{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:MF5NS7K2O3N5WLPCT5NHLSGZBN","merge_version":"pith-open-graph-merge-v1","event_count":3,"valid_event_count":3,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"50676d3c0a812d7829a9426fce7a12295b792ee81e1d9bdd6d9f4c9ac53f4920","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-26T03:51:20Z","title_canon_sha256":"c9cae3361c1b592788941c21e6f33a8facedfafcbd2b390fce75ce2d21aca000"},"schema_version":"1.0","source":{"id":"2607.23444","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.23444","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"arxiv_version","alias_value":"2607.23444v1","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.23444","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"pith_short_12","alias_value":"MF5NS7K2O3N5","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"pith_short_16","alias_value":"MF5NS7K2O3N5WLPC","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"pith_short_8","alias_value":"MF5NS7K2","created_at":"2026-07-28T01:22:53Z"}],"graph_snapshots":[{"event_id":"sha256:23ee70af6c91024ce6a2ede90dac271151912774704685ef1bf4340240d39c04","target":"graph","created_at":"2026-07-28T01:22:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.23444/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"LLM-based agents extend large language models with long-term memory (LTM) that persists privacy-sensitive user data across sessions. Production systems mitigate extraction risks through memory isolation, binding each user's LTM to a unique identifier. This defense has blocked known attacks on shared storage, fostering the assumption that isolated LTM is secure. We identify the tool interface as an overlooked attack surface. Agents routinely embed LTM-retrieved data in tool invocation parameters, enabling a malicious tool to exfiltrate private memory without violating user-level isolation. Naiv","authors_text":"Chuanchao Zang, Jianing Wang, Li Wang, Shanqing Guo, Wenyu Chen, Xiangtao Meng, Xinyu Gao, Zheng Li","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.23444","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b420ec915813347f27ff24dd29323f8191742f5a8f304b01d804150e7f0e70ab","target":"record","created_at":"2026-07-28T01:22:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"50676d3c0a812d7829a9426fce7a12295b792ee81e1d9bdd6d9f4c9ac53f4920","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-26T03:51:20Z","title_canon_sha256":"c9cae3361c1b592788941c21e6f33a8facedfafcbd2b390fce75ce2d21aca000"},"schema_version":"1.0","source":{"id":"2607.23444","kind":"arxiv","version":1}},"canonical_sha256":"617ad97d5a76dbdb2de29f5a75c8d90b46d1ac5c2209ab9d843fce00202435a2","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"617ad97d5a76dbdb2de29f5a75c8d90b46d1ac5c2209ab9d843fce00202435a2","first_computed_at":"2026-07-28T01:22:53.125324Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-28T01:22:53.125324Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"DP1snJXT5mMIbhNzGbtrMK0WuVmxEgckhRgXS0I09DZCq5+aoGrTUqvMdExrJOcQdB/sY/RBc22ss0GAX9eSAA==","signature_status":"signed_v1","signed_at":"2026-07-28T01:22:53.126128Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.23444","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b420ec915813347f27ff24dd29323f8191742f5a8f304b01d804150e7f0e70ab","sha256:23ee70af6c91024ce6a2ede90dac271151912774704685ef1bf4340240d39c04","sha256:6261fc9266d0c9e4458fee3f6ba330fa9f3a6a677ff3dd572baecbb6bdc3c5c0"],"state_sha256":"1a5e53e85e47189adf7e7ff176122cb3a145c8032d63e9ff885b20b8d1f8aa93"}