Pith. sign in

REVIEW 2 major objections 8 minor 72 references

Persistent Semantic Entities in Tool-Augmented LLM Systems

T0 review · 2 major / 8 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Tool-augmented LLM agents hold hidden state that survives sessions and spreads between agents; name binding is its necessary mechanism, injected preferences and instructions persist undecayed, and external validation mitigates it best.

desk verdict An unusually transparent, reproducible agent-security paper whose main empirical highlight (type-dependent persistence) is solid, but whose headline 'every model is susceptible' rests on a detector the paper itself shows is unreliable for factual scenarios. read the letter →

arxiv 2608.07952 v1 pith:HMCLSWYY submitted 2026-08-08 cs.LG cs.AIcs.CRcs.SE

Zhaohui Wang This is my paper · ORCID
classification cs.LGcs.AIcs.CRcs.SE
keywords persistentsemanticentitiestool-augmentedLLMagentsnamebindingeventtriggeringcross-boundarypropagationcontaminationpersistencetoolregistrysecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Tool-augmented LLM agents can carry implicit, semantic-level state that ordinary debugging cannot see: the paper formalizes this as Persistent Semantic Entities, constructs defined by name binding, event triggering, and cross-boundary propagation. Across 24 models from 11 families, every tested model is susceptible to contamination seeded through these mechanisms (20-100% on the 20-model susceptibility panel), and the mechanism ablation identifies name binding as the necessary and dominant lever: without it, contamination is 0%. Persistence tracks the type of injected content rather than model scale or deployment: preference and instruction contamination stay at 100% through ten turns on every model probed, persona-style injection decays partially, and factual contamination self-corrects on some models but not others. The practical stakes are that preference and instruction contamination persist without self-correction, evade keyword-based detection, and compound $1.9\times$ along a four-stage agent pipeline, making tool registries a poorly monitored attack surface in deployed agent systems.

What carries the argument

The load-bearing object is the Persistent Semantic Entity, defined as a triple $(N, T, P)$: a name binding function $N: S \to H$ mapping string identifiers to execution handlers, an event triggering function $T: V \to 2^S$ mapping runtime events to the sets of bindings they activate, and a propagation function $P: S \times C \to 2^{S \times C}$ mapping (binding, context) pairs to downstream activations. A PSE exhibits persistence when an activation in one context induces an activation in a distinct context without any explicit state transfer, and a resilient system must enforce name-binding integrity, event isolation, and bounded propagation chains. The name binding component carries the argument: in the mechanism ablation every configuration lacking it shows 0% contamination while name binding alone produces 45-95% (Cohen's $d = 3.26$ on one ablation model and 1.37 on the other), so the tool registry is identified as the primary attack surface. Contamination is operationalized as a measurable deviation from expected behavior caused by PSE state, and detection relies on an LLM-as-judge predicate because string matching cannot distinguish adoption of injected content from explicit correction of it.

What would settle it

Run the §4.3 mechanism ablation with a name-free injection channel: seed contamination through a direct event subscription (a handler attached to a lifecycle event with no registry name) or through serialized memory state, keep the rest of the protocol identical, and check whether the no-name-binding arm stays at 0%; any nonzero rate in that arm would falsify the claim that name binding is necessary for PSE contamination.

Watch

Extended reading notes

Core claim

The paper's central claim is that a tool registry is not a passive lookup table but a durable semantic layer: an entity bound to a name outlives the session that created it, can be reactivated by runtime events without explicit invocation, and can propagate to other agents and future sessions through shared registries or serialized state. The author argues this by formalizing a Persistent Semantic Entity as a triple $(N, T, P)$ and then showing experimentally that contamination introduced through these mechanisms appears on every one of 24 tested models with no resolvable scale trend (20-100% across the 20-model panel; $R^2 = 0.25$, $p = 0.256$ on the matched scale sweep), that name binding alone reproduces the effect (45-95% in the ablation) while every configuration without it sits at 0%, and that persistence is governed by contamination type: preference and instruction injections hold at ceiling through turn 10 on every model probed, persona injection decays, and factual injection self-corrects on some models but not others. The paper further claims that defenses fail asymmetrically: self-reflection inside the contaminated context is unreliable and on one model increases contamination, context-isolated self-verification cuts contamination 20-79% without oracle references, and external validation at agent boundaries blocks the four-stage pipeline cascade entirely; it also shows that keyword-based detection systematically mislabels corrective responses as contaminated.

Load-bearing premise

The load-bearing premise is that the paper's injection protocol faithfully represents how contamination enters real agent systems: in the ablation, removing the name-bound injection vector also removes the contamination (as the paper itself notes in §4.3), so if real contamination can arrive through other channels, such as a direct event subscription or saved memory state that carries no registered tool name, the claim that name binding is necessary would not generalize.

