{"as_of":"2026-08-08T21:59:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:876b2483598c2656f29ba0551155f04bbf41204f640dbf1589774f46cabe9bc7","coverage":[{"denominator":41,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":41,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-30T22:03:10.012682Z","state":"measured"},{"denominator":41,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":41,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.23444/citation-record","integrity":"/paper/2607.23444/integrity","json":"/paper/2607.23444/citation-record.json","paper":"/paper/2607.23444"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2310.02374","last_updated":"2024-09-25T04:50:38Z","snapshot_observed_at":"2026-07-06T16:27:22.878185Z","submitted_at":"2023-10-03T18:54:10Z","title":"Conversational Health Agents: A Personalized LLM-Powered Agent Framework","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.02374","snapshot_observed_at":"2026-07-30T22:03:09.844930Z","title":"Conversational health agents: A personalized llm-powered agent framework.arXiv preprint arXiv:2310.02374, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.844930Z"},"links":{"cited_paper":"/paper/2310.02374","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:cc19f3faccf673b94ea97862ce3760e8ea34bdccc54cb7ae72ed2d4fbb124550","observation_id":"0ff3621f-4693-4592-95d7-959af7904f44","resolution":{"observed_at":"2026-07-30T22:03:09.844930Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.849969Z","title":"Improving language models by retrieving from trillions of tokens","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.849969Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:e4c54d763ed2f072dae280356e686634096db7a827752ba233b67d646f2a09f9","observation_id":"24f26f39-f193-416d-9ddf-802aae1aaa2c","resolution":{"observed_at":"2026-07-30T22:03:09.849969Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.03109","last_updated":"2023-12-29T02:12:03Z","snapshot_observed_at":"2026-08-05T13:54:21.157165Z","submitted_at":"2023-07-06T16:28:35Z","title":"A Survey on Evaluation of Large Language Models","version":9},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.03109","snapshot_observed_at":"2026-07-30T22:03:09.854321Z","title":"Yu, Qiang Yang, and Xing Xie","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.854321Z"},"links":{"cited_paper":"/paper/2307.03109","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:13fdc9ff389831faae06284d919b7b2bd85d9ecba60b960eedd61c1d825690f1","observation_id":"79b6458b-5939-4a80-aed4-ede442756330","resolution":{"observed_at":"2026-07-30T22:03:09.854321Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.858554Z","title":"Ms marco: Benchmarking ranking models in the large-data regime","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.858554Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:34fef9c5cc286f59e63653b9f6cce44ee52fc68c4f82026e9c3a12742691c80c","observation_id":"3e349ab8-6279-4af2-bde6-e770c740c163","resolution":{"observed_at":"2026-07-30T22:03:09.858554Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.862623Z","title":"Agentdojo: A dynamic en- vironment to evaluate prompt injection attacks and defenses for llm agents.Advances in Neu- ral Information Processing Systems, 37:82895– 82920, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.862623Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:7176b41934651b353ac945594561762f6acfb96ff0cbc0a47836a1df91c1d3ed","observation_id":"1f44e042-625e-4040-9c02-5f0654076a08","resolution":{"observed_at":"2026-07-30T22:03:09.862623Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.12173","last_updated":"2023-05-05T14:26:17Z","snapshot_observed_at":"2026-07-06T14:55:08.682906Z","submitted_at":"2023-02-23T17:14:38Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.12173","snapshot_observed_at":"2026-07-30T22:03:09.866541Z","title":"More than you’ve asked for: A comprehensive analysis of novel prompt injec- tion threats to application-integrated large lan- guage models.arXiv preprint arXiv:2302.12173, 27, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.866541Z"},"links":{"cited_paper":"/paper/2302.12173","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:5a6deb2d3c8b9aeea9552f2bff5a2baccbbebb53187ad67f687470f66fad0e9b","observation_id":"94b76fab-11f4-4057-bcb3-9a884ab8af54","resolution":{"observed_at":"2026-07-30T22:03:09.866541Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.870956Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated appli- cations with indirect prompt injection","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.870956Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:cc08403a2ee2b09eb7cf86eb962a277754357915d4275c6f5503dfb683a6b020","observation_id":"ed4d977a-b3d5-43c5-9c95-8b531d6f5670","resolution":{"observed_at":"2026-07-30T22:03:09.870956Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.874582Z","title":"[Online]","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.874582Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:b6b0b99f27a1cd6a7c85502907a0a6cf7a893cf2d8c737664d165bbc89631a0a","observation_id":"3cc1dcac-86b3-4ca4-8684-cf594a65a26e","resolution":{"observed_at":"2026-07-30T22:03:09.874582Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.14110","last_updated":"2025-08-08T11:56:30Z","snapshot_observed_at":"2026-08-02T10:24:11.927887Z","submitted_at":"2024-11-21T13:18:03Z","title":"Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.14110","snapshot_observed_at":"2026-07-30T22:03:09.878034Z","title":"Rag-thief: Scal- able extraction of private data from retrieval- augmented generation applications with agent- based attacks.arXiv preprint arXiv:2411.14110, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.878034Z"},"links":{"cited_paper":"/paper/2411.14110","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:1dcdff02e3c769f9d2a780553f841bcbbef19e68cfb1b8dc01ef8b123fd5221e","observation_id":"dc13bef8-f132-494f-9f70-d3217d8d8464","resolution":{"observed_at":"2026-07-30T22:03:09.878034Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.882064Z","title":"PhD thesis, OW ASP, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.882064Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:0df396622df2d8a13f47d382657ff6555d0f5bce695b97bfa640b6086457daa8","observation_id":"ee004766-e59d-4baa-a4f3-adbb103f1609","resolution":{"observed_at":"2026-07-30T22:03:09.882064Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.886022Z","title":"Dense passage retrieval for open-domain question answering","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.886022Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:1c6b55bca8d677b3ff3cb48d89993a4fc81b4b9c484ec034ddfe129de77ac87e","observation_id":"e2895147-5c3b-4cf4-82e7-c38046f32136","resolution":{"observed_at":"2026-07-30T22:03:09.886022Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.889779Z","title":"Retrieval- augmented generation for knowledge-intensive nlp tasks.Advances in neural information pro- cessing systems, 33:9459–9474, 2020","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.889779Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:c22efbf82833cff7cac50d10033cd6c2a372091e616d604fd8eee73ec3fec7b5","observation_id":"1429b973-643c-4e35-9e06-1ebed3513628","resolution":{"observed_at":"2026-07-30T22:03:09.889779Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.05459","last_updated":"2024-05-08T06:16:23Z","snapshot_observed_at":"2026-08-02T13:57:57.119489Z","submitted_at":"2024-01-10T09:25:45Z","title":"Personal LLM Agents: Insights and Survey about the Capability, Efficiency and Security","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.05459","snapshot_observed_at":"2026-07-30T22:03:09.897534Z","title":"Personal llm agents: Insights and survey about the ca- pability, efficiency and security, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.897534Z"},"links":{"cited_paper":"/paper/2401.05459","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:752743c709f2d18ce7ac0e04dd30d79b2f9677dba0c7eb5b3e4901dbb2a4ed06","observation_id":"9cc7ce4b-ce16-45de-a9a9-a7a80feab129","resolution":{"observed_at":"2026-07-30T22:03:09.897534Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.04434","last_updated":"2024-06-19T06:04:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-05-07T15:56:43Z","title":"DeepSeek-V2: A Strong, Economical, and Efficient Mixture-of-Experts Language Model","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.04434","snapshot_observed_at":"2026-07-30T22:03:09.901388Z","title":"Deepseek-v2: A strong, economical, and effi- cient mixture-of-experts language model.arXiv preprint arXiv:2405.04434, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.901388Z"},"links":{"cited_paper":"/paper/2405.04434","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:97fa9ad2c6473bdce88db05f7023e88edcf44d3220fc3fba47f685dad5c4bf2f","observation_id":"6e9534df-06d6-4b4f-8b6b-d315db66ea6d","resolution":{"observed_at":"2026-07-30T22:03:09.901388Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.17753","last_updated":"2024-02-27T18:42:31Z","snapshot_observed_at":"2026-08-06T11:15:36.554174Z","submitted_at":"2024-02-27T18:42:31Z","title":"Evaluating