{"as_of":"2026-08-09T00:08:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:d249cfd67cf4d11e4cb7c7dbf1936762c1ff3ffa267f812963e49a5038c370c9","coverage":[{"denominator":13,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":13,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T16:19:08.659588Z","state":"measured"},{"denominator":13,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":13,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.18063/citation-record","integrity":"/paper/2607.18063/integrity","json":"/paper/2607.18063/citation-record.json","paper":"/paper/2607.18063"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2410.09024","last_updated":"2025-04-18T14:30:31Z","snapshot_observed_at":"2026-08-02T12:38:54.249632Z","submitted_at":"2024-10-11T17:39:22Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.09024","snapshot_observed_at":"2026-08-01T16:19:08.591855Z","title":"Agentharm: A benchmark for measuring harmfulness of LLM agents.arXiv preprint arXiv:2410.09024,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.591855Z"},"links":{"cited_paper":"/paper/2410.09024","citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:b0a773cbb6799d795bf95b8959acce3d3ce84511c36e22af728dde199d1f3908","observation_id":"cb9d54ac-a36d-49d8-8a77-d270fe776526","resolution":{"observed_at":"2026-08-01T16:19:08.591855Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:19:08.632076Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.632076Z"},"links":{"citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:6b17d57e6023cb60949aa271683f2145a9abe2fd05cafc66de3ffed72fc584d0","observation_id":"10f70f7c-61ec-4297-bb8c-aa8255be8e44","resolution":{"observed_at":"2026-08-01T16:19:08.632076Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.00612","last_updated":"2025-05-29T01:48:23Z","snapshot_observed_at":"2026-08-07T15:57:20.674591Z","submitted_at":"2025-05-01T15:43:51Z","title":"Position: AI Competitions Provide the Gold Standard for Empirical Rigor in GenAI Evaluation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.00612","snapshot_observed_at":"2026-08-01T16:19:08.637388Z","title":"Sculley, Will Cukierski, Phil Culliton, Sohier Dane, Maggie Demkin, Ryan Holbrook, Addison Howard, Paul Mooney, Walter Reade, Megan Risdal, and Nate Keating","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.637388Z"},"links":{"cited_paper":"/paper/2505.00612","citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:08e90094c9cec40347ff966fca5a8773724615f1e86b9552db38d269ace98d4b","observation_id":"d47b433a-ecdd-4c60-bf5f-c86b2e713985","resolution":{"observed_at":"2026-08-01T16:19:08.637388Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-01T16:19:08.642230Z","title":"Zico Kolter, and Matt Fredrikson","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.642230Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:835a072af7b7b6257d8a90b03be7bd90ac144af5e9373446a338dfa25e1d0078","observation_id":"bb1f7e20-d6c8-44c1-b2c6-e26358957c51","resolution":{"observed_at":"2026-08-01T16:19:08.642230Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:19:08.646941Z","title":"static scanner false positive","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.646941Z"},"links":{"citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:4ba12293707f12a5316ba1ff01989363bdf6b944ab3ae4b9eda2fe33115d84c2","observation_id":"87315c15-adac-4ece-8b2c-ae5182aef1ee","resolution":{"observed_at":"2026-08-01T16:19:08.646941Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:19:08.659588Z","title":"metadata","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.659588Z"},"links":{"citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:27a4298c363b7e3a6ea4ecf6dd2159aed4e76e49cff86a68bf849c5bc4ec4af4","observation_id":"88f25e9e-539c-4864-9000-f8e8b018bb8f","resolution":{"observed_at":"2026-08-01T16:19:08.659588Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:19:08.653322Z","title":"discrimination","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.653322Z"},"links":{"citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:7191a9328d1d0d569d6060cc5bc0193d8e9d3140550ef15bdcc22753d5169eee","observation_id":"2543fac7-c219-41b2-8216-1b93274a14d9","resolution":{"observed_at":"2026-08-01T16:19:08.653322Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-01T16:19:08.626130Z","title":"LLM defenses are not robust to multi-turn human jailbreaks yet.arXiv preprint arXiv:2408.15221,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":1939,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.626130Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:9a011a017d7b84d22b0ea52d2b130b4c4cea538276c518ca9762291879aef722","observation_id":"52be3610-9d22-4093-b472-d455bb546b5d","resolution":{"observed_at":"2026-08-01T16:19:08.626130Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.12173","last_updated":"2023-05-05T14:26:17Z","snapshot_observed_at":"2026-07-06T14:55:08.682906Z","submitted_at":"2023-02-23T17:14:38Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.12173","snapshot_observed_at":"2026-08-01T16:19:08.620825Z","title":"Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection.arXiv preprint arXiv:2302.12173,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":2000,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.620825Z"},"links":{"cited_paper":"/paper/2302.12173","citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:f443024a455c158630d3a66ad9a442d29cf70b83f2924afe0caa3efc61ef267d","observation_id":"a980366c-883e-4df2-b65b-529546b13abb","resolution":{"observed_at":"2026-08-01T16:19:08.620825Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:19:08.609960Z","title":"Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":2023,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.609960Z"},"links":{"citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:2d979ce79615b482862d839eaeedbb5ced061bab790b76210ea3c8f076129541","observation_id":"3e85ae6c-d35b-43d4-a19d-aa88b69d0520","resolution":{"observed_at":"2026-08-01T16:19:08.609960Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-01T16:19:08.615174Z","title":"AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents.arXiv preprint arXiv:2406.13352,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.615174Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:4cbb47b6b5a62437d60e4ea037144fc332df2a6b76fa1d1b3a557fa0dbefe865","observation_id":"20af0eb7-595f-4044-ac48-05c1df91ff6a","resolution":{"observed_at":"2026-08-01T16:19:08.615174Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T16:19:08.598377Z","title":"Breaking agent backbones: Evaluating the security of backbone LLMs in AI agents.arXiv preprint arXiv:2510.22620,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":2025,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.598377Z"},"links":{"citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:abad0f29e84cfb1179982cc5f537a02d0c49f2a4c486bcdef1f4caf7d3ffc692","observation_id":"4128cf2e-4331-435a-ac9f-e32c8e1046d9","resolution":{"observed_at":"2026-08-01T16:19:08.598377Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-01T16:19:08.603833Z","title":"Pappas, and Eric Wong","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":2026,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.603833Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:66679daa21d5b6dadfd5b5646bfe434256181f36c95d0fc314c1ced82611c401","observation_id":"4b301f0e-cb13-4c73-b675-e3ed922cd45a","resolution":{"observed_at":"2026-08-01T16:19:08.603833Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-07T18:42:59.875513Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security"},"reference_resolution":{"displayed":13,"state_counts":{"malformed_identifier":2,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":11,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":13},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 13 of 13 outbound references and 0 inbound Pith citation observations for arXiv:2607.18063."}