{"as_of":"2026-08-18T14:26:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:6ee3860575266f36bfb541ce1cb5c81f5224b2f2aad61db32afcec28f33f992d","coverage":[{"denominator":183,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":100,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-12T16:26:48.676389Z","state":"measured"},{"denominator":101,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":101,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-18T06:34:40.430872+00:00","state":"measured"},{"denominator":1,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-16T05:46:02.165244Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-08-16T05:46:02.337420Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"cited_work":{"arxiv_id":"2411.13459","doi":null,"metadata_source":"pith","pith_arxiv_id":"2411.13459","snapshot_observed_at":"2026-08-16T05:46:02.337420Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","venue":"cs.CR","work_id":"f73623af-a9cf-4965-acb6-9470ea00f190","year":2024},"citing_paper":{"arxiv_id":"2504.19855","last_updated":"2025-04-29T02:52:54Z","snapshot_observed_at":"2026-08-18T02:00:51.986997Z","submitted_at":"2025-04-28T14:48:00Z","title":"The Automation Advantage in AI Red Teaming","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-16T05:46:02.165244Z"},"links":{"cited_paper":"/paper/2411.13459","citing_paper":"/paper/2504.19855"},"observation_digest":"sha256:7487b4586f3db0944fee30bc3584488d26e637ecde15d1330c80e11e4444c0db","observation_id":"79275b3b-6ba2-441e-b010-e343497b6a48","resolution":{"observed_at":"2026-08-16T05:46:02.343105Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2411.13459/citation-record","integrity":"/paper/2411.13459/integrity","json":"/paper/2411.13459/citation-record.json","paper":"/paper/2411.13459"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.581985Z","title":"Chatgpt","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.581985Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:85cc7b0f27c0763f4d2be6e4d608f837cd1236529d4a7d238e94b8b4c2cae35d","observation_id":"1d17ed6a-3366-4383-8ad2-b54beb828302","resolution":{"observed_at":"2026-08-12T16:26:47.581985Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.596405Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.596405Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:fdd75be416b5e7a84dbe1d4feee9dcb256443ab7384dd4a80fe477fc50596180","observation_id":"7f01b204-8f3b-4f9a-be43-d7e34c5f8bf2","resolution":{"observed_at":"2026-08-12T16:26:47.596405Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.603644Z","title":"Copilot","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.603644Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:823518b1f220dc4d8cb055f0c9c7484308743e8e6c2a01753197dd6c4ffd0fe4","observation_id":"2fd8c185-aab8-471a-a86f-60564ed38176","resolution":{"observed_at":"2026-08-12T16:26:47.603644Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.612376Z","title":"Autopilot and full self-driving (supervised) — tesla support","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.612376Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:9f54ad5722000703aa0e184f306eed8a33ff37f79465368afbc6f921cb9b6978","observation_id":"dad5238a-3b3f-4907-9961-e2e0635d5ab3","resolution":{"observed_at":"2026-08-12T16:26:47.612376Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.619694Z","title":"Ocr software, data extraction tool - amazon textract - aws","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.619694Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:168e579e2b40ffda4c7f6ccd76ebec62a2a6c6de64cc308829f261d9d18e13a9","observation_id":"ec675b08-ab3d-43c3-9bae-8a305dca1ab7","resolution":{"observed_at":"2026-08-12T16:26:47.619694Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.625607Z","title":"Membership inference attacks against machine learning models,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.625607Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:27b756b7cd8e36db311787f6e418732ea3a3888ed0bfa40a6da4cedd7e871f28","observation_id":"33ffdc73-91a2-4068-a711-b6652d764da9","resolution":{"observed_at":"2026-08-12T16:26:47.625607Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.632974Z","title":"Stealing machine learning models via prediction {APIs},","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.632974Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:e47f989f7a8de5bbf321aedab499a7a7b4c5b8ba31e8009547945436e3335ea5","observation_id":"3623de56-1558-4e47-8628-c21f79548049","resolution":{"observed_at":"2026-08-12T16:26:47.632974Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.643899Z","title":"Model recon- struction from model explanations,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.643899Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:aae566824f52e79fca73f45de451e3e44b1a1512cab527c1a108b121ee64831d","observation_id":"37fbd553-7ace-48c2-8922-aee8964aef4d","resolution":{"observed_at":"2026-08-12T16:26:47.643899Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.653966Z","title":"A comprehensive survey on poisoning attacks and countermeasures in machine learning,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.653966Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:ef436ef705c1cde6aa1104f12ebc709aa30dd1c083698f71b2ec80d873231c80","observation_id":"557c188d-75e8-4192-b5e0-51b8f1138795","resolution":{"observed_at":"2026-08-12T16:26:47.653966Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.665966Z","title":"Dnn model theft through trojan side-channel on edge fpga accelerator,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.665966Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:f3474f83c1ea987b359253e9831470bd46d17a134f10dc3b0515509e361d1df4","observation_id":"489d4c49-8f46-4ef2-b7b4-a870bbbaa300","resolution":{"observed_at":"2026-08-12T16:26:47.665966Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2007.06751","last_updated":"2020-07-15T01:29:55Z","snapshot_observed_at":"2026-08-14T13:13:36.316811Z","submitted_at":"2020-07-14T00:59:28Z","title":"SESAME: Software defined Enclaves