Editorial extensions

If this is right

  • Tool name registries become a security boundary: since contamination requires a name binding, registry integrity (authorized-only binding, explicit unbinding, whitelisting) is the primary architectural mitigation.
  • Observability must cover registry mutations, event subscriptions, and propagation edges, not just tool calls and I/O: enhanced logging of this state raises visibility of PSE-relevant activity from 25% to 75%.
  • Defensive effort should concentrate on preference and instruction contamination, the types that persist undecayed and face no parametric resistance, rather than on factual contamination, which at least some models self-correct.
  • Multi-agent deployments need validation at every agent boundary: without it, contamination compounds $1.9\times$ along a four-stage pipeline (40% $\to$ 75%), and external validation blocks the cascade outright.
  • Contamination detection should be semantically aware: judge-based evaluation distinguishes adoption from correction, whereas keyword matching systematically overestimates contamination on factual scenarios.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A test the paper did not run: because §4.3 admits that removing name binding also removes the injection vector, injecting contamination through a name-free channel (a direct event subscription, or serialized memory carrying no registry name) would decide whether name-binding necessity is a property of agent systems or only of this injection design.
  • The type-dependence asymmetry suggests a self-correction frontier worth mapping: contamination should persist when nothing in the model's parametric knowledge contradicts it and decay when it does; probing weakly held or fictional facts could trace that frontier, and the paper's own 20-turn sweep shows the frontier is model-specific.
  • If the model-collapse analogy runs deeper than an analogy, two checkable predictions follow from the four-stage cascade: the $1.9\times$ amplification should grow with pipeline length, and even a weak per-boundary filter should flatten it.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 8 minor

Summary. This paper formalizes Persistent Semantic Entities (PSEs) as triples (N, T, P) capturing name binding, event triggering, and cross-boundary propagation in tool-augmented LLM agents, and reports a 14,293-run corpus across 24 models from 11 families. The headline claims are: (1) every tested model is susceptible (20–100% on the 20-model panel) with name binding as the necessary mechanism, since removing it gives 0% contamination; (2) persistence is type-dependent—preference and instruction contamination persist undecayed through turn 10, persona decays partially, and factual contamination is model-dependent; (3) context-isolated self-verification (CIV) reduces contamination by 20–79% (median 36.5%) without oracle references, keyword detection carries an 83% false-positive rate on factual corrections, and contamination compounds 1.9x along a four-stage pipeline (40% to 75%). The authors also report a 50pp observability improvement from enhanced logging. A notable feature is the paper's selective transparency: several earlier statistics (H1 ANOVA, the factorial interaction, operator utility and half-life columns, a secondary-judge check) are explicitly withdrawn or labeled descriptive, and the released artifacts include a SHA-256 manifest and a verification script that recomputes the run ledger.

Significance. If the susceptibility claim is re-established with judge-based per-model rates, this paper makes a useful contribution to the agent-security literature. It offers a crisp vocabulary for a real class of failure (state that persists through names and events rather than data flow), identifies the tool registry as an under-monitored attack surface, and produces falsifiable, type-dependent persistence patterns and a consistent defense ordering (external validation, CIV, no defense, on every model tested). The practical strengths are the shipped artifacts: a pinned release with a SHA-256 manifest, a verification script that recomputes all run counts, and explicit withdrawal of non-reproducible statistics rather than silent omission. The CIV defense is oracle-free and cheap. The formal sections are labeled interpretive by the authors themselves, which is an appropriate scope choice for an empirical paper. As reported, however, the first headline—the 20–100% susceptibility range and the no-immunity claim—rests on the non-canonical keyword-plus-cosine detector, and the name-binding claim is partly an artifact of the injection protocol; both issues are fixable within the paper's scope.

