{"as_of":"2026-08-10T05:10:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:b285a803de66b471f1890e4bdb8d610f009a243557e4b332a7fec8a04ff6240d","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":11,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":11,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":11,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":11,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-08T20:06:58.253925Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-05-19T11:32:17.365821Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-08-08T20:06:58.253925Z","title":"H., Chen, P.-Y., et al","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-08T19:58:38.598603Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-08T20:06:58.253925Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2502.05174"},"observation_digest":"sha256:4856de2ede3492687d156759b678bad906c15d7639d1d1270c089d18d9a4636e","observation_id":"b1dc6c89-9d97-48be-a6eb-b3b54354f6ec","resolution":{"observed_at":"2026-08-08T20:06:58.253925Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-08-07T14:36:10.402453Z","title":"Hsu, and Pin-Y u Chen","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18333","last_updated":"2025-05-23T19:39:56Z","snapshot_observed_at":"2026-08-07T14:30:46.734293Z","submitted_at":"2025-05-23T19:39:56Z","title":"A Critical Evaluation of Defenses against Prompt Injection Attacks","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T14:36:10.402453Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2505.18333"},"observation_digest":"sha256:0af5c327dfc75afb9d84c16ab5bdf6e745b5486466c1c7113206a758e0095943","observation_id":"5c9caa73-c550-4fb1-b7d7-82c0db51c642","resolution":{"observed_at":"2026-08-07T14:36:10.402453Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":"2411.00348","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Attention tracker: Detecting prompt injection attacks in llms","venue":null,"work_id":"da1f38f3-85bc-4459-a377-dd769954a983","year":2024},"citing_paper":{"arxiv_id":"2506.02546","last_updated":"2026-04-14T05:32:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-06-03T07:32:57Z","title":"To trust or not to trust: Attention-based Trust Management for LLM Multi-Agent Systems","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-19T11:30:47.877793Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2506.02546"},"observation_digest":"sha256:6bbe3807d2b5e37ded51b67f71e0c243490209b8155ae116a0ad5d08ab3c764d","observation_id":"4202bd62-c2d9-4d7b-beb3-a6ac69f92f39","resolution":{"observed_at":"2026-05-19T11:32:17.369840Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-08-06T15:42:00.939667Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.15219","last_updated":"2025-07-21T03:41:44Z","snapshot_observed_at":"2026-08-06T15:35:31.690602Z","submitted_at":"2025-07-21T03:41:44Z","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","version":1},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-06T15:42:00.939667Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2507.15219"},"observation_digest":"sha256:670a1dcd553f599e2f4ed971a140b16985cbc6b99f913d69b17c345782b7c298","observation_id":"d136625b-8bd1-4eca-bba9-5c2b2a346ec9","resolution":{"observed_at":"2026-08-06T15:42:00.939667Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-08-04T17:46:19.348770Z","title":"Attention tracker: Detecting prompt injection attacks in LLMs,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.10682","last_updated":"2025-09-12T20:26:16Z","snapshot_observed_at":"2026-08-09T23:59:45.617391Z","submitted_at":"2025-09-12T20:26:16Z","title":"LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems","version":1},"reference_index":138,"source":"pdf_text","source_observed_at":"2026-08-04T17:46:19.348770Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2509.10682"},"observation_digest":"sha256:9dc998958dd5bad2852bd6388b5934aa120683af972af2f4f695a31c9c379432","observation_id":"199f599f-cb57-4f3f-a049-4b9c0a226e6f","resolution":{"observed_at":"2026-08-04T17:46:19.348770Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":"2411.00348","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Attention tracker: Detecting prompt injection attacks in llms","venue":null,"work_id":"da1f38f3-85bc-4459-a377-dd769954a983","year":2024},"citing_paper":{"arxiv_id":"2509.22040","last_updated":"2026-04-28T01:43:32Z","snapshot_observed_at":"2026-08-02T08:19:00.747753Z","submitted_at":"2025-09-26T08:20:54Z","title":"\"Your AI, My