{"as_of":"2026-08-22T23:09:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:6a8f0a1ed06b1d4342f69568b6ccf692ec09538369108ac684d8b9448af2e2d4","coverage":[{"denominator":49,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":49,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-12T00:37:02.534015Z","state":"measured"},{"denominator":49,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":49,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-22T06:32:14.747728+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.08027/citation-record","integrity":"/paper/2608.08027/integrity","json":"/paper/2608.08027/citation-record.json","paper":"/paper/2608.08027"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2303.18223","last_updated":"2026-03-18T05:34:39Z","snapshot_observed_at":"2026-08-14T10:40:26.323157Z","submitted_at":"2023-03-31T17:28:46Z","title":"A Survey of Large Language Models","version":19},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.18223","snapshot_observed_at":"2026-08-12T00:37:02.403278Z","title":"A survey of large language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.403278Z"},"links":{"cited_paper":"/paper/2303.18223","citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:f9a40b630ea52dd2f02f296473f3c6f167287573a548cab975de44017af480ba","observation_id":"affd7774-c9fa-4050-9dc8-21b095188d5c","resolution":{"observed_at":"2026-08-12T00:37:02.403278Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.407355Z","title":"Formalizing and benchmarking prompt injection attacks and defenses,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.407355Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:bd6c84c84c78312e92d52a0839142a8473986d77c69af7ff5672ab4865ba0547","observation_id":"5bfd5039-8f75-4a61-bf84-6add7e7ebaf7","resolution":{"observed_at":"2026-08-12T00:37:02.407355Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.972374Z","title":"OW ASP top 10 for large language model applications,","venue":null,"work_id":"d74d72b3-9940-40be-9863-74f4f7d498d1","year":2023},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.410406Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:1241b91b1365df4cb04e15741d26694833b1bafa3ea89a10fede1d7b387995b1","observation_id":"1d712126-7fb5-4736-87bb-c28c34b4a3c9","resolution":{"observed_at":"2026-08-12T00:37:02.975164Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.964557Z","title":"Delimiters won’t save you from prompt injection,","venue":null,"work_id":"2589b67d-c1fa-4ee5-9074-d4f86ffbb405","year":null},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.413519Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:da69ccc47d51c1b88df61785a4ff853f8c4e9d498dfd906a2db8d9165437a721","observation_id":"8b7c1f00-ab62-47ff-9097-0d75c5385042","resolution":{"observed_at":"2026-08-12T00:37:02.967850Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.949487Z","title":"Sandwich defense,","venue":null,"work_id":"4636df6f-dfd2-49a2-9dae-94be91bfb5bb","year":2023},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.419425Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:bc3022388759a6d4fb9446169feb1640be6a4ad0daa8f19a249b74adfc91062c","observation_id":"3c495ea6-a1db-492c-a99a-53a67b454344","resolution":{"observed_at":"2026-08-12T00:37:02.952098Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.941825Z","title":"Instruction defense,","venue":null,"work_id":"4e638ba2-bee7-43cc-a3a3-4206af68d49b","year":2023},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.422389Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:dbb3254e440b2e20b1628397e285cfbbcee6c55b81402741e14a677a3edbce6a","observation_id":"9faf0654-c4c9-4ff9-bf63-7f2339053561","resolution":{"observed_at":"2026-08-12T00:37:02.944538Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.933751Z","title":"Prompt-guard-86m,","venue":null,"work_id":"56fd9608-e3bd-4907-859e-772bbaa394ce","year":2024},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.425600Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:7cd7976ecf4f95af4523e0c13df90e75b3baabd1f908a1eac0139d7f7a9e308a","observation_id":"3ef082e4-a440-4fb6-9df3-e375e6f9a1a3","resolution":{"observed_at":"2026-08-12T00:37:02.936715Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.926172Z","title":"Fine-tuned deberta-v3-base for prompt injection