure than the leakage and reject-rate results.
minor comments (6)
  1. [Figure 1, Table 2] Figure 1 and Table 2: The figure lists four gates (scope, schema, phase, invariants) while Table 2 expands six checks; the grouping note helps but a one-line mapping in the figure caption would reduce reader friction.
  2. [§3.1] §3.1: “When the projection is path-realizable, we write Rs…” — briefly state when a projection is not path-realizable and how the prototype handles that case, since later footprint definitions assume leaf paths in L.
  3. [Table 6] §5.2 / Table 6: “Verifier accepted” is defined as cross-setting disagreement and “does not imply semantic correctness,” but the column name still reads as a positive outcome. Rename to “Verifier disagreement” or similar to avoid misreading the audit.
  4. [§3.4] §3.4 commutation assumptions (deterministic actors, no retries/rollbacks, fixed footprints, verifier supports disjoint from the other actor’s writes) are strong relative to live stochastic agents. A short forward pointer in §3.4 to the empirical stochastic evaluation in §5 would clarify the static/dynamic split.
  5. [Abstract, §1, §7] Typos / polish: Abstract and §1 use “afootprint” without space; §7 “must still be satisfy” → “must still satisfy.” Date line “2026-06-30” and arXiv stamp are fine for preprint but should be normalized for journal production.
  6. [§6] Related work (§6) covers protection systems, structured generation, and prompt injection well; a brief explicit contrast with tool-permission / capability systems in agent frameworks (beyond the cited IFC and ACL lines) would help practitioners place PatchOptic.

Circularity Check

0 steps flagged

No significant circularity: empirical systems evaluation with definitional footprint machinery, not a self-reducing derivation.

full rationale

PatchOptic is a systems paper: it defines a step contract (projected-read view, write region, patch-source region), implements runtime verification over JSON Patch, and measures effects on PatchBench. The footprint algebra (restriction, union, commutation) is definitional machinery for static checks, not a claim that a fitted quantity predicts itself. Empirical results (semantic pass, leak runs, 9/9 hidden-source rejections) are measurements under ablations (Unconstrained, Schema Only, FSM+ACL, View Only, Verify Only, PatchOptic), including a no-model compromised-artifact test that removes the actor. Verify Only still enforces PA with full prompt input, so the write-side claim is not forced by projection. Citations for optics, RBAC/ABAC, JSON Patch/Schema, and agent benchmarks are external; there is no load-bearing uniqueness theorem or ansatz imported from the authors' prior work. Hand-authored cases that stress declared failure modes and LLM-as-judge methodology are validity/generalization concerns, not derivation circularity under the stated patterns. No equation or central claim reduces to its inputs by construction.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 3 invented entities

The central claim rests on standard protection and structured-data machinery plus design choices for the interface and evaluation. No fitted physical constants. Load-bearing assumptions are policy trust, JSON-path authority as the protection model, static actor assumptions for reordering certificates, and the hand-authored benchmark/judge protocol for empirical magnitudes.

free parameters (3)
  • semantic_pass content-score threshold = 0.80
    Accepted artifacts pass semantically only if content score ≥ 0.80 and no reported leakage; the 0.80 cutoff is a fixed evaluation choice that shapes reported success rates.
  • quality-judge component weights = 0.25/0.25/0.20/0.20/0.10
    Content score uses fixed weights 0.25 coverage + 0.25 non-omission + 0.20 non-hallucination + 0.20 non-contradiction + 0.10 format; these weights are chosen by the authors and affect quality comparisons.
  • Mistral actor temperature = 0
    Weak-actor runs fix temperature=0; stochasticity of the strong hosted actor is controlled only by ten-round averaging.
axioms (5)
  • domain assumption Workflow policy (read/write/patch-source regions, phase, schema, invariants) is trusted; runtime enforces declared policy rather than discovering correct policy.
    Stated in §2 and §6; underpins all safety claims.
  • domain assumption JSON Pointer path regions with prefix containment are an adequate authority model for shared structured state in the prototype.
    §3.2 defines L, ⪯, and regions over JSON Pointer paths.
  • ad hoc to paper For static commutation, actors are deterministic functions of prompt input, run once, have no external side effects beyond declared writes, and verifier supports are disjoint from the other actor's writes.
    §3.4 phase assumptions; without them the certificate is only a sufficient static test or falls back to differential execution.
  • domain assumption Optics/lenses provide the right conceptual split between view and update, realized here as projected reads plus checked JSON Patch rather than a full categorical optic.
    §1 and §3.1 explicitly borrow view/update intuition without claiming a full optic implementation.
  • domain assumption Least-privilege / mediated access is the appropriate security framing for shared workflow state against untrusted LLM invocations.
    §2 cites Lampson/Saltzer-Schroeder tradition and Table 1 failure model.
invented entities (3)
  • PatchOptic step interface (Os, Ws, Ps authority triple + verifier gates) no independent evidence
    purpose: Unify projected reads with verified structured writes and patch-source checks for shared-state LLM steps.
    Core design object of the paper; evaluated empirically, not independently evidenced outside this work.
  • Footprint algebra (restriction, union, commutation certificate, composite external footprint σ(P)) no independent evidence
    purpose: Support delegation, composition reuse, and same-phase reordering certificates from declared path regions.
    Static layer built on the step declaration; analytical rather than benchmark-scored.
  • PatchBench no independent evidence
    purpose: 46-case multi-domain benchmark and six-setting protocol to separate projection, schema, FSM/ACL, and full verification effects.
    Hand-authored evaluation suite introduced by the paper.

