{"as_of":"2026-08-15T21:28:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:477ecf42a3b1f65126458cfc704b77c37be7c28602b61fd6a981faf0ab2574f7","coverage":[{"denominator":20,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":20,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-08T03:07:21.524834Z","state":"measured"},{"denominator":24,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":24,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-15T06:32:42.880941+00:00","state":"measured"},{"denominator":4,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":4,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-10T04:30:17.477789Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-08-05T17:47:07.180045Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.24118","snapshot_observed_at":"2026-08-01T06:40:05.033819Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization.arXiv preprint arXiv:2604.24118, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.21824","last_updated":"2026-07-23T21:21:01Z","snapshot_observed_at":"2026-08-13T02:52:32.049212Z","submitted_at":"2026-07-23T21:21:01Z","title":"Protocol-Level Attacks on Agentic Commerce Platforms: A Cross-Platform Taxonomy, AIP-Bench, and Unified Defense","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-01T06:40:05.033819Z"},"links":{"cited_paper":"/paper/2604.24118","citing_paper":"/paper/2607.21824"},"observation_digest":"sha256:570863e72d7e6cd2ef5e2d996015defdc06a0a3bdf191cc42d90ff77d95690f2","observation_id":"14d6e910-31d5-4ba8-be7a-354f80c8d7c1","resolution":{"observed_at":"2026-08-01T06:40:05.033819Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.24118","snapshot_observed_at":"2026-07-31T17:44:15.652372Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.24343","last_updated":"2026-07-31T11:27:14Z","snapshot_observed_at":"2026-08-12T15:43:04.972245Z","submitted_at":"2026-07-27T12:21:18Z","title":"Beyond Aggregate Risk: Role-Stratified Conformal Risk Control for LLM Tool Calls","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-07-31T17:44:15.652372Z"},"links":{"cited_paper":"/paper/2604.24118","citing_paper":"/paper/2607.24343"},"observation_digest":"sha256:5ab06994d2767acdc38e984a20976ee8d4b0ec295956b3fd57d9b0a442d4543b","observation_id":"e14d8970-0c9e-4951-a1ca-0975bdcf0c74","resolution":{"observed_at":"2026-07-31T17:44:15.652372Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"cited_work":{"arxiv_id":"2604.24118","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.24118","snapshot_observed_at":"2026-08-05T17:47:07.180045Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","venue":"cs.CR","work_id":"c8ecc6ff-721d-4bcd-9838-d1fe024b68db","year":2026},"citing_paper":{"arxiv_id":"2608.03509","last_updated":"2026-08-07T07:07:45Z","snapshot_observed_at":"2026-08-13T00:26:47.576380Z","submitted_at":"2026-08-04T11:51:23Z","title":"SkillJack: Persistent Skill Backdoors in Self-Evolving Agents","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-05T17:47:06.821776Z"},"links":{"cited_paper":"/paper/2604.24118","citing_paper":"/paper/2608.03509"},"observation_digest":"sha256:9aa70870f199a8cf6a82f54bdc42308c1bb66765a2f67b3f31cf285c5e3217c0","observation_id":"75de418b-5408-45d6-b1f7-883193b6c360","resolution":{"observed_at":"2026-08-05T17:47:07.244007Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.24118","snapshot_observed_at":"2026-08-10T04:30:17.477789Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.03509","last_updated":"2026-08-07T07:07:45Z","snapshot_observed_at":"2026-08-13T00:26:47.576380Z","submitted_at":"2026-08-04T11:51:23Z","title":"SkillJack: Persistent Skill Backdoors in Self-Evolving Agents","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-10T04:30:17.477789Z"},"links":{"cited_paper":"/paper/2604.24118","citing_paper":"/paper/2608.03509"},"observation_digest":"sha256:0db2d51832a3e9043f59f768096a6485d24fb382f91938d35ee1c5d02b85f183","observation_id":"5f0beb60-b48e-4f15-8664-142f16e472f1","resolution":{"observed_at":"2026-08-10T04:30:17.477789Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2604.24118/citation-record","integrity":"/paper/2604.24118/integrity","json":"/paper/2604.24118/citation-record.json","paper":"/paper/2604.24118"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2507.07974","last_updated":"2025-08-25T16:49:10Z","snapshot_observed_at":"2026-08-14T02:10:24.403536Z","submitted_at":"2025-07-10T17:51:05Z","title":"Defending