major comments (2)
  1. [§3.3, §C.1, Table 12/Fig. 3] The 20-model susceptibility panel that supports the headline 'every tested model is susceptible (20–100%)' is scored with keyword matching plus cosine similarity (cos>0.7), the very channel that §3.3 and §C.6 document as having an 83% false-positive rate on factual-correction responses, which constitute 4 of the 10 scenarios (overall Cohen's kappa=0.22 against the LLM judge on n=180). Table 20 confirms that the scaling sweep uses keyword+cosine as its canonical labels, and the released n=180 inter-detector comparison is drawn from the temporal panel rather than from the scaling sweep, so it cannot characterize per-model detector error on the 20-model panel. The internal evidence illustrates the risk: Table 6 (judge-based) reports Llama-3.1-8B at 0% factual contamination because it self-corrects, while Table 12 lists the same model at 100% using a detector that flags corrective responses such as 'NOT Lyon, but Paris' as contaminated because the injected token appears. The 8-model judge-based defense panel (Table 7) does show 35–75% baseline rates on every model, so the qualitative no-immunity pattern may survive, but the 20–100% range and the 20-model claim are not established by the released evidence, and a ±8pp cosine-threshold shift cannot repair a categorical detector error. Because the 1,100-run scaling corpus is part of the released artifact, re-scoring it (or a per-model stratified sample) with the judge and reporting per-model, per-category rates is a feasible fix within the paper's scope.
  2. [§4.3, Abstract, §7] The abstract and conclusion state 'name binding as the necessary and dominant mechanism: without it, contamination is 0%,' but §4.3 itself qualifies the ablation as 'partly by construction, since removing N removes the injection vector.' In this protocol, disabling N removes the only pathway by which contamination is introduced, so the 0% result follows from the injection design rather than from an independent measurement of the models' resistance. The experiment therefore supports 'name binding is the entry vector under this protocol,' not 'name binding is necessary and dominant in general.' The qualitative claim may hold, but the version in the abstract and §7 should carry the §4.3 qualification, and ideally the design should decouple the injection vector from N (for example, delivering contamination through event triggers or serialized state with N toggled independently) so the necessity claim can be tested rather than assumed.
minor comments (8)
  1. [§4.2, §4.7] The H2 observability gap (25% to 75%) is, as §4.2 states, fixed by construction—each logging regime yields a fixed visibility set—yet the §4.7 summary and the contribution list restate it as a finding ('enhanced logging improves observability by 50pp'); please present it as a definitional consequence rather than an empirical result.
  2. [§4.6, Abstract] The phrase 'every model probed' in the abstract's persistence claim covers Llama-3.1-8B at n=10 (Table 6) plus three models at n=5 with unanimous cells (Table 17), so the claim's strength exceeds what the sample sizes support; please state the per-model sample sizes and the wide Wilson intervals directly alongside the claim.
  3. [Table 1] The Table 1 header 'Observ- bdry' and the PSE row entry 'Impl. ✓ 75% miss' appear partially corrupted; please repair the column so the observability contrast is legible.
  4. [§3.2] The indicator function in the contamination-rate estimator is typeset as '⊮', which is a font artifact that should be replaced by a standard 1[·] or bold-one notation.
  5. [§2, Table 23] The 'RAG pollution' row of the run ledger (80 runs, 65% baseline) is not backed by any methodology or results subsection in the appendix; please add its configuration or remove it from the ledger.
  6. [Appendix D.2, Table 22] The M1 re-anchoring formula 'C(h) = αh0 + (1−α)h' loses its subscripts and reads as garbled; please restore the time-indexed notation.
  7. [§4.5, Table 5] The 20–79% reduction range is computed from point estimates in n=20 cells with wide Wilson intervals (for example, Gemini-Flash-Lite's 79% comes from 3/20 versus 14/20); the main text should state this interval-based caveat where the range is first quoted, as §C.2.5 already does for the ordering claim.
  8. [§3.3, Table 3] The primary judge (Gemini-2.0-Flash-Lite) is also the evaluated model in the H3 ablation arm, and the secondary-judge agreement check (kappa=0.88) is reported only descriptively without retained run-level output; please either retain and release that output or run a second judge on the Gemini-FL ablation cells.

Circularity Check

2 steps flagged · score 6.0 of 10

Two headline results—the 50pp observability gap and name-binding necessity—are admitted to be fixed by the experimental constructions; the remaining persistence, defense, and cascade findings are independent measurements.

  1. self definitional [Section 4.2 (H2: Observability Gap), final paragraph]
    "Standard logging captures only 25% of PSE-relevant state; enhanced logging achieves 75%, a 50 percentage point improvement (4,000 runs). Each regime yields a fixed visibility set by construction, so we report this gap descriptively rather than as a significance test."

    The 50pp gap is a restatement of the logging definitions: standard logging is defined to record tool calls, I/O, and errors, while enhanced logging is defined to additionally record registry operations, event triggers, and propagation edges. PSE-relevant state is itself defined as registry/event/propagation state, so excluding that state from standard logging guarantees the 25% figure by construction. The paper's own phrase 'fixed visibility set by construction' concedes that no empirical behavior produced the improvement; the '50 percentage point improvement' is therefore a definitional artifact presented as a finding.

  2. self definitional [Section 4.3 (H3: Mechanism Ablation), Table 3 key findings; abstract and conclusion restate]
    "Key findings: (1) Name binding is the enabling mechanism: without it, contamination is 0% regardless of the other two—partly by construction, since removing N removes the injection vector, so this establishes N as necessary without isolating it as the unique causal lever;"

    The ablation toggles mechanisms under an injection protocol whose contamination vector is the name binding itself. Removing N therefore removes the only route by which contamination is administered, so the 0% in all N-off cells is entailed by experimental design rather than discovered. The paper explicitly says 'partly by construction, since removing N removes the injection vector.' The abstract and conclusion nonetheless headline 'with name binding as the necessary and dominant mechanism: without it, contamination is 0%' and 'name binding is the necessary and dominant contamination mechanism (d=3.26),' dropping the by-construction caveat and presenting a definitionally forced result as the paper's first empirical claim.