pith-pipeline@v1.1.0-grok45 · 23555 in / 3717 out tokens · 32314 ms · 2026-07-11T07:25:48.053677+00:00 · methodology

0 comments
read the original abstract

Agentic workflows often operate over shared, structured state. Because LLM context windows are limited, each model invocation is typically shown only the state fragment needed for the current workflow step, a pattern commonly known as progressive disclosure. Modern systems construct such model-facing views using grep-like keyword search, retrieval-augmented generation (RAG), abstract-syntax-tree (AST) queries, and task-specific agent skills. These methods make the read side manageable, but they do not define when a locally proposed rewrite is valid after it is applied back to the full state. The missing piece is a contract between local updates and global validity. We introduce PatchOptic, an optic-inspired interface for shared-state LLM workflows. Optics are compositional bidirectional accessors that describe how views of structured data are read and updated. PatchOptic borrows this view/update intuition and realizes it through projected reads and verified structured patches. Each workflow step declares a projected read view, an authorized write region, and a patch-source region. Beyond runtime enforcement, the same declaration yields a path-level footprint that supports delegation, sub-workflow composition, and static certificates for reordering independent steps within the same phase. We evaluate this design with PatchBench, a benchmark with 46 cases across domains. The results show that projected reads reduce reported leakage and token cost while preserving accepted-output quality under the strong actor. Runtime verification blocks declared workflow-contract violations before commit, and patch-read enforcement rejects compromised patch artifacts that use hidden sources.

Figures

Figures reproduced from arXiv: 2607.05483 by Jiaqi Cai, Zhaoyu Bai.

Figure 1
Figure 1. Figure 1: Operational workflow and inspection point. The runtime holds the full shared state [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: PatchBench evaluation workflow. A fixed case record is replayed under six settings. The [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Parallel actor comparison on the same 46 cases, six settings, and ten-round protocol. [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Audit-only outcome breakdown on the repeat-ten local Mistral runs. Left: expected-accept [PITH_FULL_IMAGE:figures/full_fig_p015_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: No-model compromised-patch stress test on nine fixed patch artifacts that name hidden [PITH_FULL_IMAGE:figures/full_fig_p016_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

50 extracted references · 4 linked inside Pith

  1. [1]

    Toolformer: Language models can teach themselves to use tools

    Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. Toolformer: Language models can teach themselves to use tools. InAdvances in Neural Information Processing Systems, 2023

    2023

  2. [2]

    ReAct: Synergizing reasoning and acting in language models

    Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. ReAct: Synergizing reasoning and acting in language models. InProceedings of the International Conference on Learning Representations, 2023

    2023

  3. [3]

    ToolLLM: Facilitating large language models to master 16000+ real-world APIs

    Yujia Qin, Shihao Liang, Yining Ye, Kunlun Zhu, Lan Yan, Yaxi Lu, Yankai Lin, Xin Cong, Xiangru Tang, Bill Qian, Sihan Zhao, Lauren Hong, Runchu Tian, Ruobing Xie, Jie Zhou, Mark Gerstein, Dahai Li, Zhiyuan Liu, and Maosong Sun. ToolLLM: Facilitating large language models to master 16000+ real-world APIs. InProceedings of the International Conference on L...