Against Prompt Injection With a Few DefensiveTokens","version":2},"cited_work":{"arxiv_id":"2507.07974","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2507.07974","snapshot_observed_at":"2026-07-04T00:59:20.691622Z","title":"Defending against prompt injection with a few defensive tokens","venue":null,"work_id":"4f729650-c7f8-4e91-b5ed-4250fe884098","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2507.07974","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:eba17c7e9cc5d9e5fef6ab61a3d85f53ca761d21f4dd4177bc856839867eda82","observation_id":"38648840-d053-4eb0-be8d-b05dcf8a8c4b","resolution":{"observed_at":"2026-05-11T22:16:31.049398Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"https://docs.cloud.google","venue":null,"work_id":"942fe375-94bf-4667-a4dc-64f465c41768","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:ce0bacd0ea936be6e6d3695632eb260fb4ac3bedaa3191748f779d0d671b8c4b","observation_id":"6f7c90b8-2c6b-441a-8fe3-e71e38211f9d","resolution":{"observed_at":"2026-05-26T22:23:09.359110Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-08-15T10:52:04.955270Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":"2403.14720","doi":"10.48550/arxiv.2403.14720","metadata_source":"pith","pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","venue":"cs.CR","work_id":"c18cd975-e731-4e0f-a99f-a37d846cdd31","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:8cd83c93da683b787a7b165a321b25c9ec6db34e143f0513e78965105756a243","observation_id":"a98aa8a6-22a5-46c6-9d90-c4fbcc500f1f","resolution":{"observed_at":"2026-05-14T22:28:55.556742Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.21276","last_updated":"2024-10-25T17:43:01Z","snapshot_observed_at":"2026-08-15T14:02:47.366139Z","submitted_at":"2024-10-25T17:43:01Z","title":"GPT-4o System Card","version":1},"cited_work":{"arxiv_id":"2410.21276","doi":"10.1177/15248380231178756","metadata_source":"pith","pith_arxiv_id":"2410.21276","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"GPT-4o System Card","venue":"cs.CL","work_id":"f37bf1c7-4964-4e56-9762-d20da8d9009f","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2410.21276","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:b831a5778c70d537ac3951fac98a43f6d23abacaa5036a1764c186dd44ca9f0b","observation_id":"e46d2afd-0c0a-4d35-9f59-2d5818011af4","resolution":{"observed_at":"2026-05-11T22:16:31.475909Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.12252","doi":"10.48550/arxiv.2510.12252","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Promptlocate: Localizing prompt injection attacks","venue":"ArXiv.org","work_id":"247fa04e-9000-4d54-8e25-538bf1645f81","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:1af4ffab69c1857672cb9c1bae2b7268d348ba56e3b0cd159cc679b2253b8914","observation_id":"5acdecc0-a3ec-40b9-9e28-78be41ea06be","resolution":{"observed_at":"2026-05-11T22:16:30.056074Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"InProceedings of the 2024 conference on empirical methods in natural language processing: industry track, pages 371–385","venue":null,"work_id":"2fd193d0-561f-483c-b4e3-f0e02cb1f8c0","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:95491602fdc5e3f0d85603d63769ace23766ca55bc98af788bb86124c13d84ed","observation_id":"62cb19c6-20ab-4dd7-b231-467f86a45c7c","resolution":{"observed_at":"2026-05-26T22:23:09.353350Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04957","last_updated":"2024-03-07T23:46:20Z","snapshot_observed_at":"2026-08-13T00:59:41.384742Z","submitted_at":"2024-03-07T23:46:20Z","title":"Automatic and Universal Prompt Injection Attacks against Large Language Models","version":1},"cited_work":{"arxiv_id":"2403.04957","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2403.04957","snapshot_observed_at":"2026-07-04T14:09:53.868428Z","title":"Automatic and universal prompt injection attacks against large language