to Secure Inference Accelerators with Multi-tenant Execution","version":2},"cited_work":{"arxiv_id":"2007.06751","doi":null,"metadata_source":"pith","pith_arxiv_id":"2007.06751","snapshot_observed_at":"2026-08-12T16:26:50.174972Z","title":"SESAME: Software defined Enclaves to Secure Inference Accelerators with Multi-tenant Execution","venue":"cs.CR","work_id":"48a1ea75-c8c6-40aa-b54a-fa7de89df95f","year":2020},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.674655Z"},"links":{"cited_paper":"/paper/2007.06751","citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:b8e601ec2149711c5eaca5e0804d35fc942040dc965bc698c6c068db633a61f1","observation_id":"204e6b4e-8c75-4c38-b125-6446f16503ae","resolution":{"observed_at":"2026-08-12T16:26:50.185176Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.686525Z","title":"Triton: Software-defined threat model for secure multi-tenant ml inference accelerators,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.686525Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:31777bd58cfc08070408f5ae22503c8982607353b814984473eee22e6bad7945","observation_id":"2c803071-fa07-4468-bb83-b674efee5103","resolution":{"observed_at":"2026-08-12T16:26:47.686525Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.705494Z","title":"Prada: protecting against dnn model stealing attacks,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.705494Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:2b44e0797df6346551188d23e5c15f3d7f4d4d413544e9ae3464155478329007","observation_id":"0ca00561-6bfc-4401-80fb-f35653897198","resolution":{"observed_at":"2026-08-12T16:26:47.705494Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.726397Z","title":"Machine un- learning,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.726397Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:d5dca57b8b1afa34e943620a1d34ee5a77c643477a386b39a782142396b91a85","observation_id":"06f9fe30-71ee-46ce-912f-366bea2cf12d","resolution":{"observed_at":"2026-08-12T16:26:47.726397Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.736618Z","title":"Strong data augmenta- tion sanitizes poisoning and backdoor attacks without an accuracy tradeoff,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.736618Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:7566bb1d3fb81f33c5f5685f94b189edac4bec6f08cd339376e44814e9b9455e","observation_id":"a748a3f0-90a9-45c4-a2b9-8bef5c150b0c","resolution":{"observed_at":"2026-08-12T16:26:47.736618Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.744887Z","title":"Privacy side channels in machine learning systems,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.744887Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:2c32b65607f441334ddbebc81caa141f6c02631b26660d2bf5f0c67bccc2234a","observation_id":"53e21c43-9069-44a0-b7df-cd9616216253","resolution":{"observed_at":"2026-08-12T16:26:47.744887Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.760858Z","title":"The shift from models to compound ai systems","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.760858Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:5616b9072108d84681d2941256fba0984a971441eee56f7cde0b27d2de0a7b9c","observation_id":"2c529706-eb42-4fc0-8b29-2c301376cffb","resolution":{"observed_at":"2026-08-12T16:26:47.760858Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.767417Z","title":"Langchain framework","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.767417Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:7e614bb03170f94ac149df338812894a652a05982590938b5f7451c2506742bd","observation_id":"064ee7b0-6077-426c-a3ee-19a2d482a331","resolution":{"observed_at":"2026-08-12T16:26:47.767417Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.781561Z","title":"Pytorch","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.781561Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:0d664db94ed897120b413ee42c78982e7e314c9edc94291c0f3d319e7cbc582e","observation_id":"972d7a8a-8d79-429b-a41d-f7de21be0416","resolution":{"observed_at":"2026-08-12T16:26:47.781561Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.787779Z","title":"Cuda® deep neural network library","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.787779Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:4c952eb89c91f7ba9944aac9ed535fc7149227ac72e42e96517253268f758c80","observation_id":"3f9d310a-be17-4adc-9b5b-a82a72a97516","resolution":{"observed_at":"2026-08-12T16:26:47.787779Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.796102Z","title":"Rowhammer: A retrospective,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.796102Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:3d3a67cbc1e820c2a7a8c2a5cb39b55638b5be2ecd2f382fd5f70a6d82b4607f","observation_id":"144b293c-d386-48a3-b195-c7f23c982fbe","resolution":{"observed_at":"2026-08-12T16:26:47.796102Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.18362","last_updated":"2023-10-24T14:25:53Z","snapshot_observed_at":"2026-08-16T14:49:19.852945Z","submitted_at":"2023-10-24T14:25:53Z","title":"SoK: Memorization in General-Purpose Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.18362","snapshot_observed_at":"2026-08-12T16:26:47.809417Z","title":"Sok: Memorization in general-purpose large language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.809417Z"},"links":{"cited_paper":"/paper/2310.18362","citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:18959461ebccf920e84127c3fad824921e302362617f9187e3c4d176bda66749","observation_id":"fe8ce346-3722-45a3-834f-7ae60d1345cf","resolution":{"observed_at":"2026-08-12T16:26:47.809417Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.818771Z","title":"Sok: Security and privacy in machine learning,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.818771Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:5d15b9194d1c120cb64a786c16fe7b42e0fa76e7013a3e52ebf19d37cdca5b21","observation_id":"0874ad74-5bd5-4f9c-b943-b7db0774799c","resolution":{"observed_at":"2026-08-12T16:26:47.818771Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.825389Z","title":"Sok: Membership inference is harder than previously