full rationale

Two of the paper's core hypotheses reduce to their own definitions, and the paper itself says so. The H2 observability gap ('25% to 75%') is fixed because standard logging is defined to omit the registry/event/propagation state that PSE observability is defined over; the paper concedes 'fixed visibility set by construction.' The H3 name-binding necessity (0% contamination without N) is fixed because the contamination injection vector is removed together with name binding; the paper concedes 'partly by construction, since removing N removes the injection vector.' Both caveats live in the body while the abstract and conclusion restate the unqualified versions, which is why the circularity score is not lower. The score is 6 rather than 8 because substantial independent content remains: temporal persistence is measured with judge-based labels and cross-provider replicates, the CIV/SRV defense comparison is a separate 480-run experiment, and the E3 cascade and E4 tool-injection results do not depend on the two by-construction claims. The scaling-sweep susceptibility headline (20-100%) is threatened by a measurement-validity problem rather than circularity: the sweep uses keyword+cosine as the canonical detector (Table 20), yet the paper documents an 83% false-positive rate for that channel on factual-correction responses; that is a correctness concern, not a definitional reduction, so it is not counted as a circular step here. Self-citations to the author's prior work (MindGuard, MCPTox, Agent Security Bench) appear only in related work, are not invoked as load-bearing support, and no uniqueness theorem is imported from them.

Assumptions & free parameters 2 free parameters · 4 assumptions · 1 invented entities

The central claims rest on a definitional tuple, hand-set thresholds, a non-independent judge, and an injection protocol that may force some results. The authors disclose most of these limitations, but the ledger still limits the strength of the quantitative conclusions.

free parameters (2)
  • contamination threshold tau = 0.05
    Hand-set in §3.2 as the boundary for declaring a system contaminated. All contamination-rate claims inherit this choice.
  • cosine detection threshold = 0.7
    Used as the canonical detection threshold for the scaling sweep. The paper calls it conventional and shows absolute rates shift by ±8pp when swept from 0.5 to 0.9.
assumptions (4)
  • domain assumption Contamination enters only through the three modeled PSE mechanisms, and in the ablation only through name binding or channels attached to it.
    Underlies the headline that removing name binding drops contamination to 0%; the paper acknowledges this is partly by construction in §4.3.
  • domain assumption The LLM-as-judge labels from Gemini-2.0-Flash-Lite are a valid measure of contamination.
    The judge is context-isolated but belongs to a vendor whose models are on the evaluated panel; the paper concedes it cannot claim complete judge independence in §3.3 and Limitations.
  • domain assumption Temperature 0 plus fixed seeds removes sampling randomness, leaving only task-instance variation.
    All inference claims rely on this. Provider-side nondeterminism is checked only on Llama-3.1-8B (§E.2).
  • domain assumption The Rust/Python platform faithfully simulates real agent runtimes so that registry, event, and propagation behavior maps to production frameworks.
    The case studies are mechanism-level reconstructions, not observed incidents, as stated in §5 and Appendix F.
invented entities (1)
  • Persistent Semantic Entity (N,T,P) tuple independent evidence
    purpose: Formalizes name binding, event triggering, and propagation as the defining mechanisms of persistent agent contamination.
    The construct is definitional, but the paper attaches falsifiable predictions to it (type-dependent persistence, 0% contamination without name binding under its injection design) that independent replication could test.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Persistent Semantic Entities in Tool-Augmented LLM Systems." pith.science (2026). https://pith.science/paper/HMCLSWYY

@misc{pith2026260807952,
  author       = {Pith},
  title        = {Pith review of: Persistent Semantic Entities in Tool-Augmented LLM Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HMCLSWYY}},
  note         = {Machine review of arXiv:2608.07952}
}
abstract

Tool-augmented LLM agents can harbor implicit state that persists across sessions, activates through events, and propagates across agent boundaries---largely invisible to standard debugging. We formalize this as Persistent Semantic Entities (PSEs): constructs defined by name binding, event triggering, and cross-boundary propagation, and evaluate them across 24 models from 11 families (1.5B--1T parameters). First, every tested model is susceptible (20--100% on the 20-model susceptibility panel), with name binding as the necessary and dominant mechanism: without it, contamination is 0%. Second, persistence depends on contamination type rather than scale or deployment: preference contamination persists undecayed on every model probed (100% at t=10) and instruction contamination persists wherever adopted, persona-style injection decays partially (90%$\to$10%), while factual injection is model-dependent---self-corrected on Llama-3.1-8B and GPT-4o-mini but held at ceiling on both Qwen2.5-coder variants, so we do not claim it self-corrects in general. The preference and instruction results hold across providers in our controlled setting. Third, context-isolated self-verification achieves 20--79% reduction (median 36.5%) without oracle references while keyword-based detection produces systematic false positives, and contamination compounds 1.9$\times$ along a four-stage agent pipeline (40%$\to$75%). Preference and instruction contamination---persistent, lacking self-correction, and poorly captured by standard monitoring---represent a particularly concerning attack surface for deployed agent systems.

Figures

Figures reproduced from arXiv: 2608.07952 by the authors.