Very Long-Term Conversational Memory of LLM Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.17753","snapshot_observed_at":"2026-07-30T22:03:09.905552Z","title":"Evaluating very long-term con- versational memory of llm agents, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.905552Z"},"links":{"cited_paper":"/paper/2402.17753","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:6f8a25d956d7bf17bb0393c9c6552edc984af0263bc0b3598d91a34410ec1445","observation_id":"11fb0b98-4adc-4d5b-9d54-29345a511628","resolution":{"observed_at":"2026-07-30T22:03:09.905552Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.909406Z","title":"Gpt-5-mini, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.909406Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:0b53bb4271d5d8c9a58bd281e45d62bb50c7fb479369a2155be3c75b42d5c496","observation_id":"0bacc32e-4be8-49e2-9f96-795d00d37c59","resolution":{"observed_at":"2026-07-30T22:03:09.909406Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.913185Z","title":"Generative agents: Interac- tive simulacra of human behavior","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.913185Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:f41e424db03d1cb10798e3abfd796b419d6f3605c6733c7ef7b641abe9aa7dc2","observation_id":"5672d02a-aaa7-4fc2-80dd-2c190a5de9dc","resolution":{"observed_at":"2026-07-30T22:03:09.913185Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.917391Z","title":"Gorilla: Large lan- guage model connected with massive apis.Ad- vances in Neural Information Processing Sys- tems, 37:126544–126565, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.917391Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:fc33976641303f9aa82d1fe9ef861c3fbc0abfb841f72316e5d43f430b20ef7e","observation_id":"02a82bf0-7492-42d2-9778-f3656c5918f9","resolution":{"observed_at":"2026-07-30T22:03:09.917391Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.17840","last_updated":"2024-10-06T21:25:41Z","snapshot_observed_at":"2026-08-06T11:51:24.278910Z","submitted_at":"2024-02-27T19:08:05Z","title":"Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systems","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.17840","snapshot_observed_at":"2026-07-30T22:03:09.921668Z","title":"Follow my instruction and spill the beans: Scalable data extraction from retrieval-augmented generation systems.arXiv preprint arXiv:2402.17840, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.921668Z"},"links":{"cited_paper":"/paper/2402.17840","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:6514c79ac5aa0cc6a560194c74cf9488c5dc5b39f5baa480e5bda826ea15041f","observation_id":"481294e0-57d9-480b-b4b1-ffdf9cc66245","resolution":{"observed_at":"2026-07-30T22:03:09.921668Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.925923Z","title":"Tool learning with foundation models.ACM Computing Surveys, 57(4):1–40, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.925923Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:9339355d761276720c2d08fc011dc031407d1dd27884fcf6d05a8754aaba9300","observation_id":"0693efa8-4e72-4866-bd65-9d9ae73a1cf3","resolution":{"observed_at":"2026-07-30T22:03:09.925923Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.929839Z","title":"In-context retrieval- augmented language models.Transactions of the Association for Computational Linguistics, 11:1316–1331, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.929839Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:770dd9ebe15fbf4b10209ef5a08f2031b5b2232af4129ebfc30603ee88328e99","observation_id":"fbe5b2fb-4b3d-42bd-8a84-e262bedb42f2","resolution":{"observed_at":"2026-07-30T22:03:09.929839Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.933657Z","title":"Replug: Retrieval-augmented black-box language mod- els","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.933657Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:9455c9c2593b9b5acb7f7ac62da3436865c54a7f9ac064233522cc54673eaec9","observation_id":"3b4ff696-9d03-4866-84f3-a1d7f2154990","resolution":{"observed_at":"2026-07-30T22:03:09.933657Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.07128","last_updated":"2024-10-04T05:56:56Z","snapshot_observed_at":"2026-08-08T00:41:08.811604Z","submitted_at":"2024-01-13T18:09:05Z","title":"EHRAgent: Code Empowers Large Language Models for Few-shot Complex Tabular Reasoning on Electronic Health Records","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.07128","snapshot_observed_at":"2026-07-30T22:03:09.937895Z","title":"Ehragent: Code empowers large language models for few-shot complex tabular reasoning on electronic health records.arXiv preprint arXiv:2401.07128, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.937895Z"},"links":{"cited_paper":"/paper/2401.07128","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:12acb94e906870ffb3d4150b3fdcd365360060d81070fa276cad7a3dff5cc495","observation_id":"f56cee30-502c-4158-ad75-e1ae8d007922","resolution":{"observed_at":"2026-07-30T22:03:09.937895Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.11805","last_updated":"2025-05-09T21:04:06Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-12-19T02:39:27Z","title":"Gemini: A Family of Highly Capable Multimodal Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.11805","snapshot_observed_at":"2026-07-30T22:03:09.941840Z","title":"Gemini: a fam- ily of highly capable multimodal models.arXiv preprint arXiv:2312.11805, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.941840Z"},"links":{"cited_paper":"/paper/2312.11805","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:0104a1aa6f856b252bdffeffb0e72e6743e01a131a748643746412f5d18478b8","observation_id":"cf60e53c-830d-438f-a7d9-148aba43307b","resolution":{"observed_at":"2026-07-30T22:03:09.941840Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2104.08663","last_updated":"2021-10-21T01:18:28Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2021-04-17T23:29:55Z","title":"BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2104.08663","snapshot_observed_at":"2026-07-30T22:03:09.945696Z","title":"Beir: A heterogenous benchmark for zero-shot eval- uation of information retrieval models.arXiv preprint arXiv:2104.08663, 2021","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.945696Z"},"links":{"cited_paper":"/paper/2104.08663","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:3292d37189728549e6055febf33d675b706fb9dc26aba4279accbc164a9114cf","observation_id":"c9163724-0ec2-4dac-96ac-dcc115debf2b","resolution":{"observed_at":"2026-07-30T22:03:09.945696Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.949819Z","title":"Adapted large language models can out- perform medical experts in clinical text sum- marization.Nature medicine, 30(4):1134–1142, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.949819Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:9814603c46cd61b8069ba857143e89336c7d4dab39a7ed0d606c8dca0cdcaed2","observation_id":"ebb3a6cf-1e08-4d7b-b7ba-7279453c5d97","resolution":{"observed_at":"2026-07-30T22:03:09.949819Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2304.13343","last_updated":"2025-03-18T02:16:56Z","snapshot_observed_at":"2026-08-01T15:59:14.413948Z","submitted_at":"2023-04-26T07:25:31Z","title":"SCM: Enhancing Large Language Model with Self-Controlled Memory Framework","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.13343","snapshot_observed_at":"2026-07-30T22:03:09.953585Z","title":"Enhancing large language model with self-controlled memory framework","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.953585Z"},"links":{"cited_paper":"/paper/2304.13343","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:10a0ea78dcdf31682c61885a913a6f0a3b001ec3ebe40bbde0b3f5409967acbe","observation_id":"92db0fcc-ef49-4083-9498-e462bad3b751","resolution":{"observed_at":"2026-07-30T22:03:09.953585Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.13172","last_updated":"2025-06-03T17:08:56Z","snapshot_observed_at":"2026-08-07T18:11:02.941133Z","submitted_at":"2025-02-17T19:55:53Z","title":"Unveiling Privacy Risks in LLM Agent Memory","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.13172","snapshot_observed_at":"2026-07-30T22:03:09.957580Z","title":"Unveil- ing privacy risks in llm agent memory.arXiv preprint arXiv:2502.13172, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.957580Z"},"links":{"cited_paper":"/paper/2502.13172","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:c56d670e1925040260b2326d22bd327129d44eaa5eac1c06881c1ec762428834","observation_id":"4742da1c-f88c-4a14-b353-4787356bb2bc","resolution":{"observed_at":"2026-07-30T22:03:09.957580Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.961668Z","title":"A survey on large language model