thought,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.825389Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:58d24b276bca78b81974e1816908ed8dbae11185be7fa86910dd00ae241421ba","observation_id":"e34c7f6d-42b0-408c-85b7-09a9c1033435","resolution":{"observed_at":"2026-08-12T16:26:47.825389Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.834377Z","title":"Sok: Model inversion attack landscape: Taxonomy, challenges, and future roadmap,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.834377Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:a71516de13ae26ca39b5049098683d1e06d118215a5533c86d110ff83821de8f","observation_id":"37c68c4c-db04-40d8-b1e6-8cdc8f5a250e","resolution":{"observed_at":"2026-08-12T16:26:47.834377Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.844101Z","title":"Mitre attack framework","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.844101Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:1ba0ec49819b9de0162fb30bf2ba0a8394b3e7cfaca3e9d748f5a8c3d3eb5853","observation_id":"18ceb25b-385e-4548-8858-cd1694413110","resolution":{"observed_at":"2026-08-12T16:26:47.844101Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.852528Z","title":"In-datacenter performance analysis of a tensor processing unit,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.852528Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:7ced29cacd1f122046a3f09410fc8822c97064e701b9f765baebeee3ae73820a","observation_id":"a2676bbf-b45d-4303-9a01-018f52ee0a50","resolution":{"observed_at":"2026-08-12T16:26:47.852528Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.865812Z","title":"Github copilot","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.865812Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:3ff63e5f96e4ea05b776c35d344c0d8b59c2efcee47b2b53e423c91c5dd9e9f8","observation_id":"0d5effc0-21c5-464e-8b7b-b807ed32fd6d","resolution":{"observed_at":"2026-08-12T16:26:47.865812Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.873335Z","title":"Amazon q developer","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.873335Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:d9940c3a291d83932166b00fca56d4d3162e5bf0ce9bd3cb4e90100d0faff839","observation_id":"ab437fca-2a7e-42c4-b9ed-6d5ff5885adb","resolution":{"observed_at":"2026-08-12T16:26:47.873335Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.881012Z","title":"Mistral ai","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.881012Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:4ebe286c054dc0b9f8f1542c4a42a1d45ebaa19afa4a90cf2345eabe71437ea4","observation_id":"ebafccad-0762-4dec-a490-eb53f707e950","resolution":{"observed_at":"2026-08-12T16:26:47.881012Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.889436Z","title":"Clip-decoder: Zeroshot multilabel classifica- tion using multimodal clip aligned representations,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.889436Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:30636f7cfbbfbdc41d89ae8f4146ec90cc5a0ecb88e55d6a816cc25524178fcb","observation_id":"e4e203ee-f4c4-4588-ab65-ad1fd0c3bdea","resolution":{"observed_at":"2026-08-12T16:26:47.889436Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.898630Z","title":"Mitre att&ck: Design and philosophy,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.898630Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:5f0bb2171be40e1aa3f21f48a077ef21b9a6b55928ae1facfc537dfa1bfee855","observation_id":"014c581d-3965-463e-8c94-74954065ef5c","resolution":{"observed_at":"2026-08-12T16:26:47.898630Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.906894Z","title":"Ev- erywhere all at once: Co-location attacks on public cloud faas,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.906894Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:65b5f973d560e311f269387ccff56eea1a7e3462e0ece56a3c32ca7903e95cb8","observation_id":"40188ab7-adae-4237-98cb-048d710e886b","resolution":{"observed_at":"2026-08-12T16:26:47.906894Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.915125Z","title":"Theory and practice of finding eviction sets,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.915125Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:5e6e7efb8f0a4952776a9e3b79ae638c072b15846e188e99e54f45a779c943bb","observation_id":"1885305f-dbab-4dea-ad1e-20cca475a317","resolution":{"observed_at":"2026-08-12T16:26:47.915125Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.925723Z","title":"Flush+ reload: A high resolution, low noise, l3 cache side-channel attack,","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.925723Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:62ed644de90a5e6599aab1ad4394082be098548ffe1bce86eba42d96cee51819","observation_id":"5baa0dc4-8fbb-49d6-9411-86d725c74980","resolution":{"observed_at":"2026-08-12T16:26:47.925723Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.933726Z","title":"Cache missing for fun and profit,","venue":null,"work_id":null,"year":2005},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.933726Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:2072d7a159ca2868eb984a314d36a2cd6d273cc73bfd66d66f07c25a5105ce78","observation_id":"42911aa2-2358-4345-9d07-06e8d604d882","resolution":{"observed_at":"2026-08-12T16:26:47.933726Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.941360Z","title":"Confusedpilot: Confused deputy risks in rag-based llms,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.941360Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:0dba8968d4e0ee34a7ab33f8a38b14c202917cdf6923ab205995efb5e1a37c8e","observation_id":"d5ce4d8b-fac2-49fa-93b0-34f971675527","resolution":{"observed_at":"2026-08-12T16:26:47.941360Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.955842Z","title":"Cache telepathy: Lever- aging shared resource attacks to learn dnn architectures,","venue":null,"work_id":null,"year":2003},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.955842Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:2eca6afcdf3ebbff339e44a5828ad3eaea842d5e76ac52cc2aba6fc7ef1f645b","observation_id":"24309597-0288-42a2-ba3c-62f72bca1b5d","resolution":{"observed_at":"2026-08-12T16:26:47.955842Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.966062Z","title":"Hugging