{"as_of":"2026-08-17T07:51:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:3d0c79926db31c090b9697df6b99d532df3a0ba8dbfbc6e4bda676ede218eb63","coverage":[{"denominator":21,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":21,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-02T03:05:25.734583Z","state":"measured"},{"denominator":21,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":21,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-17T06:30:58.91139+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.14006/citation-record","integrity":"/paper/2607.14006/integrity","json":"/paper/2607.14006/citation-record.json","paper":"/paper/2607.14006"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.6028/nist.sp.800-115","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"NIST Special Publication 800-115, National Institute of Standards and Technology, Gaithersburg, MD, USA (2008)","venue":null,"work_id":"45e834f9-b20e-499c-bf0d-0b7786d6a99a","year":2008},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:23.285132Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:985554056db00215fe8475fc4a0ede0c8d2bb6ae1305502927e536b05e14c4ac","observation_id":"b0fd21a2-aa6e-400d-9aad-27e460b9709e","resolution":{"observed_at":"2026-08-02T03:09:07.518731Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:23.353021Z","title":"https://attack.mitre.org/","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:23.353021Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:c9cce1f195dd855feb052f880a96b17d1a0f39d59b2d9fec8d93874bdedc2898","observation_id":"94d3e682-71e3-44d4-86f9-0d2dbb0f3d69","resolution":{"observed_at":"2026-08-02T03:05:23.353021Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1412.6572","last_updated":"2015-03-20T20:19:16Z","snapshot_observed_at":"2026-08-12T17:13:46.394331Z","submitted_at":"2014-12-20T01:17:12Z","title":"Explaining and Harnessing Adversarial Examples","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1412.6572","snapshot_observed_at":"2026-08-02T03:05:23.454563Z","title":"https://arxiv.org/abs/1412.6572","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:23.454563Z"},"links":{"cited_paper":"/paper/1412.6572","citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:3b46ed11a74872fccff8559a1c592cbac9ca59f1d439390a08d8853a21e8257c","observation_id":"cdae8dbe-77d3-4f34-9465-46e4e6a53e4a","resolution":{"observed_at":"2026-08-02T03:05:23.454563Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:23.567592Z","title":"Pattern Recognition84, 317–331 (2018) https://doi.org/10.1016/ j.patcog.2018.07.023","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:23.567592Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:9a2569fded5e6426a36cafced9a14862163509a5deb90933d030d26b00d77086","observation_id":"046a0012-3817-4ebe-8502-d26050b90d64","resolution":{"observed_at":"2026-08-02T03:05:23.567592Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1145/3453158","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"ACM Computing Surveys54(5), 1–36 (2021) https://doi.org/10.1145/3453158","venue":"ACM Computing Surveys","work_id":"b90e2b4b-ec94-4457-97db-faaf21f25695","year":2021},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:23.666588Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:b18c81bc721b4745eb2172a3b067bd726952e714e12ac0682ca8ac538ba0ab7d","observation_id":"28f465da-5057-4b9b-89bb-8ac5ca7594ac","resolution":{"observed_at":"2026-08-02T03:09:07.311126Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-17T06:30:58.91139+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:23.779240Z","title":"https://genai.owasp.org/llm-top-10/","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:23.779240Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:6b057e6c7f8397ddc297c8df81d645c8b573ed08f056ea4bde90a0a04545553c","observation_id":"32d76f52-9943-4950-869d-354b462fd77f","resolution":{"observed_at":"2026-08-02T03:05:23.779240Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:23.875555Z","title":"IEEE Access14, 12875–12899 (2026) https://doi.org/10.1109/ACCESS","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:23.875555Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:6ca75c078ad602541f4c8336f4332bfc2e167e0b388703fe80f4a542566b556e","observation_id":"5e036853-b3b8-42b1-9532-1ae7456c5462","resolution":{"observed_at":"2026-08-02T03:05:23.875555Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.12173","last_updated":"2023-05-05T14:26:17Z","snapshot_observed_at":"2026-08-12T14:45:22.117576Z","submitted_at":"2023-02-23T17:14:38Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.12173","snapshot_observed_at":"2026-08-02T03:05:24.010667Z","title":"https://arxiv.org/abs/2302.12173","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:24.010667Z"},"links":{"cited_paper":"/paper/2302.12173","citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:1e7e8a1ba7bf4bc9578114d532f2b7cee5c02d00fda63d7140482349908b1f97","observation_id":"88c610aa-d019-4410-836f-d137261cef62","resolution":{"observed_at":"2026-08-02T03:05:24.010667Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-02T03:05:24.126216Z","title":"https: //doi.org/10.48550/arXiv.2307.15043","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:24.126216Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:c20cf64ad9b81c1ea19021cb5ed8f09297c307e71c25fa2c510a64ae227169b9","observation_id":"583b1f33-cf54-4562-a659-c65cb7c1156b","resolution":{"observed_at":"2026-08-02T03:05:24.126216Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:24.251147Z","title":"NIST Trustworthy and Responsible AI NIST AI 600-1, National Institute of Standards and Technology, Gaithersburg, MD, USA (2024)","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:24.251147Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:95654384898f1ce5e2ef8595aaf461b785ec2927221c24927472ce33092c0f70","observation_id":"6033cc9e-4dbb-49a5-82e9-29ce11a953c3","resolution":{"observed_at":"2026-08-02T03:05:24.251147Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:24.350128Z","title":"https://atlas.mitre.org/","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:24.350128Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:a4aaedfdc9c4343a5cc5980196a1c00d1e358e74a34d7ccffbd99605005cdf62","observation_id":"8f7d0e91-086c-4c2a-9e79-5f5f29f4ea0a","resolution":{"observed_at":"2026-08-02T03:05:24.350128Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:24.465501Z","title":"https://owasp.org/ www-project-ai-security-and-privacy-guide/","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:24.465501Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:ac830a5c3f1b11258d32c8e794a382075c98809a6ae3622624bb930182baeee2","observation_id":"dfb9f66c-8441-4dfd-9a77-d178d150c8dd","resolution":{"observed_at":"2026-08-02T03:05:24.465501Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:24.578719Z","title":"NIST Trustworthy and Responsible AI NIST AI 100-1, National Institute of Standards and Technology, Gaithersburg, MD, USA (2023)","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:24.578719Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:3bc08d3921154c34291bed24137bd42aca93604bd584c56119826cd5c19cb7a0","observation_id":"08304201-c604-455f-bfb4-e6ea1ea72756","resolution":{"observed_at":"2026-08-02T03:05:24.578719Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:24.694539Z","title":"https://www.iso.org/standard/77304","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:24.694539Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:e067a5a8c78b32824ed61cd28defb7a909d62a717abe4869df085abcf15ca010","observation_id":"6a209313-9cd5-4bec-a73d-371d58e70340","resolution":{"observed_at":"2026-08-02T03:05:24.694539Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:24.874180Z","title":"ACM SIGOPS Operating Systems Review22(4), 36–38 (1988) https://doi.org/ 10.1145/54289.871709","venue":null,"work_id":null,"year":1988},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:24.874180Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:b0d8e46d2fb80bf184c78d2d2c650f2819aa945e6bd7d1615cc4a273f49ebbb9","observation_id":"4b8aa762-78bd-4f19-a116-7ee7eb0d5fdc","resolution":{"observed_at":"2026-08-02T03:05:24.874180Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:25.001264Z","title":"https:// owasp.org/www-project-machine-learning-security-top-10/","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:25.001264Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:8654554e1ba45dcbe66db80a0e376ed35fd08ad0dbc58d16a04f9f1d63f51f80","observation_id":"f39ca71e-5766-4c2c-be3f-c9de7722b1cb","resolution":{"observed_at":"2026-08-02T03:05:25.001264Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-11T23:45:02.178667Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-02T03:05:25.152096Z","title":"https://arxiv.org/abs/2404.13208","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:25.152096Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:321c0b1753c0a6d45984ba626135145ecbae8a703afdefe797c7e1707fe90795","observation_id":"0b61ffca-4e28-4df6-9518-66c472225755","resolution":{"observed_at":"2026-08-02T03:05:25.152096Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-08-16T14:19:54.814069Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-08-02T03:05:25.268927Z","title":"In: Proceedings of the USENIX Security Symposium (2025)","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:25.268927Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:98008102104fa494e67929bb206aecfa31e326021fbab04ac7aba2db93549410","observation_id":"e8b83c0e-01d6-46fb-a0d1-a1920db44b3d","resolution":{"observed_at":"2026-08-02T03:05:25.268927Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:25.434494Z","title":"Accepted to USENIX Security 2026 (2026)","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:25.434494Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:ac1da5bfa4ec035079a3ab51c2ec401811b5b5044981955b20eb816b5dd80c7b","observation_id":"a9800dc2-eb01-4d53-82c4-692fcc9a5262","resolution":{"observed_at":"2026-08-02T03:05:25.434494Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:25.596038Z","title":"ACM Computing Surveys57(7), 1–36 (2025) https://doi.org/10.1145/3716628 41","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:25.596038Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:9e4d7441ff634fac26124fc8fead22ee4faf7b4bfcce35234568b21d4415e2e0","observation_id":"1b516cb1-0922-4300-9f8a-cc1c031a9566","resolution":{"observed_at":"2026-08-02T03:05:25.596038Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-02T03:05:25.734583Z","title":"NIST Special Publication 800-160, Volume 2, Revision 1, National Institute of Standards and Technology, Gaithersburg, MD, USA (2021)","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-02T03:05:25.734583Z"},"links":{"citing_paper":"/paper/2607.14006"},"observation_digest":"sha256:7bb2f07060c53ecb7ab3d2fc11f26780bf7b6f45ddd77dda57d8be11e431e158","observation_id":"5f3d8af6-479d-4c18-b49c-9a470ce9249e","resolution":{"observed_at":"2026-08-02T03:05:25.734583Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.14006","last_updated":"2026-07-15T16:36:54Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-15T23:54:17.492775Z","submitted_at":"2026-07-15T16:36:54Z","title":"Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation"},"reference_resolution":{"displayed":21,"state_counts":{"malformed_identifier":4,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":15,"verified_exact":2,"verified_fuzzy":0},"total_outbound_references":21},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-17T06:30:58.91139+00:00","source":"crossref"},{"observed_at":"2026-08-17T06:30:54.323127+00:00","source":"retraction_watch"}],"thesis":"As of 17 August 2026, this Paper Citation Record lists 21 of 21 outbound references and 0 inbound Pith citation observations for arXiv:2607.14006."}