{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:IJVOVGIJ7FXKLMSWPS3VVYKTO7","short_pith_number":"pith:IJVOVGIJ","canonical_record":{"source":{"id":"2502.08966","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-13T05:06:22Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"0f0de2c73c932b0c2bf3da779e9b3f7f4fcc4b4729ab2a1ba9159c43e9821e4a","abstract_canon_sha256":"7bd6e960ce881d1534202d737aaac79680d36c562c0741a4c4c6b0c063f226b9"},"schema_version":"1.0"},"canonical_sha256":"426aea9909f96ea5b2567cb75ae15377d5daae7220141c9f3f341695c848d2e1","source":{"kind":"arxiv","id":"2502.08966","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.08966","created_at":"2026-07-05T10:14:09Z"},{"alias_kind":"arxiv_version","alias_value":"2502.08966v2","created_at":"2026-07-05T10:14:09Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.08966","created_at":"2026-07-05T10:14:09Z"},{"alias_kind":"pith_short_12","alias_value":"IJVOVGIJ7FXK","created_at":"2026-07-05T10:14:09Z"},{"alias_kind":"pith_short_16","alias_value":"IJVOVGIJ7FXKLMSW","created_at":"2026-07-05T10:14:09Z"},{"alias_kind":"pith_short_8","alias_value":"IJVOVGIJ","created_at":"2026-07-05T10:14:09Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:IJVOVGIJ7FXKLMSWPS3VVYKTO7","target":"record","payload":{"canonical_record":{"source":{"id":"2502.08966","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-13T05:06:22Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"0f0de2c73c932b0c2bf3da779e9b3f7f4fcc4b4729ab2a1ba9159c43e9821e4a","abstract_canon_sha256":"7bd6e960ce881d1534202d737aaac79680d36c562c0741a4c4c6b0c063f226b9"},"schema_version":"1.0"},"canonical_sha256":"426aea9909f96ea5b2567cb75ae15377d5daae7220141c9f3f341695c848d2e1","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:14:09.156294Z","signature_b64":"L+t4OXP0zePm5XoQ90p9oV7T/tg0rRMlPn1zzU7/3C394VizoKYZgPC0QyggTGfdqrMEoB5akxy8PtDFBpHSBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"426aea9909f96ea5b2567cb75ae15377d5daae7220141c9f3f341695c848d2e1","last_reissued_at":"2026-07-05T10:14:09.155796Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:14:09.155796Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2502.08966","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:14:09Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"orgq538Xf0A8LZBb8JWO45npjdqUAYgBX4G7XtCHBD7e63VrFbe/0aB1Dt1gp8kkG1iSRjj79nRy2b8331dEAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T21:04:17.021333Z"},"content_sha256":"3dee31b72ac1104632b341c8502fa6b93fa5c210ffd5b79fd441b2a8b0526867","schema_version":"1.0","event_id":"sha256:3dee31b72ac1104632b341c8502fa6b93fa5c210ffd5b79fd441b2a8b0526867"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:IJVOVGIJ7FXKLMSWPS3VVYKTO7","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Ben L. Titzer, Heather Miller, McKenna McCall, Peter Yong Zhong, Phillip B. Gibbons, Ruiqi Wang, Siyuan Chen","submitted_at":"2025-02-13T05:06:22Z","abstract_excerpt":"Tool-Based Agent Systems (TBAS) allow Language Models (LMs) to use external tools for tasks beyond their standalone capabilities, such as searching websites, booking flights, or making financial transactions. However, these tools greatly increase the risks of prompt injection attacks, where malicious content hijacks the LM agent to leak confidential data or trigger harmful actions. Existing defenses (OpenAI GPTs) require user confirmation before every tool call, placing onerous burdens on users. We introduce Robust TBAS (RTBAS), which automatically detects and executes tool calls that preserve"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.08966","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2502.08966/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:14:09Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"PjPWVHELMbwU00fe88MVfnxUlJ+JItbyt9jKU2KlJXlNgEC6x63Gm5/VhiFHbVo0BNB1y9G2cdGWj7Rjz4xDBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T21:04:17.021872Z"},"content_sha256":"1a16e4cbd7432e6559f5871670d3f07fc5b4b7ad095366902affcfa33a8c8394","schema_version":"1.0","event_id":"sha256:1a16e4cbd7432e6559f5871670d3f07fc5b4b7ad095366902affcfa33a8c8394"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/IJVOVGIJ7FXKLMSWPS3VVYKTO7/bundle.json","state_url":"https://pith.science