detection,","venue":null,"work_id":"b19f183f-cc4c-4e8c-bc88-33e141119f8a","year":2024},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.428096Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:a3132d762ed5f101796263d8ba3b6e1fbdc82abb301a8b25574023eefe3a78a5","observation_id":"3fd2f2d0-cba3-41bc-9869-7399d53d36bd","resolution":{"observed_at":"2026-08-12T00:37:02.928960Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.918430Z","title":"Signed-prompt: A new approach to prevent prompt injection attacks against llm-integrated applications,","venue":null,"work_id":"a23f033d-4c59-4bd8-9b85-1329ff4a0c2e","year":2024},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.430524Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:39e99ffb1fe32f53acf5177a2ea691a4bdf9faa660aa297977fa790021ff9bee","observation_id":"bf0ffde1-fe28-41ea-be07-379142738bdf","resolution":{"observed_at":"2026-08-12T00:37:02.921412Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.433308Z","title":"Attention tracker: Detecting prompt injection attacks in llms,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.433308Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:223bd43c6853cf18023d586edbbbfd33149d1ece2fb830d8779fbcb3530c5ca2","observation_id":"1bd8d7e8-3662-455a-bb52-40974ff9b358","resolution":{"observed_at":"2026-08-12T00:37:02.433308Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.22770","last_updated":"2025-03-30T16:39:15Z","snapshot_observed_at":"2026-08-18T17:14:27.472806Z","submitted_at":"2024-10-30T07:39:42Z","title":"InjecGuard: Benchmarking and Mitigating Over-defense in Prompt Injection Guardrail Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.22770","snapshot_observed_at":"2026-08-12T00:37:02.435811Z","title":"Injecguard: Benchmarking and mitigating over-defense in prompt injection guardrail models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.435811Z"},"links":{"cited_paper":"/paper/2410.22770","citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:4302d19fe1c2c2b68558566f80c1923034eec3c5de6a6b865e389e15431969c5","observation_id":"217f530d-ceed-4699-a3a1-6e4ea54d8d22","resolution":{"observed_at":"2026-08-12T00:37:02.435811Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.906335Z","title":"Piguard: Prompt injection guardrail via mitigating overdefense for free,","venue":null,"work_id":"5e141c21-3a51-4855-a8b7-950677e14084","year":2025},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.438313Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:aed026409d0428d8f8b5f08fb1c68fd60a04fd3072ee45b77da2a837aa7e4f03","observation_id":"46f822c2-6291-4a46-9a9a-a5d397edea0d","resolution":{"observed_at":"2026-08-12T00:37:02.909766Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.898625Z","title":"Securing LLM systems against prompt injec- tion,","venue":null,"work_id":"b3159a83-4147-48bf-aade-3f5631315027","year":2023},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.440400Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:3395bcbea9a603f97c2baf9468e02c2c9688c336abaecc97496b461df848e715","observation_id":"690294cf-0e4b-431c-9802-24a9a8caee98","resolution":{"observed_at":"2026-08-12T00:37:02.901585Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.891618Z","title":"Prompt injection attacks against GPT-3,","venue":null,"work_id":"09cffb47-e42c-4760-9202-845a5386110d","year":2022},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.442458Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:8bf702fd12b82454ba552723c487d34ed23b0bfb43b794b96ba76d8150b7583f","observation_id":"000d4c6b-4b4e-4344-b710-d51afa8cdad8","resolution":{"observed_at":"2026-08-12T00:37:02.893977Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-12T00:37:02.444749Z","title":"Universal and transferable adversarial attacks on aligned language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.444749Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:dc0ad480bec6e4aa31a35cd1b76d9c2f84d7605f89cdd065377ab0a1a133dd18","observation_id":"93c60bfb-083d-4478-a0de-a297b3afb12a","resolution":{"observed_at":"2026-08-12T00:37:02.444749Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.884143Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models,","venue":null,"work_id":"2cf713f1-e713-4cb4-b972-501737317163","year":2024},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.447166Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:176b58c2c080322dce214df22748e67c0f4015d1c6ba3bd4fd29441335905d64","observation_id":"74b273c7-1791-4886-8fb5-4878fa68b026","resolution":{"observed_at":"2026-08-12T00:37:02.887185Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.449530Z","title":"x.com — x.com,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.449530Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:3227d878aaecf41c901f09aa5d6c58567f1ac8b6d011d6672dd74c1b35aa15e0","observation_id":"74bd7a97-b3b4-4fb4-b79f-3e78d57a2076","resolution":{"observed_at":"2026-08-12T00:37:02.449530Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1610.01644","last_updated":"2018-11-22T23:40:00Z","snapshot_observed_at":"2026-08-09T22:50:03.459615Z","submitted_at":"2016-10-05T20:59:01Z","title":"Understanding intermediate layers using linear classifier probes","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1610.01644","snapshot_observed_at":"2026-08-12T00:37:02.452001Z","title":"Understanding intermediate layers using linear classifier probes,","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.452001Z"},"links":{"cited_paper":"/paper/1610.01644","citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:0a0172e0d67863088f388323d681ea47b6587f30c8c14bbdcc368bd1d170d532","observation_id":"3e5b6a83-baaa-4a28-925a-086bab7c0e50","resolution":{"observed_at":"2026-08-12T00:37:02.452001Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.454969Z","title":"Probing classifiers: Promises, shortcomings, and ad- vances,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.454969Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:7c053de4b71a25b36ab2c646c61d14a400acbb257205f14f635f3eba94955923","observation_id":"62bdad09-b8ec-4a9b-9c1e-37e5aaf7a2f1","resolution":{"observed_at":"2026-08-12T00:37:02.454969Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.11895","last_updated":"2022-09-24T00:43:19Z","snapshot_observed_at":"2026-08-18T21:12:50.808922Z","submitted_at":"2022-09-24T00:43:19Z","title":"In-context Learning and Induction Heads","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.11895","snapshot_observed_at":"2026-08-12T00:37:02.457319Z","title":"In-context learning and induction heads,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.457319Z"},"links":{"cited_paper":"/paper/2209.11895","citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:e22c9231c87d566fe57c55cfd5212640a1bd7b4bb600c0e71422ed61b58c5cc6","observation_id":"c7dabdcc-db6f-47d0-8272-aba8ad2cf329","resolution":{"observed_at":"2026-08-12T00:37:02.457319Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.872440Z","title":"Retrieval head mecha- nistically explains long-context factuality,","venue":null,"work_id":"ae940694-dcc8-4733-9ead-aad317414666","year":2025},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.460216Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:d31b126bfa0668d796d1d823a171091ff0a20cca409501af9ae7dd9f073e0e1b","observation_id":"1ef72592-bcbb-4ed1-a36a-4e91c77063e6","resolution":{"observed_at":"2026-08-12T00:37:02.875217Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.864154Z","title":"Regularization and variable selection via the elastic net,","venue":null,"work_id":"8fb99fa3-a303-40e6-b152-e2ec1b2c05c6","year":2005},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.462658Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:47e3ebf864dc66a3891edecf6644f04709f2e7e3a1b336b1139a4fe51bccc5e8","observation_id":"08fce25b-1352-446e-92cf-624c2991a22c","resolution":{"observed_at":"2026-08-12T00:37:02.867287Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.465278Z","title":"Recursive deep models for semantic compositionality over a sentiment treebank,","venue":null,"work_id":null,"year":2013},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.465278Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:6511fe8113a2384b7b8307ad13a73c9de32c2528c4705d224e66158a7d8b567e","observation_id":"c86b8ca2-80eb-494d-82be-fc87b786ec82","resolution":{"observed_at":"2026-08-12T00:37:02.465278Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.852422Z","title":"Foundation","venue":null,"work_id":"3b08a9f9-e7a7-44fd-a16d-c2829d1e970b","year":2019},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.467887Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:647c83bb45ba26ff57b3d15211ed40c61de23dccdfb81221d21a180abd12a0c1","observation_id":"05cc63a6-7251-452d-8fca-643a07d0ac3a","resolution":{"observed_at":"2026-08-12T00:37:02.855394Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.844426Z","title":"Don’t