Figure 1
Figure 1. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Behavioral drift from the released 6,000-run H1 arti￾fact. (a) Success rate by run index (no pse blue, pse basic red, pse full green): indistinguishable (74.7%/74.4%/74.6%). (b) Per￾task drift from baseline ( [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. PSE susceptibility vs. model scale, all 20 models from 10 families. Filled circles: the 7 matched-protocol models over which the log-linear regression (dashed) is computed; open squares: remaining panel models run under cost-adjusted n. Error bars: 95% Wilson CI. No statistically resolved scale trend in the matched sweep (R 2 = 0.25, p = 0.256, n = 7); substantial model-specific variation at every scale. Summary: Ac… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: PSE contamination rate vs. model scale (log-scale x-axis), all 20 models (n = 1,100 total runs; per-point values identical to [PITH_FULL_IMAGE:figures/full_fig_p019_4.png]
Figure 5
Figure 5. Figure 5: and [PITH_FULL_IMAGE:figures/full_fig_p021_5.png]
Figure 6
Figure 6. Figure 6: plots the per-type persistence curves; [PITH_FULL_IMAGE:figures/full_fig_p023_6.png]
Figure 7
Figure 7. Figure 7: illustrates the experimental platform architecture. The system consists of two main components: a Rust core providing deterministic PSE behavior, and a Python harness for LLM integration. Rust Core Registry Events Propagation Python Harness LLM Harness Metrics Scenario…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

72 extracted references · 46 canonical work pages

  1. [1]

    Constitutional AI : Harmlessness from AI feedback

    Bai, Y., Kadavath, S., Kundu, S., Askell, A., Kernion, J., Jones, A., Chen, A., Goldie, A., Mirhoseini, A., McKinnon, C., et al. Constitutional AI : Harmlessness from AI feedback. arXiv preprint arXiv:2212.08073, 2022

    arXiv 2022

  2. [2]

    LangChain : Building applications with LLMs through composability

    Chase, H. LangChain : Building applications with LLMs through composability. https://github.com/langchain-ai/langchain, 2023

    work page 2023

  3. [3]

    Teaching large language models to self-debug

    Chen, X., Lin, M., Sch \"a rli, N., and Zhou, D. Teaching large language models to self-debug. In International Conference on Learning Representations, 2024 a

    work page 2024

  4. [4]

    AgentPoison : Red-teaming LLM agents via poisoning memory or knowledge bases

    Chen, Z., Xiang, Z., Xiao, C., Song, D., and Li, B. AgentPoison : Red-teaming LLM agents via poisoning memory or knowledge bases. In Advances in Neural Information Processing Systems, 2024 b

    work page 2024

  5. [5]

    Cover, T. M. and Thomas, J. A. Elements of Information Theory. Wiley-Interscience, 2nd edition, 2006

    work page 2006

  6. [6]

    Memory --- CrewAI documentation

    CrewAI contributors . Memory --- CrewAI documentation. https://docs.crewai.com/concepts/memory, 2024. Documents shared short-term/long-term memory across collaborating agents. Accessed: 2026-08-06

    work page 2024

  7. [7]

    AgentDojo : A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents

    Debenedetti, E., Zhang, J., Balunovi \'c , M., Beurer-Kellner, L., Fischer, M., and Tram \`e r, F. AgentDojo : A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Advances in Neural Information Processing Systems Datasets and Benchmarks Track, 2024

    work page 2024

  8. [8]

    Memory poisoning attack and defense on memory based LLM -agents

    Devarangadi Sunil, B., Sinha, I., Maheshwari, P., Todmal, S., Mallik, S., and Mishra, S. Memory poisoning attack and defense on memory based LLM -agents. arXiv preprint arXiv:2601.05504, 2026

    arXiv 2026

Show all 72 references
  1. [9]

    Memory injection attacks on LLM agents via query-only interaction

    Dong, S., Xu, S., He, P., Li, Y., Tang, J., Liu, T., Liu, H., and Xiang, Z. Memory injection attacks on LLM agents via query-only interaction. In Advances in Neural Information Processing Systems ( NeurIPS ) , 2025. arXiv:2503.03704

    2025

  2. [10]

    The transaction concept: Virtues and limitations

    Gray, J. The transaction concept: Virtues and limitations. Very Large Data Bases, pp.\ 144--154, 1981

    1981

  3. [11]

    Not what you've signed up for: Compromising real-world LLM -integrated applications with indirect prompt injection

    Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., and Fritz, M. Not what you've signed up for: Compromising real-world LLM -integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AIS...

    2023

  4. [12]

    Hong, S., Zhuge, M., Chen, J., Zheng, X., Cheng, Y., Zhang, C., Wang, J., Wang, Z., Yau, S. K. S., Lin, Z., Zhou, L., Ran, C., Xiao, L., Wu, C., and Schmidhuber, J. MetaGPT : Meta programming for a multi-agent collaborative framework. In International Conference on Learning Re...