    2024

  4. [4]

    CodeSearchNet challenge: Evaluating the state of semantic code search

    Hamel Husain, Ho-Hsiang Wu, Tiferet Gazit, Miltiadis Allamanis, and Marc Brockschmidt. CodeSearchNet challenge: Evaluating the state of semantic code search. arXiv preprint arXiv:1909.09436, 2019

    Pith/arXiv arXiv 1909

  5. [5]

    BEIR: A heterogeneous benchmark for zero-shot evaluation of information retrieval models

    Nandan Thakur, Nils Reimers, Andreas Rücklé, Abhishek Srivastava, and Iryna Gurevych. BEIR: A heterogeneous benchmark for zero-shot evaluation of information retrieval models. In Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks (NeurIPS Datasets and Benchmarks), 2021

    2021

  6. [6]

    CrossCodeEval: A diverse and multilingual benchmark for cross-file code completion

    Yangruibo Ding, Zijian Wang, Wasi Uddin Ahmad, Hantian Ding, Ming Tan, Nihal Jain, Murali Krishna Ramanathan, Ramesh Nallapati, Parminder Bhatia, Dan Roth, and Bing Xiang. CrossCodeEval: A diverse and multilingual benchmark for cross-file code completion. In Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks (NeurIPS...

    2023

  7. [7]

    API-bank: A comprehensive benchmark for tool-augmented LLMs

    Minghao Li, Yingxiu Zhao, Bowen Yu, Feifan Song, Hangyu Li, Haiyang Yu, Zhoujun Li, Fei Huang, and Yongbin Li. API-bank: A comprehensive benchmark for tool-augmented LLMs. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 3102–3116, 2023

    2023

  8. [8]

    CRAG – comprehensive RAG benchmark

    Xiao Yang, Kai Sun, Hao Xin, Yushi Sun, Nikita Bhalla, Xiangsen Chen, Sajal Choudhary, Rongze Daniel Gui, Ziran Will Jiang, Ziyu Jiang, et al. CRAG – comprehensive RAG benchmark. InProceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks (NeurIPS Datasets and Benchmarks), 2024

    2024

  9. [9]

    Patil, Huanzhi Mao, Charlie Cheng-Jie Ji, Fanjia Yan, Vishnu Suresh, Ion Stoica, and Joseph E

    Shishir G. Patil, Huanzhi Mao, Charlie Cheng-Jie Ji, Fanjia Yan, Vishnu Suresh, Ion Stoica, and Joseph E. Gonzalez. The berkeley function calling leaderboard (BFCL): From tool use to agentic evaluation of large language models. InForty-second International Conference on Machine Learning, 2025

    2025

  10. [10]

    AppWorld: A controllable world of apps and people for benchmarking interactive coding agents

    Harsh Trivedi, Tushar Khot, Mareike Hartmann, Ruskin Manku, Vinty Dong, Edward Li, Shashank Gupta, Ashish Sabharwal, and Niranjan Balasubramanian. AppWorld: A controllable world of apps and people for benchmarking interactive coding agents. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p...

    2024

  11. [11]

    Shunyu Yao, Noah Shinn, Pedram Razavi, and Karthik Narasimhan.τ-bench: A benchmark for tool-agent-user interaction in real-world domains, 2024

    2024

  12. [12]

    Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig

    Shuyan Zhou, Frank F. Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig. WebArena: A realistic web environment for building autonomous agents. InProceedings of the International Conference on Learning Representations, 2024

    2024

  13. [13]

    ToolSandbox: A stateful, conversational, interactive evaluation benchmark for LLM tool use capabilities

    Jiarui Lu, Thomas Holleis, Yizhe Zhang, Bernhard Aumayer, Feng Nan, Haoping Bai, Shuang Ma, Shen Ma, Mengyu Li, Guoli Yin, Zirui Wang, and Ruoming Pang. ToolSandbox: A stateful, conversational, interactive evaluation benchmark for LLM tool use capabilities. In Findings of the Association for Computational Linguistics: NAACL 2025, pages 1160–1183, Albuquer...

    2025

  14. [14]

    Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security, pages 79–90, 2023

    2023

  15. [15]

    AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents

    Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. arXiv preprint arXiv:2406.13352, 2024

    Pith/arXiv arXiv 2024

  16. [16]

    InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents. InFindings of the Association for Computational Linguistics: ACL 2024, pages 10471–10506, 2024

    2024

  17. [17]

    JSON Schema: A media type for describing JSON documents

    Austin Wright, Henry Andrews, Ben Hutton, and Greg Dennis. JSON Schema: A media type for describing JSON documents. Draft 2020-12 specification, JSON Schema, 2022

    2020

  18. [18]

    PICARD: Parsing incrementally for constrained auto-regressive decoding from language models

    Torsten Scholak, Nathan Schucher, and Dzmitry Bahdanau. PICARD: Parsing incrementally for constrained auto-regressive decoding from language models. InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 9895–9901, 2021

    2021

  19. [19]

    Prompting is programming: A query language for large language models.Proceedings of the ACM on Programming Languages, 7(PLDI):1946–1969, 2023