face","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.966062Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:ce0386663a1044c5b25182157647b50ef8d47f731deb5fc7f755491f7b20730d","observation_id":"d2895b32-7b18-46dc-95a7-5ff23235f0f7","resolution":{"observed_at":"2026-08-12T16:26:47.966062Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.975725Z","title":"Google tensorflow","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.975725Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:cf45b60b2a49f74388a4ab19a56db4799b3b59bfff6cd78866364296e5c2e94a","observation_id":"32ac1193-7b6c-47b2-a125-e360f9d160c3","resolution":{"observed_at":"2026-08-12T16:26:47.975725Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.986096Z","title":"Apache spark","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.986096Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:7d55d1d834a767d291e7fb04c450716d78e7a1781ff1139a630c0b333604081e","observation_id":"fb37b1fc-7cc8-4dd4-b43c-df96d2a920d0","resolution":{"observed_at":"2026-08-12T16:26:47.986096Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:47.995572Z","title":"Apache hadoop","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:47.995572Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:9a0b9bd321e706bce82d35faf8da9796180b39a7ea287d3e4b683e2c5aa26926","observation_id":"0356afa5-d899-42e0-9c49-e0015a0aeadf","resolution":{"observed_at":"2026-08-12T16:26:47.995572Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.013314Z","title":"Snowflake","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.013314Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:fd9aba2c26a25a88ffcb0507bb91bf76d02f31947315bb507a783c16cce0a6df","observation_id":"e588a361-37a6-492e-a618-2d27f79f663f","resolution":{"observed_at":"2026-08-12T16:26:48.013314Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.023455Z","title":"Bentoml","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.023455Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:e4280a9bf2e1663438a693521217d9081b7a3012145a119b2e51c5d479d6d776","observation_id":"54555caf-c53d-4313-8758-7a3e6df3b886","resolution":{"observed_at":"2026-08-12T16:26:48.023455Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.032674Z","title":"Kubernetes","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.032674Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:3fff4b4a234bb8de2d34de899c7cde43b42bd0691a83295c100ef41a498dd1e6","observation_id":"35a17ec1-9088-49a0-9e98-0a7a4e1ab88e","resolution":{"observed_at":"2026-08-12T16:26:48.032674Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.046154Z","title":"Pyyaml package","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.046154Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:994d5908a819ca3ca5f03f51e0e8e6cf6b1945aed7dab69b2b7685f40e6c0e0b","observation_id":"3287ac1d-c9d4-47db-9723-13a9a293099c","resolution":{"observed_at":"2026-08-12T16:26:48.046154Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.061961Z","title":"Cve-2023-31035","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.061961Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:2b19f7fb3940179aef360d7871c4a87b571edf82872caeb72f1694250b166508","observation_id":"eaae5611-df31-4694-8a1c-cb10e3df3a4a","resolution":{"observed_at":"2026-08-12T16:26:48.061961Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.070697Z","title":"Cve-2024-3095","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.070697Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:364a51f791205f29dcef25ab60705f16f52cde08f169feccbf87f61395cd102d","observation_id":"05c08627-4426-42c2-bcae-3c2d86394343","resolution":{"observed_at":"2026-08-12T16:26:48.070697Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.079021Z","title":"Formal verification methods,","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.079021Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:17af36b25a0b14b320f8229a0064c8ccd36a0e906cca7d42c83e446fbd7c6799","observation_id":"8f73ffd2-41be-4715-9135-217dcd657ac6","resolution":{"observed_at":"2026-08-12T16:26:48.079021Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.088486Z","title":"Hfl: Hybrid fuzzing on the linux kernel.,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.088486Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:25cfe0a8a01cfca7b5c1e9e71655008c5651320065a72d590dd18ea76a6ced3c","observation_id":"aaff326a-2956-43c9-86c0-f3811c7b3d37","resolution":{"observed_at":"2026-08-12T16:26:48.088486Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.104839Z","title":"Sok: A defense- oriented evaluation of software supply chain security,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.104839Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:4c7ec5c8f774390566fb555c03979ef3487d3a8ede1d362e8883b09ed10c3fb8","observation_id":"108975ce-905a-432a-b103-abebdc116bed","resolution":{"observed_at":"2026-08-12T16:26:48.104839Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.112052Z","title":"Sok: Taxonomy of attacks on open-source software supply chains,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.112052Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:693f95d1ce69c0687fe0fb2e3e2b05c3e6e1fc2bcbf48280fd006e872cac9648","observation_id":"25808180-b641-4818-bf05-fe54c4d28a44","resolution":{"observed_at":"2026-08-12T16:26:48.112052Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.124818Z","title":"Practical automated detection of ma- licious npm packages,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.124818Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:7917f954b47dfc2215b9425b66b6acd3945fd5f1855fc6df0cc946e2f37f81b2","observation_id":"4bbe68ab-0217-45a0-853d-70ec7a482aa2","resolution":{"observed_at":"2026-08-12T16:26:48.124818Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.137544Z","title":"Immutability and encapsulation for sound oo information flow