    2024

  5. [13]

    Khalil, H. K. Nonlinear Systems. Prentice Hall, 3rd edition, 2002

    2002

  6. [14]

    ConversationBufferMemory source, LangChain v0.0.200

    LangChain contributors . ConversationBufferMemory source, LangChain v0.0.200. https://github.com/langchain-ai/langchain/blob/v0.0.200/langchain/memory/buffer.py, 2023. Version-pinned source of the buffer memory class persisting conversation history across chain invocations. Ac...

    2023

  7. [15]

    CrewAI : Framework for orchestrating role-playing autonomous AI agents

    Moura, J. CrewAI : Framework for orchestrating role-playing autonomous AI agents. https://github.com/joaomdmoura/crewAI, 2024

    2024

  8. [16]

    G., Stoica, I., and Gonzalez, J

    Packer, C., Wooders, S., Lin, K., Fang, V., Patil, S. G., Stoica, I., and Gonzalez, J. E. MemGPT : Towards LLMs as operating systems. arXiv preprint arXiv:2310.08560, 2023

    2023 arXiv

  9. [17]

    G., Zhang, T., Wang, X., and Gonzalez, J

    Patil, S. G., Zhang, T., Wang, X., and Gonzalez, J. E. Gorilla : Large language model connected with massive APIs . In Advances in Neural Information Processing Systems, 2024

    2024

  10. [18]

    When LLMs play the telephone game: Cultural attractors as conceptual tools to evaluate LLMs in multi-turn settings

    Perez, J., Kova c , G., L \'e ger, C., Colas, C., Molinaro, G., Derex, M., Oudeyer, P.-Y., and Moulin-Frier, C. When LLMs play the telephone game: Cultural attractors as conceptual tools to evaluate LLMs in multi-turn settings. In International Conference on Learning Represent...

    2025

  11. [19]

    ToolLLM : Facilitating large language models to master 16000+ real-world APIs

    Qin, Y., Liang, S., Ye, Y., Zhu, K., Yan, L., Lu, Y., Lin, Y., Cong, X., Tang, X., Qian, B., et al. ToolLLM : Facilitating large language models to master 16000+ real-world APIs . In International Conference on Learning Representations, 2024

    2024

  12. [20]

    Toolformer : Language models can teach themselves to use tools

    Schick, T., Dwivedi-Yu, J., Dess \` , R., Raileanu, R., Lomeli, M., Zettlemoyer, L., Cancedda, N., and Scialom, T. Toolformer : Language models can teach themselves to use tools. In Advances in Neural Information Processing Systems, 2023

    2023

  13. [21]

    Ignore this title and HackAPrompt : Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition

    Schulhoff, S., Pinto, J., Khan, A., Bouchard, L.-F., Si, C., Anber, S., Tagber, K., Verber, A., Haez, A., Rabel, L., et al. Ignore this title and HackAPrompt : Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition. In Proceedings of the 2023 Con...

    2023

  14. [22]

    AI models collapse when trained on recursively generated data

    Shumailov, I., Shumaylov, Z., Zhao, Y., Gal, Y., Papernot, N., and Anderson, R. AI models collapse when trained on recursively generated data. Nature, 631: 0 755--759, 2024

    2024

  15. [23]

    AutoGPT : An autonomous GPT-4 experiment

    Significant Gravitas . AutoGPT : An autonomous GPT-4 experiment. https://github.com/Significant-Gravitas/AutoGPT, 2023 a . Accessed: 2024-01-15

    2023

  16. [24]

    Auto-GPT-Plugins : Plugins for Auto-GPT

    Significant Gravitas . Auto-GPT-Plugins : Plugins for Auto-GPT . https://github.com/Significant-Gravitas/Auto-GPT-Plugins, 2023 b . Plugin repository; documents that plugins execute arbitrary Python code within the agent process. Accessed: 2026-08-06

    2023

  17. [25]

    The instruction hierarchy: Training LLMs to prioritize privileged instructions

    Wallace, E., Xiao, K., Leike, J., et al. The instruction hierarchy: Training LLMs to prioritize privileged instructions. arXiv preprint arXiv:2404.13208, 2024

    2024 arXiv

  18. [26]

    Unveiling attractor cycles in large language models: A dynamical systems view of successive paraphrasing

    Wang, Y., Li, C., Yan, M., Cheng, Y., and Zhang, W. Unveiling attractor cycles in large language models: A dynamical systems view of successive paraphrasing. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics ( ACL ) , 2025 a

    2025

  19. [27]

    MindGuard : Intrinsic decision inspection for securing LLM agents against metadata poisoning

    Wang, Z., Du, H., Shi, G., Zhang, J., Cheng, H., Yao, Y., Guo, K., and Li, X.-Y. MindGuard : Intrinsic decision inspection for securing LLM agents against metadata poisoning. arXiv preprint arXiv:2508.20412, 2025 b

    2025

  20. [28]

    MCPTox : A benchmark for tool poisoning attack on real-world MCP servers

    Wang, Z., Gao, Y., Wang, Y., Liu, S., Sun, H., Cheng, H., Shi, G., Du, H., and Li, X. MCPTox : A benchmark for tool poisoning attack on real-world MCP servers. arXiv preprint arXiv:2508.14925, 2025 c

