{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:7INWFZMMYQACZUD4T7ZAFOHH4S","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"adcf22a51061f26565c9bffdbf6821aebc066c19bc1a8a9e125fe3d83ce4003d","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-01T12:00:33Z","title_canon_sha256":"04b0a3991cdf41d9ae0c29bae7925065fabbae929f7c32ab56190ab100ba3f82"},"schema_version":"1.0","source":{"id":"2608.02657","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.02657","created_at":"2026-08-05T00:38:12Z"},{"alias_kind":"arxiv_version","alias_value":"2608.02657v1","created_at":"2026-08-05T00:38:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.02657","created_at":"2026-08-05T00:38:12Z"},{"alias_kind":"pith_short_12","alias_value":"7INWFZMMYQAC","created_at":"2026-08-05T00:38:12Z"},{"alias_kind":"pith_short_16","alias_value":"7INWFZMMYQACZUD4","created_at":"2026-08-05T00:38:12Z"},{"alias_kind":"pith_short_8","alias_value":"7INWFZMM","created_at":"2026-08-05T00:38:12Z"}],"graph_snapshots":[{"event_id":"sha256:7e82660560d649bace3b61fb731cf8b9b09d13a3e66603aa1ae6ede555cd82f1","target":"graph","created_at":"2026-08-05T00:38:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2608.02657/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Agentic LLMs are vulnerable to indirect prompt injection (IPI) attacks, e.g., malicious side-tasks hidden in external tool results. While many efforts have sought to address the threats, little is known about the internals of agentic LLMs when they are exposed to IPI attacks, a condition which we call IPI exposure. In this paper, we study this problem in depth from three aspects. (1) Probing: Across six models, including the giant 753B-parameter GLM-5.2, simple linear probes trained on pre-generation hidden states can predict LLMs' IPI exposure. These probes achieve 90%+ AUROC on unseen attack","authors_text":"Han Qiu, Jianshuo Dong, Jie Zhang, Maosen Zhang, Nan Deng, Tianwei Zhang, Xiaoping Zhang, Xu Peng, Yiming Liu","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.02657","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:8c0579732dd0819b940242c2a1639100ce3888c222add2221917da9d033d8e4e","target":"record","created_at":"2026-08-05T00:38:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"adcf22a51061f26565c9bffdbf6821aebc066c19bc1a8a9e125fe3d83ce4003d","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-01T12:00:33Z","title_canon_sha256":"04b0a3991cdf41d9ae0c29bae7925065fabbae929f7c32ab56190ab100ba3f82"},"schema_version":"1.0","source":{"id":"2608.02657","kind":"arxiv","version":1}},"canonical_sha256":"fa1b62e58cc4002cd07c9ff202b8e7e491f87c9008a58d689a20e2755194f74b","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"fa1b62e58cc4002cd07c9ff202b8e7e491f87c9008a58d689a20e2755194f74b","first_computed_at":"2026-08-05T00:38:12.909821Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-08-05T00:38:12.909821Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"HjI23ctOi5o+I2YdagxNCBY9RcRTKXRPv/UUowou/jEZYsP1W/B3r0WkFtkHmYwQrTbyySElGDGMEdy8hGeaAw==","signature_status":"signed_v1","signed_at":"2026-08-05T00:38:12.912299Z","signed_message":"canonical_sha256_bytes"},"source_id":"2608.02657","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:8c0579732dd0819b940242c2a1639100ce3888c222add2221917da9d033d8e4e","sha256:7e82660560d649bace3b61fb731cf8b9b09d13a3e66603aa1ae6ede555cd82f1"],"state_sha256":"6bf94e4547ef06ba4b9a2356c2dcdd7d5427fd6b3127905d1bfdd390a2fab2bc"}