control,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.137544Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:48ef806cd0a7b7b9bb6cb8121d328a944df33f889a32a71f81fa2b8a289c3e52","observation_id":"96743c1a-c479-4ad3-a59f-5e6260240558","resolution":{"observed_at":"2026-08-12T16:26:48.137544Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.145655Z","title":"Raksha: a flexible information flow architecture for software security,","venue":null,"work_id":null,"year":2007},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.145655Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:30f1ee43b46d26e49c109b818f458a14b07ca0674ab37aa87bbb470bd266e485","observation_id":"4d9060f9-dd1e-48f5-b94e-b86921103dbc","resolution":{"observed_at":"2026-08-12T16:26:48.145655Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.153034Z","title":"Mod- ular information flow through ownership,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.153034Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:157e8540e62105c22e37da191c2bdc02f7345e1baeae6be5faaec1cedb64991c","observation_id":"ce1b3b7d-370c-4d1e-8df3-dd89c5b0159a","resolution":{"observed_at":"2026-08-12T16:26:48.153034Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.162293Z","title":"Rethinking privacy in machine learning pipelines from an information flow control perspective,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.162293Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:bafa5f16d8027144a05c9eaf0a70d438a5af1074bf41ea738952c18124c60a55","observation_id":"3f44c7c0-ecc2-4cd4-a42f-100b5103c820","resolution":{"observed_at":"2026-08-12T16:26:48.162293Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.180114Z","title":"Rust ai engine","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.180114Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:0c5d85731a49091be2292b33b248d9a273d6d07ed853be53a07c73e5edbd5677","observation_id":"9dc92f20-9424-4a27-a16d-0b2a8d49beca","resolution":{"observed_at":"2026-08-12T16:26:48.180114Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.18431","last_updated":"2024-09-06T18:42:43Z","snapshot_observed_at":"2026-08-16T13:30:55.982414Z","submitted_at":"2024-07-25T23:46:27Z","title":"Rusty Linux: Advances in Rust for Linux Kernel Development","version":2},"cited_work":{"arxiv_id":"2407.18431","doi":null,"metadata_source":"pith","pith_arxiv_id":"2407.18431","snapshot_observed_at":"2026-08-12T16:26:50.091306Z","title":"Rusty Linux: Advances in Rust for Linux Kernel Development","venue":"cs.SE","work_id":"33813e79-bf7f-4862-a6d8-1ed2efe495ac","year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.195016Z"},"links":{"cited_paper":"/paper/2407.18431","citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:5dd599fae4b456c1c39d49ec186657c7fcd12ab72b149f3a915c2797431e8446","observation_id":"550f4880-d673-4bb2-a2b7-bc3dd0588a72","resolution":{"observed_at":"2026-08-12T16:26:50.101572Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.210597Z","title":"Erim: Secure, efficient in-process isolation with memory protection keys,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.210597Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:1c87506eba4e50183a7c04bff479e79af9741515dbef4fe42b7ee6c817aa9a2d","observation_id":"399c3b4f-0cb8-4282-ba98-7ffcbdc5185f","resolution":{"observed_at":"2026-08-12T16:26:48.210597Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.221388Z","title":"Securecells: A secure compartmentalized architecture,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.221388Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:d4b9b5982d09c7558e69e6967ca71c8ff0d2b4764d4d5916e8d2f45ee999ce26","observation_id":"b2b57b35-95be-4e5b-ab0b-2cafff4f3ab9","resolution":{"observed_at":"2026-08-12T16:26:48.221388Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.228685Z","title":"Retrofitting fine grain isola- tion in the firefox renderer,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.228685Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:77f56edcc4fba14a2057f6df741e0e79212782c6558d838996b19520ff68bbfb","observation_id":"d87f32df-493c-4e33-a896-fd520c9027b9","resolution":{"observed_at":"2026-08-12T16:26:48.228685Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.234534Z","title":"Going beyond the limits of sfi: Flexible and secure hardware-assisted in-process isolation with hfi,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.234534Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:5ae260248dfface7a9a2d914f82a54c85841da5aa5e06baf5febc95842525476","observation_id":"190ae8d1-6aaf-46cd-8bd7-a596ccddf4f8","resolution":{"observed_at":"2026-08-12T16:26:48.234534Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.244590Z","title":"Cheri: A hybrid capability-system architecture for scalable software compart- mentalization,","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.244590Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:a9fec38a8aafed69d717f8fc500dd602a656773992dd3e2e6d3aa51a7a322641","observation_id":"721c84b2-d2fd-4705-8a9f-547fdc9def69","resolution":{"observed_at":"2026-08-12T16:26:48.244590Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.255468Z","title":"Morpheus: A vulnerability-tolerant secure architecture based on ensembles of moving target defenses with churn,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.255468Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:d0ef113ca3120d3d3fa524faa37c58328ffa381468b4a38c8ef3cc423deb3f49","observation_id":"b6683080-c406-4bc5-bdde-41b386c686f3","resolution":{"observed_at":"2026-08-12T16:26:48.255468Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.266704Z","title":"Boosting microservice resilience: An evaluation of istio’s impact on kubernetes clusters under chaos,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.266704Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:466756660b8e850c600b2e42e7c1c1201168804334963135512e250112802807","observation_id":"8476dd99-55c6-43cf-8774-b9ebdf5b0f71","resolution":{"observed_at":"2026-08-12T16:26:48.266704Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.273959Z","title":"Rethinking system audit