{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:IW7J2RLIX4H7TBMRKLVS44MVNL","short_pith_number":"pith:IW7J2RLI","canonical_record":{"source":{"id":"2503.00061","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-27T04:04:50Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"05a66c80de22e14475e1e9a710f58730e6d4bafff3a0c6bd91b5f553bc8e2d25","abstract_canon_sha256":"acc331f66e7c14f673537482511e4c86417dd92c8aedc27e34d3be96cca6a162"},"schema_version":"1.0"},"canonical_sha256":"45be9d4568bf0ff9859152eb2e71956af0e12ac7a213e8293b31b906acf9425c","source":{"kind":"arxiv","id":"2503.00061","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.00061","created_at":"2026-07-05T10:23:30Z"},{"alias_kind":"arxiv_version","alias_value":"2503.00061v2","created_at":"2026-07-05T10:23:30Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.00061","created_at":"2026-07-05T10:23:30Z"},{"alias_kind":"pith_short_12","alias_value":"IW7J2RLIX4H7","created_at":"2026-07-05T10:23:30Z"},{"alias_kind":"pith_short_16","alias_value":"IW7J2RLIX4H7TBMR","created_at":"2026-07-05T10:23:30Z"},{"alias_kind":"pith_short_8","alias_value":"IW7J2RLI","created_at":"2026-07-05T10:23:30Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:IW7J2RLIX4H7TBMRKLVS44MVNL","target":"record","payload":{"canonical_record":{"source":{"id":"2503.00061","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-27T04:04:50Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"05a66c80de22e14475e1e9a710f58730e6d4bafff3a0c6bd91b5f553bc8e2d25","abstract_canon_sha256":"acc331f66e7c14f673537482511e4c86417dd92c8aedc27e34d3be96cca6a162"},"schema_version":"1.0"},"canonical_sha256":"45be9d4568bf0ff9859152eb2e71956af0e12ac7a213e8293b31b906acf9425c","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:23:30.396104Z","signature_b64":"cjoerdFmYOe7Kc6q4soaebkvBDhb37o6R9Nh3qIZj+VTJmkjznfSr5q1OJHf3UlgX22Bt23LH85pp93kXmcWCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"45be9d4568bf0ff9859152eb2e71956af0e12ac7a213e8293b31b906acf9425c","last_reissued_at":"2026-07-05T10:23:30.395407Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:23:30.395407Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2503.00061","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:23:30Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"V7DfBV4S88SdqEBSoNslCaMOKCSHjAizla+X0deyGgQwiWmaUrgPXvIIQnnSKBCkctbHRyfNKX3aeyIDlEpuBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T23:12:59.189322Z"},"content_sha256":"6d851700f81de815e43ba5189810232f40ea7c5ad16755ecc3bd68271cc8ddcb","schema_version":"1.0","event_id":"sha256:6d851700f81de815e43ba5189810232f40ea7c5ad16755ecc3bd68271cc8ddcb"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:IW7J2RLIX4H7TBMRKLVS44MVNL","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Daniel Kang, Henil Shalin Panchal, Qiusi Zhan, Richard Fang","submitted_at":"2025-02-27T04:04:50Z","abstract_excerpt":"Large Language Model (LLM) agents exhibit remarkable performance across diverse applications by using external tools to interact with environments. However, integrating external tools introduces security risks, such as indirect prompt injection (IPI) attacks. Despite defenses designed for IPI attacks, their robustness remains questionable due to insufficient testing against adaptive attacks. In this paper, we evaluate eight different defenses and bypass all of them using adaptive attacks, consistently achieving an attack success rate of over 50%. This reveals critical vulnerabilities in curren"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.00061","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2503.00061/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:23:30Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UR7JgdmuJU9XuOijek1Kw4jvyW/aolWfui4gvXtnqKTIufId0xmfkAh5QpXRUsOogB7yeR6zISR+SuSyUrB7Bg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T23:12:59.189843Z"},"content_sha256":"7f0be7de900dfc3dec33b18201c0e09a25fdff69926e57b414515e1b173f4a1c","schema_version":"1.0","event_id":"sha256:7f0be7de900dfc3dec33b18201c0e09a25fdff69926e57b414515e1b173f4a1c"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/IW7J2RLIX4H7TBMRKLVS44MVNL/bundle.json","state_url":"https://pith.science/pith/IW7J2RLIX4H7TBMRKLVS44MVNL/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/IW7J2RLIX4H7TBMRKLVS44MVNL/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T23:12:59Z","links":{"resolver":"https://pith.science/pith/IW7J2RLIX4H7TBMRKLVS44MVNL","bundle":"https://pith.science/pith/IW7J2RLIX4H7TBMRKLVS44MVNL/bundle.json","state":"https://pith.science/pith/IW7J2RLIX4H7TBMRKLVS44MVNL/state.json","well_known_bundle":"https://pith.science/.well-known/pith/IW7J2RLIX4H7TBMRKLVS44MVNL/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:IW7J2RLIX4H7TBMRKLVS44MVNL","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"acc331f66e7c14f673537482511e4c86417dd92c8aedc27e34d3be96cca6a162","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-27T04:04:50Z","title_canon_sha256":"05a66c80de22e14475e1e9a710f58730e6d4bafff3a0c6bd91b5f553bc8e2d25"},"schema_version":"1.0","source":{"id":"2503.00061","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.00061","created_at":"2026-07-05T10:23:30Z"},{"alias_kind":"arxiv_version","alias_value":"2503.00061v2","created_at":"2026-07-05T10:23:30Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.00061","created_at":"2026-07-05T10:23:30Z"},{"alias_kind":"pith_short_12","alias_value":"IW7J2RLIX4H7","created_at":"2026-07-05T10:23:30Z"},{"alias_kind":"pith_short_16","alias_value":"IW7J2RLIX4H7TBMR","created_at":"2026-07-05T10:23:30Z"},{"alias_kind":"pith_short_8","alias_value":"IW7J2RLI","created_at":"2026-07-05T10:23:30Z"}],"graph_snapshots":[{"event_id":"sha256:7f0be7de900dfc3dec33b18201c0e09a25fdff69926e57b414515e1b173f4a1c","target":"graph","created_at":"2026-07-05T10:23:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2503.00061/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large Language Model (LLM) agents exhibit remarkable performance across diverse applications by using external tools to interact with environments. However, integrating external tools introduces security risks, such as indirect prompt injection (IPI) attacks. Despite defenses designed for IPI attacks, their robustness remains questionable due to insufficient testing against adaptive attacks. In this paper, we evaluate eight different defenses and bypass all of them using adaptive attacks, consistently achieving an attack success rate of over 50%. This reveals critical vulnerabilities in curren","authors_text":"Daniel Kang, Henil Shalin Panchal, Qiusi Zhan, Richard Fang","cross_cats":["cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-27T04:04:50Z","title":"Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.00061","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6d851700f81de815e43ba5189810232f40ea7c5ad16755ecc3bd68271cc8ddcb","target":"record","created_at":"2026-07-05T10:23:30Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"acc331f66e7c14f673537482511e4c86417dd92c8aedc27e34d3be96cca6a162","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-02-27T04:04:50Z","title_canon_sha256":"05a66c80de22e14475e1e9a710f58730e6d4bafff3a0c6bd91b5f553bc8e2d25"},"schema_version":"1.0","source":{"id":"2503.00061","kind":"arxiv","version":2}},"canonical_sha256":"45be9d4568bf0ff9859152eb2e71956af0e12ac7a213e8293b31b906acf9425c","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"45be9d4568bf0ff9859152eb2e71956af0e12ac7a213e8293b31b906acf9425c","first_computed_at":"2026-07-05T10:23:30.395407Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:23:30.395407Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"cjoerdFmYOe7Kc6q4soaebkvBDhb37o6R9Nh3qIZj+VTJmkjznfSr5q1OJHf3UlgX22Bt23LH85pp93kXmcWCg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:23:30.396104Z","signed_message":"canonical_sha256_bytes"},"source_id":"2503.00061","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6d851700f81de815e43ba5189810232f40ea7c5ad16755ecc3bd68271cc8ddcb","sha256:7f0be7de900dfc3dec33b18201c0e09a25fdff69926e57b414515e1b173f4a1c"],"state_sha256":"ad608620e4669a725f396484433361fd4eb546ba001396103725c9ae72a342fd"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Wd/eo31931KCo9zX0ns3U09zEVaQXuogSxNzHnU9qWbB0e51uqQlSingeMUCxMGQwdLJkrgC+nXiy+CEt/ilCg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T23:12:59.197848Z","bundle_sha256":"14eb211b9d4e79e158e839ef038c09a8fd860eb738258cb9937d00b307f883a2"}}