    Luca Beurer-Kellner, Marc Fischer, and Martin Vechev. Prompting is programming: A query language for large language models.Proceedings of the ACM on Programming Languages, 7(PLDI):1946–1969, 2023

    1946

  20. [20]

    Nathan Foster, Michael B

    J. Nathan Foster, Michael B. Greenwald, Jonathan T. Moore, Benjamin C. Pierce, and Alan Schmitt. Combinators for bidirectional tree transformations: A linguistic approach to the view-update problem. InProceedings of the 32nd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pages 233–246, 2005

    2005

  21. [21]

    Pierce, and Jeffrey A

    Aaron Bohannon, Benjamin C. Pierce, and Jeffrey A. Vaughan. Relational lenses: A language for updatable views. InProceedings of the Twenty-Fifth ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, pages 338–347. Association for Computing Machinery, 2006

    2006

  22. [22]

    Butler W. Lampson. Protection. InProceedings of the Fifth Princeton Symposium on Informa- tion Sciences and Systems, pages 437–443, 1971

    1971

  23. [23]

    Saltzer and Michael D

    Jerome H. Saltzer and Michael D. Schroeder. The protection of information in computer systems.Proceedings of the IEEE, 63(9):1278–1308, 1975. 20

    1975

  24. [24]

    Bryan and Mark Nottingham

    Paul C. Bryan and Mark Nottingham. JavaScript Object Notation (JSON) Patch. RFC 6902, Internet Engineering Task Force, 2013

    2013

  25. [25]

    Bryan, Kris Zyp, and Mark Nottingham

    Paul C. Bryan, Kris Zyp, and Mark Nottingham. JavaScript Object Notation (JSON) Pointer. RFC 6901, Internet Engineering Task Force, 2013

    2013

  26. [26]

    Sandhu, Edward J

    Ravi S. Sandhu, Edward J. Coyne, Hal L. Feinstein, and Charles E. Youman. Role-based access control models.Computer, 29(2):38–47, 1996

    1996

  27. [27]

    Miller, Ka-Ping Yee, and Jonathan Shapiro

    Mark S. Miller, Ka-Ping Yee, and Jonathan Shapiro. Capability myths demolished. Technical report, Technical Report, 2003

    2003

  28. [28]

    Hu, David Ferraiolo, Rick Kuhn, Adam Schnitzer, Kenneth Sandlin, Robert Miller, and Karen Scarfone

    Vincent C. Hu, David Ferraiolo, Rick Kuhn, Adam Schnitzer, Kenneth Sandlin, Robert Miller, and Karen Scarfone. Guide to attribute based access control (ABAC) definition and considerations. NIST Special Publication 800-162, National Institute of Standards and Technology, 2014

    2014

  29. [29]

    Willard and Rémi Louf

    Brandon T. Willard and Rémi Louf. Efficient guided generation for large language models, 2023

    2023

  30. [30]

    Wil M. P. van der Aalst, Arthur H. M. ter Hofstede, Bartek Kiepuszewski, and Alistair P. Barros. Workflow patterns.Distributed and Parallel Databases, 14(1):5–51, 2003

    2003

  31. [31]

    Burnett, Jerry Carter, Scott McGlashan, and Torbjörn Lager

    Jim Barnett, Rahul Akolkar, Rob Auburn, Michael Bodell, Daniel C. Burnett, Jerry Carter, Scott McGlashan, and Torbjörn Lager. State chart XML (SCXML): State machine notation for control abstraction. W3C recommendation, World Wide Web Consortium, 2015

    2015

  32. [32]

    G- eval: NLG evaluation using GPT-4 with better human alignment

    Yang Liu, Dan Iter, Yichong Xu, Shuohang Wang, Ruochen Xu, and Chenguang Zhu. G- eval: NLG evaluation using GPT-4 with better human alignment. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 2511–2522, 2023

    2023

  33. [33]

    Xing, Hao Zhang, Joseph E

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. Judging LLM-as-a-judge with MT-bench and chatbot arena. InAdvances in Neural Information Processing Systems, 2023

    2023

  34. [34]

    Dorothy E. Denning. A lattice model of secure information flow.Communications of the ACM, 19(5):236–243, 1976

    1976

  35. [35]

    Myers and Barbara Liskov

    Andrew C. Myers and Barbara Liskov. A decentralized model for information flow control. InProceedings of the 16th ACM Symposium on Operating Systems Principles, pages 129–142, 1997

    1997

  36. [36]

    Myers and Barbara Liskov

    Andrew C. Myers and Barbara Liskov. Complete, safe information flow with decentralized labels. InProceedings of the IEEE Symposium on Security and Privacy, pages 186–197, 1998