architectures for high event coverage and synchronous log availability,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.273959Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:6a0abb4330091f60aa7cb92e96fbc59f2758868d9fc7c8dba73f510e6a0fd92d","observation_id":"ceaf804e-5ea7-41c5-b86e-53977a75c8fe","resolution":{"observed_at":"2026-08-12T16:26:48.273959Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.289561Z","title":"Nvidia bluefield dpu","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.289561Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:3a76ba6c865e882a8ceb07c0e70acc8289a750c33d8ad11582cf01be33c7422c","observation_id":"58efcf24-36ff-4e47-9516-d195d20c03fa","resolution":{"observed_at":"2026-08-12T16:26:48.289561Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.304275Z","title":"Practical cold boot attack on iot device-case study on raspberry pi,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.304275Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:10f1b31dc97249a8e0519664b0c39fe46e273a0049d31cf11e2341afc2bc4a71","observation_id":"f5f881b3-bd28-41a3-ab63-c7f2553d0516","resolution":{"observed_at":"2026-08-12T16:26:48.304275Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.314754Z","title":"Warm-boot attack on modern drams,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.314754Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:e844e80b152142e19e213e1a4cfb98d0436d5e356696f4b051963ce370da3fe8","observation_id":"263d8b64-888d-43a9-8239-0266fc06f838","resolution":{"observed_at":"2026-08-12T16:26:48.314754Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.324764Z","title":"Drama: Exploiting dram addressing for cross-cpu attacks,","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.324764Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:6002d2463723c73fe40b0dbc8d633b26f7ec6859d17e10087907613b4568c141","observation_id":"c9c62902-f948-41f2-a033-660fd34ce7fa","resolution":{"observed_at":"2026-08-12T16:26:48.324764Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.336675Z","title":"Dramaqueen: Revisiting side channels in dram,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.336675Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:4e2a5e10d5acd4ab9be97c8d3d7c9ab66c4af574bd71a5868785113aa0c2da87","observation_id":"7f30e256-67bb-4793-8b14-eb6d76ae4b5e","resolution":{"observed_at":"2026-08-12T16:26:48.336675Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.346882Z","title":"Nvleak:off-chip side-channel attacks via non-volatile mem- ory systems,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.346882Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:6c6971ec16a53d1fc939b437b3f97afcc62d02fd0f68f8184d7f6cde3fe64dd0","observation_id":"211e7a6c-cbdc-4b01-a0b4-28c5541d576b","resolution":{"observed_at":"2026-08-12T16:26:48.346882Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.357176Z","title":"Deephammer: Depleting the intelligence of deep neural networks through targeted chain of bit flips,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.357176Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:a4df95ee68b0e41b893c3e1d31c34ceabcbd2c741a4b962c748e92722c7ed86e","observation_id":"d157c122-07c4-4ec7-a926-7567ffbecda3","resolution":{"observed_at":"2026-08-12T16:26:48.357176Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.367051Z","title":"Yes, one-bit-flip matters! universal dnn model inference depletion with runtime code fault injection,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.367051Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:efb3ed88d704cefc47e84b05141e8c9588c70c63eb4ffc2644b7935ff19af8e1","observation_id":"5ae70405-4990-4f42-95e3-8ff737f8dab4","resolution":{"observed_at":"2026-08-12T16:26:48.367051Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.376861Z","title":"Bit-flip attack: Crushing neural net- work with progressive bit search,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.376861Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:fd5798dfd0cb6fcbac5b74f4f5d9104029dfe0ba66871709c94cd834507445e1","observation_id":"6963e044-0169-4e9f-9ee9-60817fa4a450","resolution":{"observed_at":"2026-08-12T16:26:48.376861Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.387698Z","title":"Rambleed: Reading bits in memory without accessing them,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.387698Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:dcdf7285705b1920d4ba1f4b1ad6d904b3fe4a473f742abc6ec9906f4219a2f1","observation_id":"f8a59798-f740-44a7-8bbb-6a9e4f71bc19","resolution":{"observed_at":"2026-08-12T16:26:48.387698Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.394925Z","title":"Deepsteal: Advanced model extractions leveraging efficient weight stealing in memories,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.394925Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:577a58962552404776fe11fc971a7079c874b0a53782e391deb0d34c397ee0da","observation_id":"da900df5-04ce-4da4-a5a1-d492bb3524e5","resolution":{"observed_at":"2026-08-12T16:26:48.394925Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.407936Z","title":"Side- channel attack analysis on in-memory computing architectures,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.407936Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:77bdb625c1de4ca4cae12ae5e9a99149f80d130dc7849d31b38325fd963eea18","observation_id":"fb71c962-833f-4c25-8d26-99ef05fc38f0","resolution":{"observed_at":"2026-08-12T16:26:48.407936Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.421874Z","title":"Powergan: A machine learning approach for power side-channel attack on compute-in-memory accelerators,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.421874Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:984bf49462a8c1172b3cfdeabb87a27504b357f171d800f03fd37e4d41c75aa5","observation_id":"a2b2078d-11ca-4c38-9a96-f01240882ae7","resolution":{"observed_at":"2026-08-12T16:26:48.421874Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.11284","last_updated":"2025-06-12T20:38:42Z","snapshot_observed_at":"2026-08-16T14:00:09.336116Z","submitted_at":"2024-04-17T11:48:14Z","title":"Revisiting