/pith/IJVOVGIJ7FXKLMSWPS3VVYKTO7/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/IJVOVGIJ7FXKLMSWPS3VVYKTO7/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-01T21:04:17Z","links":{"resolver":"https://pith.science/pith/IJVOVGIJ7FXKLMSWPS3VVYKTO7","bundle":"https://pith.science/pith/IJVOVGIJ7FXKLMSWPS3VVYKTO7/bundle.json","state":"https://pith.science/pith/IJVOVGIJ7FXKLMSWPS3VVYKTO7/state.json","well_known_bundle":"https://pith.science/.well-known/pith/IJVOVGIJ7FXKLMSWPS3VVYKTO7/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:IJVOVGIJ7FXKLMSWPS3VVYKTO7","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"7bd6e960ce881d1534202d737aaac79680d36c562c0741a4c4c6b0c063f226b9","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-13T05:06:22Z","title_canon_sha256":"0f0de2c73c932b0c2bf3da779e9b3f7f4fcc4b4729ab2a1ba9159c43e9821e4a"},"schema_version":"1.0","source":{"id":"2502.08966","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2502.08966","created_at":"2026-07-05T10:14:09Z"},{"alias_kind":"arxiv_version","alias_value":"2502.08966v2","created_at":"2026-07-05T10:14:09Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2502.08966","created_at":"2026-07-05T10:14:09Z"},{"alias_kind":"pith_short_12","alias_value":"IJVOVGIJ7FXK","created_at":"2026-07-05T10:14:09Z"},{"alias_kind":"pith_short_16","alias_value":"IJVOVGIJ7FXKLMSW","created_at":"2026-07-05T10:14:09Z"},{"alias_kind":"pith_short_8","alias_value":"IJVOVGIJ","created_at":"2026-07-05T10:14:09Z"}],"graph_snapshots":[{"event_id":"sha256:1a16e4cbd7432e6559f5871670d3f07fc5b4b7ad095366902affcfa33a8c8394","target":"graph","created_at":"2026-07-05T10:14:09Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2502.08966/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Tool-Based Agent Systems (TBAS) allow Language Models (LMs) to use external tools for tasks beyond their standalone capabilities, such as searching websites, booking flights, or making financial transactions. However, these tools greatly increase the risks of prompt injection attacks, where malicious content hijacks the LM agent to leak confidential data or trigger harmful actions. Existing defenses (OpenAI GPTs) require user confirmation before every tool call, placing onerous burdens on users. We introduce Robust TBAS (RTBAS), which automatically detects and executes tool calls that preserve","authors_text":"Ben L. Titzer, Heather Miller, McKenna McCall, Peter Yong Zhong, Phillip B. Gibbons, Ruiqi Wang, Siyuan Chen","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2502.08966","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:3dee31b72ac1104632b341c8502fa6b93fa5c210ffd5b79fd441b2a8b0526867","target":"record","created_at":"2026-07-05T10:14:09Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"7bd6e960ce881d1534202d737aaac79680d36c562c0741a4c4c6b0c063f226b9","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-13T05:06:22Z","title_canon_sha256":"0f0de2c73c932b0c2bf3da779e9b3f7f4fcc4b4729ab2a1ba9159c43e9821e4a"},"schema_version":"1.0","source":{"id":"2502.08966","kind":"arxiv","version":2}},"canonical_sha256":"426aea9909f96ea5b2567cb75ae15377d5daae7220141c9f3f341695c848d2e1","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"426aea9909f96ea5b2567cb75ae15377d5daae7220141c9f3f341695c848d2e1","first_computed_at":"2026-07-05T10:14:09.155796Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:14:09.155796Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"L+t4OXP0zePm5XoQ90p9oV7T/tg0rRMlPn1zzU7/3C394VizoKYZgPC0QyggTGfdqrMEoB5akxy8PtDFBpHSBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T10:14:09.156294Z","signed_message":"canonical_sha256_bytes"},"source_id":"2502.08966","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:3dee31b72ac1104632b341c8502fa6b93fa5c210ffd5b79fd441b2a8b0526867","sha256:1a16e4cbd7432e6559f5871670d3f07fc5b4b7ad095366902affcfa33a8c8394"],"state_sha256":"a400a0026434776229f697eeef4d3338243991bb068f9d511742c8afe5f32816"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"j+hXg8MIXrEgHKC244Wyka4ZY2ola5wDhwIgwcZ+xznAJeiqfFKiRwQdHENzjUzZB9edzuh7QA3mMfRf2oIvAg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-01T21:04:17.026008Z","bundle_sha256":"2bfc606f94fb57926b37c058f76b1a8a94c74f9e2fb12454526afd8e43bc9290"}}