    1998

  37. [37]

    Andrew C. Myers. JFlow: Practical mostly-static information flow control. InProceedings of the 26th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pages 228–241, 1999

    1999

  38. [38]

    System-level defense against indirect prompt injection attacks: An information flow control perspective, 2024

    Fangzhou Wu, Ethan Cecchetti, and Chaowei Xiao. System-level defense against indirect prompt injection attacks: An information flow control perspective, 2024. 21

    2024

  39. [39]

    PiVe: Prompting with iterative verification improving graph-based generative capability of LLMs

    Jiuzhou Han, Nigel Collier, Wray Buntine, and Ehsan Shareghi. PiVe: Prompting with iterative verification improving graph-based generative capability of LLMs. arXiv preprint arXiv:2305.12392, 2023

    Pith/arXiv arXiv 2023

  40. [40]

    Sketch-guided constrained decoding for boosting blackbox large language models without logit access

    Saibo Geng, Berkay Döner, Chris Wendler, Martin Josifoski, and Robert West. Sketch-guided constrained decoding for boosting blackbox large language models without logit access. arXiv preprint arXiv:2401.09967, 2024

    Pith/arXiv arXiv 2024

  41. [41]

    JSON whisperer: Efficient JSON editing with LLMs

    Sarel Duanis, Asnat Greenstein-Messica, and Eliya Habba. JSON whisperer: Efficient JSON editing with LLMs. InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing: Industry Track, pages 1265–1274, Suzhou (China), November 2025. Association for Computational Linguistics

    2025

  42. [42]

    Ruan, Yaxing Cai, Ziyi Xu, Yilong Zhao, Ruihang Lai, and Tianqi Chen

    Yixin Dong, Charlie F. Ruan, Yaxing Cai, Ziyi Xu, Yilong Zhao, Ruihang Lai, and Tianqi Chen. XGrammar: Flexible and efficient structured generation engine for large language models. In Proceedings of Machine Learning and Systems, volume 7, 2025

    2025

  43. [43]

    MRKL systems: A modular, neuro-symbolic architecture that combines large language models, external knowledge sources and discrete reasoning, 2022

    Eyal Karpas, Omri Abend, Yonatan Belinkov, Barak Lenz, Omer Lieber, Nir Ratner, Yoav Shoham, Harry Bata, Yoav Levine, Kevin Leyton-Brown, Dor Muhlgay, Neer Rozen, Roy Schwartz, Gal Shachaf, Shai Shalev-Shwartz, and Moshe Tenenholtz. MRKL systems: A modular, neuro-symbolic architecture that combines large language models, external knowledge sources and dis...

    2022

  44. [44]

    Defending against indirect prompt injection attacks with spotlighting, 2024

    Keegan Hines, Gary Lopez, Matthew Hall, Federico Zarfati, Yonatan Zunger, and Emre Kiciman. Defending against indirect prompt injection attacks with spotlighting, 2024

    2024

  45. [45]

    Maddison, and Tatsunori Hashimoto

    Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J. Maddison, and Tatsunori Hashimoto. Identifying the risks of LM agents with an LM-emulated sandbox, 2024

    2024

  46. [46]

    StruQ: Defending against prompt injection with structured queries

    Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. StruQ: Defending against prompt injection with structured queries. In34th USENIX Security Symposium (USENIX Security 25), pages 2383–2400. USENIX Association, 2025

    2025

  47. [47]

    Defeating prompt injections by design, 2025

    Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. Defeating prompt injections by design, 2025

    2025

  48. [48]

    A graph model of data and workflow provenance

    Umut Acar, Peter Buneman, James Cheney, Jan Van den Bussche, Natalia Kwasnikowska, and Stijn Vansummeren. A graph model of data and workflow provenance. InProceedings of the 2nd USENIX Workshop on the Theory and Practice of Provenance, 2010

    2010

  49. [49]

    Davidson, and Tova Milo

    Zhuowei Bao, Susan B. Davidson, and Tova Milo. A fine-grained workflow model with provenance-aware security views. InProceedings of the 3rd USENIX Workshop on the Theory and Practice of Provenance, 2011

    2011

  50. [50]

    PROV-DM: The PROV data model

    Luc Moreau and Paolo Missier. PROV-DM: The PROV data model. W3C recommendation, World Wide Web Consortium, 2013. 22 A Artifact and Reproducibility Summary The released artifacts separate paper reproduction from full run inspection. The package contains every CSV needed to compile the figures and tables underdata/. The 46 benchmark YAML files live in the s...

    2013