give me the details, just the summary! topic-aware convolutional neural networks for extreme summarization,","venue":null,"work_id":"e89e55d9-ef75-4a67-95c6-353cf606d96f","year":2018},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.470380Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:f20dc94572f83580851f8a8c484de9721d3adf7bea7725b7d8356b01743ec940","observation_id":"28f3d2c0-9db7-4df9-a7ad-c299296739a0","resolution":{"observed_at":"2026-08-12T00:37:02.847466Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.836280Z","title":"Squad: 100,000+ questions for machine comprehension of text,","venue":null,"work_id":"0d810285-96de-4821-b3ee-b2dbf4702ca4","year":2016},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.473170Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:86a94895f5f583700332c88dae426619882a70da16bccca51e190c68195baab8","observation_id":"8d817112-e822-4279-9920-a4a37b1dd169","resolution":{"observed_at":"2026-08-12T00:37:02.839498Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-08-18T00:11:55.170013Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-08-12T00:37:02.476057Z","title":"Ignore previous prompt: Attack techniques for language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.476057Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:9a1b654a84844ffce6ca0443af23556172506d078f86c149c9871e642a635802","observation_id":"a0121950-8fea-4a9e-825c-d2975bc2bf5e","resolution":{"observed_at":"2026-08-12T00:37:02.476057Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-12T00:37:02.479512Z","title":"Llama 2: Open foundation and fine-tuned chat models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.479512Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:b7ce287b9792bd86c68a6393517d77e99c29b3599c73d7523dd0d5c9045d2fae","observation_id":"2f50e9b5-c29f-4cd3-968c-2f403ed13af4","resolution":{"observed_at":"2026-08-12T00:37:02.479512Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-08-20T21:11:43.445033Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-08-12T00:37:02.482345Z","title":"Defending against indirect prompt injection attacks with spotlighting,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.482345Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:6350b72c49aaa33bc2869f159470b69d2ec6debe8fc3984bf9dfb79769e355fc","observation_id":"8e5e477e-be3f-422d-ae2c-de826c268565","resolution":{"observed_at":"2026-08-12T00:37:02.482345Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.485394Z","title":"Prompt programming for large language models: Beyond the few-shot paradigm,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.485394Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:852bda72cd6ef2314b3c6940e9afbc35d84a011f623214c9a3d1c9994744aed8","observation_id":"ccacb7c5-127f-44a3-b503-0f802982fd12","resolution":{"observed_at":"2026-08-12T00:37:02.485394Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.09388","last_updated":"2025-05-14T13:41:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-05-14T13:41:34Z","title":"Qwen3 Technical Report","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.09388","snapshot_observed_at":"2026-08-12T00:37:02.488314Z","title":"Qwen3 technical report,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.488314Z"},"links":{"cited_paper":"/paper/2505.09388","citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:baba882d578b0d49aacf62046a9f3e86d5b9f389584fd7119c140bddd2939a80","observation_id":"0da2a6ea-a9c5-4e93-92ae-1a6a8c19ed30","resolution":{"observed_at":"2026-08-12T00:37:02.488314Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.491177Z","title":"Team, “Gemma,” 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.491177Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:518bbae98bc9a40e53e7abb24fa7bed13227218b34f5bc887bb723ceada60f0c","observation_id":"95d9d1f7-da07-4fef-9f58-7bd1ed0ceea4","resolution":{"observed_at":"2026-08-12T00:37:02.491177Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-08-13T17:20:44.002518Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-08-12T00:37:02.494454Z","title":"The llama 3 herd of