models","venue":null,"work_id":"0bf3ec19-0162-44f2-855f-1b7fdb565de2","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2403.04957","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:bd5f827c0a6e8a67d97678383730e0c6a18da5d865921429deb59322a1d2232d","observation_id":"0758cb4a-9c1a-4ce4-84da-61f3390ff217","resolution":{"observed_at":"2026-05-11T22:16:30.268382Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"In 2025 IEEE Symposium on Security and Privacy (SP), pages 2190–2208","venue":null,"work_id":"1c98e182-b7b9-4ba1-97d3-2f164d98471c","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:38ca4e36384efc07e70b9901d525c14970fce8c9e617b61138d1fbd00f5764f4","observation_id":"f6f6a1bc-9684-4b1f-b6a5-71b586ac4d02","resolution":{"observed_at":"2026-05-26T22:23:09.350682Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-08-13T17:20:44.002518Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":"2407.21783","doi":"10.1016/s0749-0720(15","metadata_source":"pith","pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"The Llama 3 Herd of Models","venue":"cs.AI","work_id":"1549a635-88af-4ac1-acfe-51ae7bb53345","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:2ae575bd4cabfdaf0ac61834f95a06f70e1b78482c3954feb847411d87951cd6","observation_id":"0488dda1-cd25-4591-854a-0876e3cecff1","resolution":{"observed_at":"2026-05-11T22:16:30.755496Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2512.12594","doi":"10.48550/arxiv.2512.12594","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"cellmate: Sandboxing browser ai agents","venue":"arXiv (Cornell University)","work_id":"3994ee1f-f65b-4f8b-93e9-6ec20a5e0988","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:b1caba87030776098e32775baa8e24e9316a50a28ce19ff940484ccd5cfebf7f","observation_id":"f4c90596-ae9a-4b7c-b243-ae36149a6b88","resolution":{"observed_at":"2026-05-11T22:16:32.359050Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-08-15T06:26:47.552378Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":"2211.09527","doi":"10.48550/arxiv.2211.09527","metadata_source":"pith","pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","venue":"cs.CL","work_id":"a7c5b6ec-3407-4330-96c8-3fc58e7d410b","year":2022},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:97366be0241b007a8c484359071df86b557b78ec84ade2ccf6cfd6becbf627ac","observation_id":"37cbf9f3-494f-449a-a4fe-5cfa6f0b6dd7","resolution":{"observed_at":"2026-05-11T22:16:32.209358Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-05-24T11:53:03.018758+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T11:53:03.018758+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2512.04367","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:47:50.377516Z","title":"9 Gerald J Popek and Robert P Goldberg","venue":null,"work_id":"3da25218-8494-4377-9eee-6d114f2231af","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:93bba8ad8d831fdf97c0e4439fea377a8f13395a6219fc1bb34dec0b6404a610","observation_id":"27d3cb5b-29fd-4acd-80eb-021290cad666","resolution":{"observed_at":"2026-05-11T22:16:29.937787Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Secu- rity, pages 660–674","venue":null,"work_id":"a71ee1d3-2c40-4b24-92e1-95c40f1162e4","year":2024},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:8e5da7353120df84a66242d6f217542ce0204b927b3312889712c6b9986a1129","observation_id":"dbf93f3b-29a0-4f42-9167-ca6ac4953537","resolution":{"observed_at":"2026-05-26T22:23:09.356257Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.15219","last_updated":"2025-07-21T03:41:44Z","snapshot_observed_at":"2026-08-06T15:35:31.690602Z","submitted_at":"2025-07-21T03:41:44Z","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","version":1},"cited_work":{"arxiv_id":"2507.15219","doi":null,"metadata_source":"pith","pith_arxiv_id":"2507.15219","snapshot_observed_at":"2026-07-11T02:47:49.968301Z","title":"Promptarmor: Simple yet effective prompt injection defenses","venue":"cs.CR","work_id":"a555d845-f54e-4efb-8504-b885d3481efa","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2507.15219","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:b70e8f390f154efffdaa92fbebc91061dd106b65011c42f0dfb164f6e9c41778","observation_id":"0d540643-035f-498a-b251-c718ced57266","resolution":{"observed_at":"2026-05-11T22:16:31.942505Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"InProceed- ings