Main Memory-Based Covert and Side Channel Attacks in the Context of Processing-in-Memory","version":4},"cited_work":{"arxiv_id":"2404.11284","doi":null,"metadata_source":"pith","pith_arxiv_id":"2404.11284","snapshot_observed_at":"2026-08-12T16:26:50.045059Z","title":"Revisiting Main Memory-Based Covert and Side Channel Attacks in the Context of Processing-in-Memory","venue":"cs.CR","work_id":"1d9e59b2-bec1-4f40-9acf-8018c591f33e","year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.431795Z"},"links":{"cited_paper":"/paper/2404.11284","citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:84f96439267aea9f735bb15c50ff41fe418bdd7b0dbb88b9b6b523cfed008f7f","observation_id":"61710016-9e82-44dd-87de-56999f9268f7","resolution":{"observed_at":"2026-08-12T16:26:50.057257Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.463811Z","title":"Understanding error propagation in deep learning neural network (dnn) accelerators and applications,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.463811Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:498143a4f4600bbd7f961863e2afaeb33c958ba73283b71deb49d9180a8a98ea","observation_id":"e51fb4c3-a8e1-4683-be93-36b6ece115db","resolution":{"observed_at":"2026-08-12T16:26:48.463811Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.474049Z","title":"Fault injection for tensorflow applications,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.474049Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:0e695f9a121659f590865052db2cce87d52c4d151becaa26db0b0384a0e6aea6","observation_id":"7d534396-8608-40df-be87-d2cee68c26e6","resolution":{"observed_at":"2026-08-12T16:26:48.474049Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.482747Z","title":"pcileech","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.482747Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:b36e9d4da8eeea3b96423f8fc45736056d72cd2235d18b292734281fc8e2f61f","observation_id":"bbf05e1c-e2b6-41a5-9dbe-3c91e0af95fb","resolution":{"observed_at":"2026-08-12T16:26:48.482747Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.490863Z","title":"Thunderclap: Exploring vulnerabilities in operating system iommu protection via dma from untrustworthy peripherals,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.490863Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:fb82fd8d17ba4025dfc755a89eb8f0629de648ee58669c7e9304caf255c41e61","observation_id":"5d129d9f-d4e8-46c8-99fb-2388081e48db","resolution":{"observed_at":"2026-08-12T16:26:48.490863Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2003.09739","last_updated":"2020-03-21T19:58:14Z","snapshot_observed_at":"2026-08-18T10:19:28.560861Z","submitted_at":"2020-03-21T19:58:14Z","title":"New Security Challenges on Machine Learning Inference Engine: Chip Cloning and Model Reverse Engineering","version":1},"cited_work":{"arxiv_id":"2003.09739","doi":null,"metadata_source":"pith","pith_arxiv_id":"2003.09739","snapshot_observed_at":"2026-08-12T16:26:49.988481Z","title":"New Security Challenges on Machine Learning Inference Engine: Chip Cloning and Model Reverse Engineering","venue":"eess.SP","work_id":"85329a91-a04e-4da9-813a-4b7d38408c5b","year":2020},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.505660Z"},"links":{"cited_paper":"/paper/2003.09739","citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:2b2ae0c4f25b45dc1ada2dd8c075fad61b11f1b42dd85b1b51855c08e192feef","observation_id":"8a99724b-4896-4c5c-9be6-de8f01817929","resolution":{"observed_at":"2026-08-12T16:26:49.998463Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.519842Z","title":"Reverse engineering convo- lutional neural networks through side-channel information leaks,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.519842Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:235f985af0bce36f69424c9ab450ca8168d6e53dae195846c23c457b06f03607","observation_id":"f0672432-354f-4c0a-91ba-ee28e83f3817","resolution":{"observed_at":"2026-08-12T16:26:48.519842Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2110.07157","last_updated":"2021-10-14T05:08:39Z","snapshot_observed_at":"2026-08-18T03:09:34.308762Z","submitted_at":"2021-10-14T05:08:39Z","title":"Bandwidth Utilization Side-Channel on ML Inference Accelerators","version":1},"cited_work":{"arxiv_id":"2110.07157","doi":null,"metadata_source":"pith","pith_arxiv_id":"2110.07157","snapshot_observed_at":"2026-08-12T16:26:49.945793Z","title":"Bandwidth Utilization Side-Channel on ML Inference Accelerators","venue":"cs.CR","work_id":"8399aceb-d15b-46bd-98e8-8d4c08b25aa5","year":2021},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.527391Z"},"links":{"cited_paper":"/paper/2110.07157","citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:5195d678c2cb86b5c10c8a84d7573a50e1bdbad5722273db336b08ab9a1610d1","observation_id":"53bcbfe3-0b18-40b4-8699-c7a40666cf95","resolution":{"observed_at":"2026-08-12T16:26:49.955457Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.536725Z","title":"Chen, “Hmtt.” https://asg.ict.ac.cn/hmtt/, 2019","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.536725Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:f55c8d9d6f9e96d9733abbe725e3cfcf5094a49e25243761d8b74c452a920fa2","observation_id":"c3ca3481-d1d6-4c0e-9e25-2fe542debe1d","resolution":{"observed_at":"2026-08-12T16:26:48.536725Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.548406Z","title":"Hermes attack: Steal dnn models with lossless inference accuracy,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":92,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.548406Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:2c3401864028e7f04287336c08d7ab9a414ba298eeea77842dbb5324a1f52396","observation_id":"3868178d-67b2-431a-a1b9-ccd362399909","resolution":{"observed_at":"2026-08-12T16:26:48.548406Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.557915Z","title":"Deepsniffer: A dnn model extraction framework based on learning architectural