{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:RCACBCA77QLGWFJC4VXM5QJQDH","short_pith_number":"pith:RCACBCA7","canonical_record":{"source":{"id":"2503.15547","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-17T05:27:57Z","cross_cats_sorted":["cs.AI","cs.MA"],"title_canon_sha256":"824f5d829e92ce973b13c046ab893ece98aa25efcb5357afd0332c096c240c12","abstract_canon_sha256":"a8d97254e9bbcdc324580acfcf013f06065b9c87844fa9e2f0a71bd46ce14403"},"schema_version":"1.0"},"canonical_sha256":"888020881ffc166b1522e56ecec13019da56f1093fc979ba2bc6bfde69d030be","source":{"kind":"arxiv","id":"2503.15547","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.15547","created_at":"2026-07-05T10:51:34Z"},{"alias_kind":"arxiv_version","alias_value":"2503.15547v2","created_at":"2026-07-05T10:51:34Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.15547","created_at":"2026-07-05T10:51:34Z"},{"alias_kind":"pith_short_12","alias_value":"RCACBCA77QLG","created_at":"2026-07-05T10:51:34Z"},{"alias_kind":"pith_short_16","alias_value":"RCACBCA77QLGWFJC","created_at":"2026-07-05T10:51:34Z"},{"alias_kind":"pith_short_8","alias_value":"RCACBCA7","created_at":"2026-07-05T10:51:34Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:RCACBCA77QLGWFJC4VXM5QJQDH","target":"record","payload":{"canonical_record":{"source":{"id":"2503.15547","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-17T05:27:57Z","cross_cats_sorted":["cs.AI","cs.MA"],"title_canon_sha256":"824f5d829e92ce973b13c046ab893ece98aa25efcb5357afd0332c096c240c12","abstract_canon_sha256":"a8d97254e9bbcdc324580acfcf013f06065b9c87844fa9e2f0a71bd46ce14403"},"schema_version":"1.0"},"canonical_sha256":"888020881ffc166b1522e56ecec13019da56f1093fc979ba2bc6bfde69d030be","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:51:34.706453Z","signature_b64":"NzRedxqyGylkdiEtimk9awzmAfbHSu9qhGAnaPc/qGtig1PDMua2YaLLQGL6d8tIXxpuPRg6nB1I2zxs+BvJDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"888020881ffc166b1522e56ecec13019da56f1093fc979ba2bc6bfde69d030be","last_reissued_at":"2026-07-05T10:51:34.705980Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:51:34.705980Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2503.15547","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:51:34Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"+rlldeoVFIJxIfwWKQQJ2WL0jiyLsGdLksRbmrN+llqZmg5zWWRiLJBWnqICVg+dfU78SRFe+7/kpo/1JkhjBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-27T13:49:14.390306Z"},"content_sha256":"5168c46023de26c31feca494b97776e1e321bf9b8fd11fa8a024b2ca721ea817","schema_version":"1.0","event_id":"sha256:5168c46023de26c31feca494b97776e1e321bf9b8fd11fa8a024b2ca721ea817"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:RCACBCA77QLGWFJC4VXM5QJQDH","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI","cs.MA"],"primary_cat":"cs.CR","authors_text":"Byoungyoung Lee, Juhee Kim, Woohyuk Choi","submitted_at":"2025-03-17T05:27:57Z","abstract_excerpt":"Large Language Models (LLMs) are combined with tools to create powerful LLM agents that provide a wide range of services. Unlike traditional software, LLM agent's behavior is determined at runtime by natural language prompts from either user or tool's data. This flexibility enables a new computing paradigm with unlimited capabilities and programmability, but also introduces new security risks, vulnerable to privilege escalation attacks. Moreover, user prompts are prone to be interpreted in an insecure way by LLM agents, creating non-deterministic behaviors that can be exploited by attackers. T"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.15547","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2503.15547/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:51:34Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"N3Rzya+ujQJ4BDWUXtk+Tz/pyflLEQTTygOWm7XboOE1DGw2nJl4qD75eO6+6mfcBaOm0uTBWcgZ13DbywVWAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-27T13:49:14.390705Z"},"content_sha256":"1cc3401ba8d8425696424b2eef19e3370a6bfea95ec9ae472b877211affaf90f","schema_version":"1.0","event_id":"sha256:1cc3401ba8d8425696424b2eef19e3370a6bfea95ec9ae472b877211affaf90f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/RCACBCA77QLGWFJC4VXM5QJQDH/bundle.json","state_url":"https://pith.science/pith/RCACBCA77QLGWFJC4VXM5QJQDH/