    2025 arXiv

  21. [29]

    Jailbroken : How does LLM safety training fail? In Advances in Neural Information Processing Systems, 2023

    Wei, A., Haghtalab, N., and Steinhardt, J. Jailbroken : How does LLM safety training fail? In Advances in Neural Information Processing Systems, 2023

    2023

  22. [30]

    Wilson, E. B. Probable inference, the law of succession, and statistical inference. Journal of the American Statistical Association, 22 0 (158): 0 209--212, 1927

    1927

  23. [31]

    AutoGen : Enabling next-gen LLM applications via multi-agent conversation

    Wu, Q., Bansal, G., Zhang, J., Wu, Y., Zhang, S., Zhu, E., Li, B., Jiang, L., Zhang, X., and Wang, C. AutoGen : Enabling next-gen LLM applications via multi-agent conversation. arXiv preprint arXiv:2308.08155, 2023

    2023 arXiv

  24. [32]

    ReAct : Synergizing reasoning and acting in language models

    Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K., and Cao, Y. ReAct : Synergizing reasoning and acting in language models. In International Conference on Learning Representations, 2023

    2023

  25. [33]

    InjecAgent : Benchmarking indirect prompt injections in tool-integrated large language model agents

    Zhan, Q., Liang, Z., Ying, Z., and Kang, D. InjecAgent : Benchmarking indirect prompt injections in tool-integrated large language model agents. arXiv preprint arXiv:2403.02691, 2024

    2024 arXiv

  26. [34]

    Agent security bench ( ASB ): Formalizing and benchmarking attacks and defenses in LLM -based agents

    Zhang, H., Huang, J., Mei, K., Yao, Y., Wang, Z., Zhan, C., Wang, H., and Zhang, Y. Agent security bench ( ASB ): Formalizing and benchmarking attacks and defenses in LLM -based agents. In International Conference on Learning Representations, 2025

    2025

  27. [35]

    AgentSentry : Mitigating indirect prompt injection in LLM agents via temporal causal diagnostics and context purification

    Zhang, T., Xu, Y., Wang, J., Guo, K., Xu, X., Xiao, B., Guan, Q., Fan, J., Liu, J., Liu, Z., and Hu, H. AgentSentry : Mitigating indirect prompt injection in LLM agents via temporal causal diagnostics and context purification. arXiv preprint arXiv:2602.22724, 2026

    2026

  28. [36]

    Poisoning retrieval corpora by injecting adversarial passages

    Zhong, Z., Huang, Z., Wettig, A., and Chen, D. Poisoning retrieval corpora by injecting adversarial passages. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, 2023. doi:10.18653/v1/2023.emnlp-main.849

    2023 doi

  29. [37]

    PoisonedRAG : Knowledge corruption attacks to retrieval-augmented generation of large language models

    Zou, W., Geng, R., Wang, B., and Jia, J. PoisonedRAG : Knowledge corruption attacks to retrieval-augmented generation of large language models. arXiv preprint arXiv:2402.07867, 2024

    2024 arXiv

  30. [38]

    Advances in Neural Information Processing Systems , year=

    Schick, Timo and Dwivedi-Yu, Jane and Dess. Advances in Neural Information Processing Systems , year=

  31. [39]

    Yao, Shunyu and Zhao, Jeffrey and Yu, Dian and Du, Nan and Shafran, Izhak and Narasimhan, Karthik and Cao, Yuan , booktitle=

  32. [40]

    Chen, Zhaorun and Xiang, Zhen and Xiao, Chaowei and Song, Dawn and Li, Bo , booktitle=

  33. [41]

    Agent Security Bench (

    Zhang, Hanrong and Huang, Jingyuan and Mei, Kai and Yao, Yifei and Wang, Zhenting and Zhan, Chenlu and Wang, Hongwei and Zhang, Yongfeng , booktitle=. Agent Security Bench (

  34. [42]

    Memory Poisoning Attack and Defense on Memory Based

    Devarangadi Sunil, Balachandra and Sinha, Isheeta and Maheshwari, Piyush and Todmal, Shantanu and Mallik, Shreyan and Mishra, Shuchi , journal=. Memory Poisoning Attack and Defense on Memory Based

  35. [43]

    Qin, Yujia and Liang, Shihao and Ye, Yining and Zhu, Kunlun and Yan, Lan and Lu, Yaxi and Lin, Yankai and Cong, Xin and Tang, Xiangru and Qian, Bill and others , booktitle=

  36. [44]

    Patil, Shishir G and Zhang, Tianjun and Wang, Xin and Gonzalez, Joseph E , booktitle=

  37. [45]

    Wu, Qingyun and Bansal, Gagan and Zhang, Jieyu and Wu, Yiran and Zhang, Shaokun and Zhu, Erkang and Li, Beibin and Jiang, Li and Zhang, Xiaoyun and Wang, Chi , journal=

  38. [46]

    International Conference on Learning Representations , year=

    Hong, Sirui and Zhuge, Mingchen and Chen, Jiaqi and Zheng, Xiawu and Cheng, Yuheng and Zhang, Ceyao and Wang, Jinlin and Wang, Zili and Yau, Steven Ka Shing and Lin, Zijuan and Zhou, Liyang and Ran, Chenyu and Xiao, Lingfeng and Wu, Chenglin and Schmidhuber, J. International C...