of the 2009 ACM SIGPLAN/SIGOPS interna- tional conference on Virtual execution environments, pages 121–130","venue":null,"work_id":"6d232686-2e38-4a7b-8971-09109b11718b","year":2009},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:9743c81642abda5c894bda0a6d1c247154db885ac6f5ad6cb330466d19c5f0d9","observation_id":"14c31d71-a508-46a2-988d-8d6d77f1f85a","resolution":{"observed_at":"2026-05-26T22:23:09.362088Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.06471","last_updated":"2025-08-08T17:21:06Z","snapshot_observed_at":"2026-08-11T03:34:09.767397Z","submitted_at":"2025-08-08T17:21:06Z","title":"GLM-4.5: Agentic, Reasoning, and Coding (ARC) Foundation Models","version":1},"cited_work":{"arxiv_id":"2508.06471","doi":"10.48550/arxiv.2508.06471","metadata_source":"pith","pith_arxiv_id":"2508.06471","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"GLM-4.5: Agentic, Reasoning, and Coding (ARC) Foundation Models","venue":"cs.CL","work_id":"5bb4e5d7-985e-431b-bb0d-75576cdc2950","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2508.06471","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:2bc0a60d299c497a6a89bede4731c69d5766a213e9ee620a36639bcbc82f573c","observation_id":"e50554d4-97a1-45c3-a630-a85f144002b1","resolution":{"observed_at":"2026-05-11T22:16:31.245875Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-05-23T05:23:01.474969+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-23T05:23:01.474969+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"In Proceedings of the 33rd ACM International Confer- ence on Multimedia, pages 10955–10964","venue":null,"work_id":"66f3f8cb-4acb-4b49-87b0-f2282d3f4596","year":2023},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:0f82986234802ac1e1634563993fcc0e3847b169dc9f7dba1a91c5df8db2a4a1","observation_id":"a6b9a0e8-0b36-4952-a915-54285597f024","resolution":{"observed_at":"2026-05-26T22:23:09.348268Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"fa2bf670-2565-4fc5-91a3-d2f5f0a756ea","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:87caa97496329f965af5dac4e1a9acb05ae0bd6afbefd9743293996c43f7420b","observation_id":"51ca2548-2ad7-4fb1-8191-5594169a9fb9","resolution":{"observed_at":"2026-05-26T22:23:09.345363Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-15T07:54:32.535665Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":"2502.05174","doi":"10.48550/arxiv.2502.05174","metadata_source":"pith","pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Melon: Indirect prompt injection defense via masked re-execution and tool comparison","venue":"cs.CR","work_id":"ca987b9e-fd52-4cd1-84b8-e5966bfc675f","year":2025},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:4d7622d6af9bc4b934c01d8a65fee7faadacd84806382bce09c8e7c188a19f6e","observation_id":"af9bf477-2843-42a9-acb7-81f110a10627","resolution":{"observed_at":"2026-05-11T22:16:30.500382Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":"2307.15043","doi":"10.48550/arxiv.2307.15043","metadata_source":"pith","pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","venue":"cs.CL","work_id":"3322fa86-1768-4677-8425-dd326b45e078","year":2023},"citing_paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-08T03:07:21.524834Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2604.24118"},"observation_digest":"sha256:59bd641cff039a881cfb0bd9b0ea93533abb9dd83db2041fd67bfc41d23e2e7a","observation_id":"6ce32323-bb7a-402c-a512-5d461697239a","resolution":{"observed_at":"2026-05-11T22:16:31.675479Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2604.24118","last_updated":"2026-04-27T07:12:52Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-30T05:21:40.679953Z","submitted_at":"2026-04-27T07:12:52Z","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization"},"reference_resolution":{"displayed":20,"state_counts":{"malformed_identifier":0,"metadata_mismatch":12,"parse_uncertain":0,"unresolved":1,"verified_exact":1,"verified_fuzzy":6},"total_outbound_references":20},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"thesis":"As of 15 August 2026, this Paper Citation Record lists 20 of 20 outbound references and 4 inbound Pith citation observations for arXiv:2604.24118."}