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/RCACBCA77QLGWFJC4VXM5QJQDH/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-27T13:49:14Z","links":{"resolver":"https://pith.science/pith/RCACBCA77QLGWFJC4VXM5QJQDH","bundle":"https://pith.science/pith/RCACBCA77QLGWFJC4VXM5QJQDH/bundle.json","state":"https://pith.science/pith/RCACBCA77QLGWFJC4VXM5QJQDH/state.json","well_known_bundle":"https://pith.science/.well-known/pith/RCACBCA77QLGWFJC4VXM5QJQDH/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:RCACBCA77QLGWFJC4VXM5QJQDH","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a8d97254e9bbcdc324580acfcf013f06065b9c87844fa9e2f0a71bd46ce14403","cross_cats_sorted":["cs.AI","cs.MA"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-17T05:27:57Z","title_canon_sha256":"824f5d829e92ce973b13c046ab893ece98aa25efcb5357afd0332c096c240c12"},"schema_version":"1.0","source":{"id":"2503.15547","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2503.15547","created_at":"2026-07-05T10:51:34Z"},{"alias_kind":"arxiv_version","alias_value":"2503.15547v2","created_at":"2026-07-05T10:51:34Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2503.15547","created_at":"2026-07-05T10:51:34Z"},{"alias_kind":"pith_short_12","alias_value":"RCACBCA77QLG","created_at":"2026-07-05T10:51:34Z"},{"alias_kind":"pith_short_16","alias_value":"RCACBCA77QLGWFJC","created_at":"2026-07-05T10:51:34Z"},{"alias_kind":"pith_short_8","alias_value":"RCACBCA7","created_at":"2026-07-05T10:51:34Z"}],"graph_snapshots":[{"event_id":"sha256:1cc3401ba8d8425696424b2eef19e3370a6bfea95ec9ae472b877211affaf90f","target":"graph","created_at":"2026-07-05T10:51:34Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2503.15547/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large Language Models (LLMs) are combined with tools to create powerful LLM agents that provide a wide range of services. Unlike traditional software, LLM agent's behavior is determined at runtime by natural language prompts from either user or tool's data. This flexibility enables a new computing paradigm with unlimited capabilities and programmability, but also introduces new security risks, vulnerable to privilege escalation attacks. Moreover, user prompts are prone to be interpreted in an insecure way by LLM agents, creating non-deterministic behaviors that can be exploited by attackers. T","authors_text":"Byoungyoung Lee, Juhee Kim, Woohyuk Choi","cross_cats":["cs.AI","cs.MA"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-17T05:27:57Z","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2503.15547","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:5168c46023de26c31feca494b97776e1e321bf9b8fd11fa8a024b2ca721ea817","target":"record","created_at":"2026-07-05T10:51:34Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a8d97254e9bbcdc324580acfcf013f06065b9c87844fa9e2f0a71bd46ce14403","cross_cats_sorted":["cs.AI","cs.MA"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-03-17T05:27:57Z","title_canon_sha256":"824f5d829e92ce973b13c046ab893ece98aa25efcb5357afd0332c096c240c12"},"schema_version":"1.0","source":{"id":"2503.15547","kind":"arxiv","version":2}},"canonical_sha256":"888020881ffc166b1522e56ecec13019da56f1093fc979ba2bc6bfde69d030be","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"888020881ffc166b1522e56ecec13019da56f1093fc979ba2bc6bfde69d030be","first_computed_at":"2026-07-05T10:51:34.705980Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:51:34.705980Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"NzRedxqyGylkdiEtimk9awzmAfbHSu9qhGAnaPc/qGtig1PDMua2YaLLQGL6d8tIXxpuPRg6nB1I2zxs+BvJDA==","signature_status":"signed_v1","signed_at":"2026-07-05T10:51:34.706453Z","signed_message":"canonical_sha256_bytes"},"source_id":"2503.15547","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:5168c46023de26c31feca494b97776e1e321bf9b8fd11fa8a024b2ca721ea817","sha256:1cc3401ba8d8425696424b2eef19e3370a6bfea95ec9ae472b877211affaf90f"],"state_sha256":"80c298605668bc9d75033fd48b83064b1feb86939716283640b01e9b925f87d0"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"cky6XEzi+k8+rD+VddndP7pg6T9BfPMx0IEHMsYWOfxVIxCJdTeyA/GwNjGp7VHkOHHakrlffhocGrByXr/YDw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-27T13:49:14.393206Z","bundle_sha256":"e0faa26f209cfbd371d9b3c676f5df41b3b23ff76e33edf6406edd1d9f94ff88"}}