  39. [47]

    International Conference on Learning Representations , year=

    Teaching Large Language Models to Self-Debug , author=. International Conference on Learning Representations , year=

  40. [48]

    Ignore This Title and

    Schulhoff, Sander and Pinto, Jeremy and Khan, Anaum and Bouchard, Louis-Fran. Ignore This Title and. Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing , pages=

    2023

  41. [49]

    Wei, Alexander and Haghtalab, Nika and Steinhardt, Jacob , booktitle=

  42. [50]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (

    Unveiling Attractor Cycles in Large Language Models: A Dynamical Systems View of Successive Paraphrasing , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (

  43. [51]

    Shumailov, Ilia and Shumaylov, Zakhar and Zhao, Yiren and Gal, Yarin and Papernot, Nicolas and Anderson, Ross , journal=

  44. [52]

    Perez, J. When. International Conference on Learning Representations , year=

  45. [53]

    Very Large Data Bases , pages=

    The transaction concept: Virtues and limitations , author=. Very Large Data Bases , pages=

  46. [54]

    Not what you've signed up for: Compromising real-world

    Greshake, Kai and Abdelnabi, Sahar and Mishra, Shailesh and Endres, Christoph and Holz, Thorsten and Fritz, Mario , booktitle=. Not what you've signed up for: Compromising real-world. 2023 , doi=

    2023

  47. [55]

    The instruction hierarchy: Training

    Wallace, Eric and Xiao, Kai and Leike, Jan and others , journal=. The instruction hierarchy: Training

  48. [56]

    Zou, Wei and Geng, Runpeng and Wang, Binghui and Jia, Jinyuan , journal=

  49. [57]

    Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing , year=

    Poisoning retrieval corpora by injecting adversarial passages , author=. Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing , year=

    2023

  50. [58]

    Packer, Charles and Wooders, Sarah and Lin, Kevin and Fang, Vivian and Patil, Shishir G and Stoica, Ion and Gonzalez, Joseph E , journal=

  51. [59]

    Chase, Harrison , year=

  52. [60]

    2023 , howpublished=

    2023

  53. [61]

    2024 , howpublished=

    Moura, Jo. 2024 , howpublished=

    2024

  54. [62]

    2002 , publisher=

    Nonlinear Systems , author=. 2002 , publisher=

    2002

  55. [63]

    2006 , publisher=

    Elements of Information Theory , author=. 2006 , publisher=

    2006

  56. [64]

    Journal of the American Statistical Association , volume=

    Probable inference, the law of succession, and statistical inference , author=. Journal of the American Statistical Association , volume=

  57. [65]

    Advances in Neural Information Processing Systems Datasets and Benchmarks Track , year=

    Debenedetti, Edoardo and Zhang, Jie and Balunovi. Advances in Neural Information Processing Systems Datasets and Benchmarks Track , year=

  58. [66]

    Zhan, Qiusi and Liang, Zhixiang and Ying, Zifan and Kang, Daniel , journal=

  59. [67]

    Constitutional

    Bai, Yuntao and Kadavath, Saurav and Kundu, Sandipan and Askell, Amanda and Kernion, Jackson and Jones, Andy and Chen, Anna and Goldie, Anna and Mirhoseini, Azalia and McKinnon, Cameron and others , journal=. Constitutional

  60. [68]

    Memory Injection Attacks on

    Dong, Shen and Xu, Shaochen and He, Pengfei and Li, Yige and Tang, Jiliang and Liu, Tianming and Liu, Hui and Xiang, Zhen , booktitle=. Memory Injection Attacks on. 2025 , note=

    2025

  61. [69]

    Wang, Zhiqiang and Gao, Yichao and Wang, Yanting and Liu, Suyuan and Sun, Haifeng and Cheng, Haoran and Shi, Guanquan and Du, Haohua and Li, Xiangyang , journal=

  62. [70]

    Zhang, Tian and Xu, Yiwei and Wang, Juan and Guo, Keyan and Xu, Xiaoyang and Xiao, Bowen and Guan, Quanlong and Fan, Jinlin and Liu, Jiawei and Liu, Zhiquan and Hu, Hongxin , journal=

  63. [71]

    Wang, Zhiqiang and Du, Haohua and Shi, Guanquan and Zhang, Junyang and Cheng, HaoRan and Yao, Yunhao and Guo, Kaiwen and Li, Xiang-Yang , journal=

  64. [72]

    2024 , howpublished=

    Memory ---. 2024 , howpublished=

    2024

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.