models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.494454Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:865f9b156e83b1400b7426bdbee18aa3e83e43335ad26955e2079e7c3efbe3cf","observation_id":"8e05a92c-9589-4af0-a618-64eeaa2375fc","resolution":{"observed_at":"2026-08-12T00:37:02.494454Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.820572Z","title":"Mistral-nemo-instruct-2407,","venue":null,"work_id":"57ff4e49-e67f-414b-85c3-6a333fb4d38b","year":2024},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.497464Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:3da2929e1494f5c11280deb0d6aa67d8851601f214bf58ffb1b3d88ae6196626","observation_id":"67e34488-9820-4136-a5a7-07074b96da0f","resolution":{"observed_at":"2026-08-12T00:37:02.823394Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.13860","last_updated":"2024-03-10T13:58:08Z","snapshot_observed_at":"2026-08-19T22:25:04.062400Z","submitted_at":"2023-05-23T09:33:38Z","title":"Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.13860","snapshot_observed_at":"2026-08-12T00:37:02.500159Z","title":"Jailbreaking chatgpt via prompt engineering: An empirical study,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.500159Z"},"links":{"cited_paper":"/paper/2305.13860","citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:388c13692fe6d5957079b194780d864130362125dd829321f5c55bc22ffaf2f1","observation_id":"d53a7dea-10e5-4d0f-861b-45c50f50e580","resolution":{"observed_at":"2026-08-12T00:37:02.500159Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.812936Z","title":"”do anything now","venue":null,"work_id":"819a6f76-f613-459c-b11c-4ae4b2bd7e01","year":2024},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.503118Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:77d9a5ac050949e5bbbfab1fb22a35943ec1452b3db3d6a5ca798ae8a48a723d","observation_id":"882902e1-2a6d-492b-bfd2-d57635407841","resolution":{"observed_at":"2026-08-12T00:37:02.815720Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.804919Z","title":"Ignore this title and hackaprompt: Exposing systemic vulnerabilities of llms through a global prompt hacking competition,","venue":null,"work_id":"0b61e0a1-3f17-4316-afd6-06361693e928","year":2023},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.505632Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:33d6e6fd2f5048872586ecb3333612e85ba5cd06585c77e3cf111a45db7f45f8","observation_id":"497259d6-83fa-4e43-ad64-f17e7987c085","resolution":{"observed_at":"2026-08-12T00:37:02.808053Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.508173Z","title":"Scikit-learn: Machine learning in python,","venue":null,"work_id":null,"year":2011},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.508173Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:924a9c789ce46cad1d650e925604b963742116426b72a82d13de7ae8d7ee5218","observation_id":"7fc2e783-097f-4d9f-8e10-4341c9aefb57","resolution":{"observed_at":"2026-08-12T00:37:02.508173Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.791034Z","title":"sklearn.linear model.LogisticRegression,","venue":null,"work_id":"29f4fdbc-87e4-4625-a1c4-b9b70c55364e","year":null},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.510582Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:dde22769e80f891e0b467c33c43cc37d348ac589b95dcdccfc1175f5f396c3de","observation_id":"116331e2-f4ea-4982-8a05-28b4f2df9200","resolution":{"observed_at":"2026-08-12T00:37:02.794326Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.773554Z","title":"Transformers: State-of- the-art natural language processing,","venue":null,"work_id":"a4963761-1c46-49be-9fde-83e36fb733aa","year":2020},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.515609Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:9a5fe9e9e6886c3d28c15c4da763ff22c7afb5d4fcc8c85553e1901ba296893f","observation_id":"12613e14-77dc-487c-aa1f-c2611f90e198","resolution":{"observed_at":"2026-08-12T00:37:02.776374Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.766385Z","title":"Positive","venue":null,"work_id":"63976e29-fb44-4b76-b64a-1e34ac4079fc","year":2021},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.518021Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:4395a93f81bd78d5a919247083f3e12e0c9d151f1311be60e1a06836b909fb9e","observation_id":"588eea50-311a-4c81-a896-f928d719086e","resolution":{"observed_at":"2026-08-12T00:37:02.769251Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.758072Z","title":"Format: Output only the Chinese