Shell\": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-18T13:20:15.306308Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2509.22040"},"observation_digest":"sha256:66fb6d395e763e2b2e5c7184515b678d2d3b8c87a910b761481d832d5f5845cb","observation_id":"248afb0b-0ca2-471d-abe0-9de54cbc5646","resolution":{"observed_at":"2026-05-18T13:21:23.911602Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":"2411.00348","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Attention tracker: Detecting prompt injection attacks in llms","venue":null,"work_id":"da1f38f3-85bc-4459-a377-dd769954a983","year":2024},"citing_paper":{"arxiv_id":"2510.23883","last_updated":"2026-04-03T16:27:34Z","snapshot_observed_at":"2026-08-02T13:42:34.526072Z","submitted_at":"2025-10-27T21:48:11Z","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","version":3},"reference_index":257,"source":"pdf_text","source_observed_at":"2026-05-18T03:42:10.703369Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2510.23883"},"observation_digest":"sha256:8c6fe8c1e7b442231bd35d99ea8e7db983354c43e5c5855329a9db9d253fe3a4","observation_id":"00e475aa-87d6-4d9f-965e-fd4c1cf38d61","resolution":{"observed_at":"2026-05-18T03:42:22.128264Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":"2411.00348","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Attention tracker: Detecting prompt injection attacks in llms","venue":null,"work_id":"da1f38f3-85bc-4459-a377-dd769954a983","year":2024},"citing_paper":{"arxiv_id":"2604.22888","last_updated":"2026-04-24T09:07:05Z","snapshot_observed_at":"2026-07-06T23:09:10.050398Z","submitted_at":"2026-04-24T09:07:05Z","title":"RouteGuard: Internal-Signal Detection of Skill Poisoning in LLM Agents","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-05-08T11:26:53.382527Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2604.22888"},"observation_digest":"sha256:7b0c815b3799c69e872042d055f3284fc5b569d319d12dfd4a65da60c95b80f1","observation_id":"912f9482-4e2b-4461-a64e-b36e6e79c930","resolution":{"observed_at":"2026-05-11T19:36:14.821338Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-08-02T08:55:49.080193Z","title":"Detecting Prompt Injection Attacks in LLMs","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.19396","last_updated":"2026-08-02T14:07:20Z","snapshot_observed_at":"2026-08-09T02:34:30.861611Z","submitted_at":"2026-07-03T14:24:26Z","title":"CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-02T08:55:49.080193Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2607.19396"},"observation_digest":"sha256:aa39b4e9681e2327f1948892032cb69d2020ee58b475431286ef9fd080c422fa","observation_id":"95298756-5175-4b61-906e-358c289ec709","resolution":{"observed_at":"2026-08-02T08:55:49.080193Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-08-04T04:34:33.174989Z","title":"Detecting Prompt Injection Attacks in LLMs","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.19396","last_updated":"2026-08-02T14:07:20Z","snapshot_observed_at":"2026-08-09T02:34:30.861611Z","submitted_at":"2026-07-03T14:24:26Z","title":"CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-04T04:34:33.174989Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2607.19396"},"observation_digest":"sha256:34f6b94516923e90eca74424c43e163bd5b27af29a38e2cfd254d4f87400a74d","observation_id":"fd443f65-e50b-4d29-a4f1-52610b00f23f","resolution":{"observed_at":"2026-08-04T04:34:33.174989Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-08-08T13:19:01.828427Z","title":"H.; and Chen, P.-Y","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.05430","last_updated":"2026-08-05T21:44:44Z","snapshot_observed_at":"2026-08-09T23:10:49.394955Z","submitted_at":"2026-08-05T21:44:44Z","title":"Robust Context-Aware Detection of Malicious Instructions in Text","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-08T13:19:01.828427Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2608.05430"},"observation_digest":"sha256:6a67c5140f66579c45a543693ba05a93bd947b963499d444fc700e660f51d00f","observation_id":"cdaa89bd-2b9c-4ff3-a50c-39c6a14e9f57","resolution":{"observed_at":"2026-08-08T13:19:01.828427Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2411.00348/citation-record","integrity":"/paper/2411.00348/integrity","json":"/paper/2411.00348/citation-record.json","paper":"/paper/2411.00348"},"outbound":[],"paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-06T19:43:23.653382Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 11 inbound Pith citation observations for arXiv:2411.00348."}