based au- tonomous agents.Frontiers of Computer Sci- ence, 18(6), March 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.961668Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:a9666ffcf8a60bd37c537da46c249051f7db6856d242904fc260f8ba88ac8943","observation_id":"2f7d121d-c90b-443c-8792-cbc90581be44","resolution":{"observed_at":"2026-07-30T22:03:09.961668Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.03533","last_updated":"2024-02-22T06:21:51Z","snapshot_observed_at":"2026-07-06T14:27:46.217000Z","submitted_at":"2022-12-07T09:25:54Z","title":"Text Embeddings by Weakly-Supervised Contrastive Pre-training","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.03533","snapshot_observed_at":"2026-07-30T22:03:09.965925Z","title":"Text embeddings by weakly-supervised contrastive pre-training","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.965925Z"},"links":{"cited_paper":"/paper/2212.03533","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:08f1a57325b398fc8fdd1aff5b793100c21a43f5ef559440ddd0dd5dd94731e2","observation_id":"4e78d54f-83b6-4436-99ae-1acd18d6c2a3","resolution":{"observed_at":"2026-07-30T22:03:09.965925Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.970140Z","title":"Silent leaks: Implicit knowledge extraction attack on rag systems through benign queries, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.970140Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:76500f4aecfb07db9e81778d3d04ca3d3be19fb3a7ceeceb34a8ac48e8e92328","observation_id":"c0237fab-34df-47ca-ba6b-67e7e91c09bd","resolution":{"observed_at":"2026-07-30T22:03:09.970140Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.20138","last_updated":"2025-06-03T05:45:06Z","snapshot_observed_at":"2026-07-06T20:14:03.824268Z","submitted_at":"2024-12-28T12:54:06Z","title":"TradingAgents: Multi-Agents LLM Financial Trading Framework","version":7},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.20138","snapshot_observed_at":"2026-07-30T22:03:09.974104Z","title":"Tradingagents: Multi-agents llm fi- nancial trading framework.arXiv preprint arXiv:2412.20138, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.974104Z"},"links":{"cited_paper":"/paper/2412.20138","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:8072a5878883f81ed30d62485ddd54ae01cae9b8b93830f5957363a80242fab2","observation_id":"a322e7d9-fe88-4e01-82f8-537afe86dc8a","resolution":{"observed_at":"2026-07-30T22:03:09.974104Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.978827Z","title":"Watch out for your agents! investigating backdoor threats to llm- based agents.Advances in Neural Information Processing Systems, 37:100938–100964, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.978827Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:b5f607551c710510de1f57c25d3e96c0b134b7b66e932574a25a45e0c68d00b6","observation_id":"ecd4c609-5552-4ea7-8bf6-f6c6bb377b88","resolution":{"observed_at":"2026-07-30T22:03:09.978827Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:09.983079Z","title":"In33rd USENIX Security Symposium (USENIX Secu- rity 24), pages 4657–4674, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.983079Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:7d96a15b8b2c734edf2da89cd85ca2f3d70060023ef85c350ce1b5f77ef21ad0","observation_id":"4824f2e5-cea4-49c5-8991-0ba6fb6bee64","resolution":{"observed_at":"2026-07-30T22:03:09.983079Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.13743","last_updated":"2023-12-03T16:18:55Z","snapshot_observed_at":"2026-07-06T16:51:23.348409Z","submitted_at":"2023-11-23T00:24:40Z","title":"FinMem: A Performance-Enhanced LLM Trading Agent with Layered Memory and Character Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.13743","snapshot_observed_at":"2026-07-30T22:03:09.986954Z","title":"Finmem: A performance-enhanced llm trading agent with layered memory and character de- sign.arXiv preprint arXiv:2311.13743, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.986954Z"},"links":{"cited_paper":"/paper/2311.13743","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:d762ccc943fe1ed0d3a415612f2fc0ecc82a90607f23bd6ed4e4f0454d3cd73b","observation_id":"c57c638d-bcde-4ed5-9cb2-d1d2d9447209","resolution":{"observed_at":"2026-07-30T22:03:09.986954Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16893","last_updated":"2024-02-23T18:35:15Z","snapshot_observed_at":"2026-08-06T15:09:16.339206Z","submitted_at":"2024-02-23T18:35:15Z","title":"The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16893","snapshot_observed_at":"2026-07-30T22:03:09.991328Z","title":"The