hints,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.557915Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:3601181492a8020aace113de6a7ba23da8bc88a4bfac0c017082cceed0e7025f","observation_id":"a7d94e91-e12f-42ad-9d1d-303fe9e97597","resolution":{"observed_at":"2026-08-12T16:26:48.557915Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.565738Z","title":"Rendered insecure: Gpu side channel attacks are practical,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.565738Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:947394f466b275c176d569d6afabea1ac3e0d91688a1e52bf9ddbf2af1e98b1f","observation_id":"5abedf82-125e-468f-a382-743827a267ee","resolution":{"observed_at":"2026-08-12T16:26:48.565738Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.574870Z","title":"Leaky dnn: Stealing deep-learning model secret with gpu context-switching side-channel,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.574870Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:9d60654dd77f25fe67d9bd4cd49dd83e4246b21be48479f898141a8aa16a0681","observation_id":"ed03dd3c-df11-452b-b4d0-a6b0dfda7548","resolution":{"observed_at":"2026-08-12T16:26:48.574870Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.586349Z","title":"Huffduff: Stealing pruned dnns from sparse accelerators,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":96,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.586349Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:e0e78b7ed5a62b1e5351db9285ddf1b4a99d1f8b6058dc783f0aa2e81a7ef48a","observation_id":"68b595f5-31e1-405a-99cb-af3984fb2cbc","resolution":{"observed_at":"2026-08-12T16:26:48.586349Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.600677Z","title":"Sparsity turns adver- sarial: Energy and latency attacks on deep neural networks,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":97,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.600677Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:6addd008d1c749a7736f422a692007c138f612636a29fad02274bf09f07272e9","observation_id":"3978d5cf-f87e-45a7-a3c4-6528d4d6e55c","resolution":{"observed_at":"2026-08-12T16:26:48.600677Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.03877","last_updated":"2024-05-02T05:35:36Z","snapshot_observed_at":"2026-08-16T14:03:27.744432Z","submitted_at":"2024-04-05T03:57:38Z","title":"Beyond the Bridge: Contention-Based Covert and Side Channel Attacks on Multi-GPU Interconnect","version":2},"cited_work":{"arxiv_id":"2404.03877","doi":null,"metadata_source":"pith","pith_arxiv_id":"2404.03877","snapshot_observed_at":"2026-08-12T16:26:49.887524Z","title":"Beyond the Bridge: Contention-Based Covert and Side Channel Attacks on Multi-GPU Interconnect","venue":"cs.CR","work_id":"657e0d21-4e67-4684-bb1d-93d2d4587f52","year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":98,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.617488Z"},"links":{"cited_paper":"/paper/2404.03877","citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:250d410cc78dc82ae6126397ae5d39e3dc611375f49e863fa938a821b5412cb4","observation_id":"c244e5e0-6157-400c-83e3-fbfdb18d94d2","resolution":{"observed_at":"2026-08-12T16:26:49.898729Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.630679Z","title":"Invisible probe: Timing attacks with pcie congestion side-channel,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":99,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.630679Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:03efeb919dea65c5cef5cc18511c69e0dd6ce234ea2a2020e5f961c6c523f810","observation_id":"0a97080f-1d13-4473-96a5-7a6d4b080585","resolution":{"observed_at":"2026-08-12T16:26:48.630679Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1812.11720","last_updated":"2019-07-08T07:31:01Z","snapshot_observed_at":"2026-08-14T23:51:51.640637Z","submitted_at":"2018-12-31T08:19:26Z","title":"Stealing Neural Networks via Timing Side Channels","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1812.11720","snapshot_observed_at":"2026-08-12T16:26:48.647912Z","title":"Steal- ing neural networks via timing side channels,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":100,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.647912Z"},"links":{"cited_paper":"/paper/1812.11720","citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:5ef602166e15a55a0cbe1c9ad032f98318df6470de59d6cb41a49fba298a72d6","observation_id":"9f0f7c9c-80b9-4384-90c8-fbd16c6373b0","resolution":{"observed_at":"2026-08-12T16:26:48.647912Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.658083Z","title":"Layer sequence extraction of optimized dnns using side-channel information leaks,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":101,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.658083Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:d138fd0f238f5dfdf9ab993c4930e9b33539c863f080a10aae4e1ae74fe0e658","observation_id":"1e6eccc7-381f-4f0d-b662-98717b445e92","resolution":{"observed_at":"2026-08-12T16:26:48.658083Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T16:26:48.676389Z","title":"Practical attacks on deep neural networks by memory trojaning,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","version":1},"reference_index":102,"source":"pdf_text","source_observed_at":"2026-08-12T16:26:48.676389Z"},"links":{"citing_paper":"/paper/2411.13459"},"observation_digest":"sha256:b16245fb71c219efe9146184a226ac36219e331da966c5c2796f68d1b945584e","observation_id":"970cae3d-372a-4c83-933b-495f7cf64523","resolution":{"observed_at":"2026-08-12T16:26:48.676389Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2411.13459","last_updated":"2024-11-20T17:08:38Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-14T23:51:46.820100Z","submitted_at":"2024-11-20T17:08:38Z","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures"},"reference_resolution":{"displayed":100,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":94,"verified_exact":6,"verified_fuzzy":0},"total_outbound_references":183},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"thesis":"As of 18 August 2026, this Paper Citation Record lists 100 of 183 outbound references and 1 inbound Pith citation observation for arXiv:2411.13459."}