translation","venue":null,"work_id":"1faed42f-fe15-4186-82b4-2bcde78eb864","year":null},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.520454Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:0ade9d5adc797a97f31ad58bcb851781a1b9d32361a3a243caa2f10cd90eea14","observation_id":"d413e9c4-beeb-41ca-90df-859e16de5204","resolution":{"observed_at":"2026-08-12T00:37:02.761236Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.749219Z","title":"Format: Output only a 2-3 sentence summary","venue":null,"work_id":"e3c5816d-ee47-4ff5-8819-68f1008c8c06","year":2021},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.522951Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:2c26e3a7a556d91666f2bd135c33674151afa7554cc3b01d7acd58c69fcf868a","observation_id":"01b5a6bf-1711-4120-9c64-b28f8db1a63a","resolution":{"observed_at":"2026-08-12T00:37:02.752800Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.741245Z","title":"Not mentioned","venue":null,"work_id":"8dcf4bcd-f954-40e3-8ec5-167d72b136d1","year":2021},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.525359Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:804087678f2a8ab11deea46c9a7c09a00d66ba5842df4a057a952ce7aabe414a","observation_id":"0bfba195-c095-482a-9610-e992830e177a","resolution":{"observed_at":"2026-08-12T00:37:02.744175Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.732562Z","title":"ignore previous instructions","venue":null,"work_id":"7e714691-d113-4c3b-9efd-419dcc4eb4b6","year":2021},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.528102Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:b5bd7a50c91306a122fad2537f88c65f0969b0ea93b599dc881b01c28f82c068","observation_id":"a3a5a0e6-eb62-4e81-9fdf-650f7e987fe2","resolution":{"observed_at":"2026-08-12T00:37:02.735636Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.724050Z","title":null,"venue":null,"work_id":"6559be1c-2a27-4f6c-9fda-765ff18f562c","year":null},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.530777Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:501825b296afd57b59918ec364d35bcdb34ae81ec590b44f64dcdf91e4dccccb","observation_id":"e15cf449-8db5-47aa-acab-43bd14c3a54c","resolution":{"observed_at":"2026-08-12T00:37:02.727073Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.714544Z","title":null,"venue":null,"work_id":"9179bab9-5dff-4353-ade8-b73f1625a2a5","year":null},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.534015Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:521ea07b9f20e9d99929fb427c1f20746ab487c27aabdff8dbc4b50b1c864c79","observation_id":"7c266ef6-b9dd-4e8c-a515-563ffd8de2b7","resolution":{"observed_at":"2026-08-12T00:37:02.718484Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.957016Z","title":"Available: https://simonwillison.net/2023/May/11/ delimiters-wont-save-you/","venue":null,"work_id":"70e0dc91-5428-430f-bae9-a7c235ca528f","year":2023},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":2023,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.416479Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:932de2f89fbc11e922506e2a644efbd2671e0789993ad084e8e49e4ce783e4ad","observation_id":"7d6db094-71d1-4e9f-890e-29bf69055ccc","resolution":{"observed_at":"2026-08-12T00:37:02.959892Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:37:02.782257Z","title":"Available: https://scikit-learn.org/stable/modules/ generated/sklearn.linear model.LogisticRegression.html","venue":null,"work_id":"7b4e5ab9-f5c1-46ae-8533-17ec45e2c37e","year":null},"citing_paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","version":1},"reference_index":2026,"source":"pdf_text","source_observed_at":"2026-08-12T00:37:02.512951Z"},"links":{"citing_paper":"/paper/2608.08027"},"observation_digest":"sha256:543e579bc2ffa3d9b4ea76c2e83aae69cdd7b6f19223f5e464f4c338c8a91aa6","observation_id":"91bc80c4-86ee-4578-a22a-76ef79b88646","resolution":{"observed_at":"2026-08-12T00:37:02.785284Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-22T06:32:14.747728+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2608.08027","last_updated":"2026-08-08T09:32:07Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-20T18:32:15.471793Z","submitted_at":"2026-08-08T09:32:07Z","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes"},"reference_resolution":{"displayed":49,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":20,"verified_exact":0,"verified_fuzzy":28},"total_outbound_references":49},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"thesis":"As of 22 August 2026, this Paper Citation Record lists 49 of 49 outbound references and 0 inbound Pith citation observations for arXiv:2608.08027."}