good and the bad: Exploring privacy issues in retrieval- augmented generation (rag).arXiv preprint arXiv:2402.16893, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.991328Z"},"links":{"cited_paper":"/paper/2402.16893","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:8e47b1035ea03560da75f1acf3f9b383286c0b7fa3306d7613cb74623f12828b","observation_id":"cd0c19f6-e574-447c-b03d-a71434ea876c","resolution":{"observed_at":"2026-07-30T22:03:09.991328Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.02644","last_updated":"2025-05-30T03:50:33Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-03T16:30:47Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.02644","snapshot_observed_at":"2026-07-30T22:03:09.995584Z","title":"Agent security bench (asb): Formalizing and benchmarking at- tacks and defenses in llm-based agents, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.995584Z"},"links":{"cited_paper":"/paper/2410.02644","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:e8db959d02ff278f8ae411ea905752d2858a6bdec5551f25da95f24918c3c01c","observation_id":"245c14bd-6156-45b4-9fb3-078ac453d8bd","resolution":{"observed_at":"2026-07-30T22:03:09.995584Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.11192","last_updated":"2024-09-17T13:48:29Z","snapshot_observed_at":"2026-08-07T21:03:54.191765Z","submitted_at":"2024-09-17T13:48:29Z","title":"Towards Ethical Personal AI Applications: Practical Considerations for AI Assistants with Long-Term Memory","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.11192","snapshot_observed_at":"2026-07-30T22:03:09.999959Z","title":"Towards ethical personal ai ap- plications: Practical considerations for ai assis- tants with long-term memory.arXiv preprint arXiv:2409.11192, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:09.999959Z"},"links":{"cited_paper":"/paper/2409.11192","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:8033f8ec48c3539788281f2b6ca2f3c1e6870a55b008879879db25f615716ffe","observation_id":"c6746fd5-bf8a-4176-824b-62195a6b2901","resolution":{"observed_at":"2026-07-30T22:03:09.999959Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-30T22:03:10.003899Z","title":"Memengine: A unified and modular library for developing ad- vanced memory of llm-based agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:10.003899Z"},"links":{"citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:bc490056cfd01e772b3b759dc918f080e49ea2dda7b6a60fb3fa43bd24566f1b","observation_id":"b28abf9e-bfe4-43c0-b0d8-0880c9ccd3ad","resolution":{"observed_at":"2026-07-30T22:03:10.003899Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.18223","last_updated":"2026-03-18T05:34:39Z","snapshot_observed_at":"2026-08-06T23:27:24.356320Z","submitted_at":"2023-03-31T17:28:46Z","title":"A Survey of Large Language Models","version":19},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.18223","snapshot_observed_at":"2026-07-30T22:03:10.007669Z","title":"A survey of large language models.arXiv preprint arXiv:2303.18223, 1(2), 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:10.007669Z"},"links":{"cited_paper":"/paper/2303.18223","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:7bf0e5f2cd26dc93bc216c4a72d61a1d5a53a4330e8107757510234d2e591117","observation_id":"de4e6206-168c-477d-8dfc-f749f44647f9","resolution":{"observed_at":"2026-07-30T22:03:10.007669Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-07-30T22:03:10.012682Z","title":"Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-07-30T22:03:10.012682Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2607.23444"},"observation_digest":"sha256:3a2440db0e0ba2d3c07de3e88bc9632ab9b2a4235b1475d33336c2e6ea4eafc3","observation_id":"0a14c275-8b1f-4d63-8c94-1ca6153ac1b4","resolution":{"observed_at":"2026-07-30T22:03:10.012682Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.23444","last_updated":"2026-07-26T03:51:20Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-02T21:53:05.560611Z","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents"},"reference_resolution":{"displayed":41,"state_counts":{"malformed_identifier":2,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":39,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":41},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 8 August 2026, this Paper Citation Record lists 41 of 41 outbound references and 0 inbound Pith citation observations for arXiv:2607.23444."}