Paper Citation Record · LEDGER

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection

As of 11 August 2026, this Paper Citation Record lists 36 of 36 outbound references and 0 inbound Pith citation observations for arXiv:2607.16199.

A citation records a reference. It does not transfer a finding from one paper to another.

pith.paper-citation-record.v1
2607.16199 v1

Coverage vector

measured 36 of 36 reference resolution

Typed states for the displayed outbound observations.

Source: paper_references, paper_reference_links, observed 2026-08-02T15:17:29.479184Z

measured 36 of 36 standing notices

One-hop event checks from named stored sources.

Source: scholarly_work_events, retraction_status_cache, observed 2026-08-10T06:31:04.303077+00:00

measured 0 of 0 inbound itemization

Pith citing papers itemized under the disclosed page cap.

Source: paper_references, paper_reference_links

measured 0 of 1 external citation measurements

A source-named dated measurement, never combined with another source.

Source: cited_works

Reference resolution

36 of 36 outbound references displayed

verified exact0
verified fuzzy0
unresolved36
parse uncertain0
malformed identifier0
metadata mismatch0

External citation measurements

No source-named external measurement is stored.

Outbound references

Observation 5bdcb069-8227-4b9a-b096-0cb6d834d37b · outbound

This paper cites Journal of the American Statistical Association , volume =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Journal of the American Statistical Association , volume =

Reference 1

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:27.615826Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation f5b1ebbe-523d-405d-b18b-8bb50fffbe35 · outbound

This paper cites 2023 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2023 , url =

Reference 2

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:27.752139Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 3ee823ef-f1eb-4310-858f-993a3f50ad6a · outbound

This paper cites 2023 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2023 , url =

Reference 3

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:27.959144Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation d025a1b7-f2e6-430e-be18-534b93b4be04 · outbound

This paper cites NeurIPS 2022 Workshop on Machine Learning Safety , year =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection NeurIPS 2022 Workshop on Machine Learning Safety , year =

Reference 4

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:28.120632Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 1e312d81-5c65-497a-a3fd-f13df30e2d5c · outbound

This paper cites 2024 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2024 , url =

Reference 5

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:28.265132Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 52a968b0-98b4-463d-be9f-63e104767b54 · outbound

This paper cites 2024 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2024 , url =

Reference 6

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:28.413984Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation c17a6101-563e-4298-989e-b21e998110f9 · outbound

This paper cites Prompt Injection Attacks and Defenses in.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Prompt Injection Attacks and Defenses in

Reference 7

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:28.534536Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 11c4323f-ffa5-4b6d-89f5-9b316091fe50 · outbound

This paper cites 2024 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2024 , url =

Reference 8

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:28.678620Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 74894152-b036-4f5e-816d-bca2418cfd10 · outbound

This paper cites 2024 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2024 , url =

Reference 9

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:28.840151Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 76bfd947-e939-48c5-a95f-a8a9a582705d · outbound

This paper cites Attacking.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Attacking

Reference 10

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:28.958281Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 3a0c74c1-1049-40e7-a6b9-f1e2837bf3e8 · outbound

This paper cites 2024 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2024 , url =

Reference 11

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.116748Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 25a1bc25-61a8-463a-b2f4-7cdf136081d2 · outbound

This paper cites 2024 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2024 , url =

Reference 12

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.240479Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation f8c4f50b-4413-47ea-b224-a7971dae13c3 · outbound

This paper cites an unresolved cited work.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Unresolved cited work

Reference 13

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.340623Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation c9a1d163-31d2-4b13-818b-0b228c904dac · outbound

This paper cites 2024 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2024 , url =

Reference 14

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.412501Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation ce2a988f-53b1-4b48-8d9f-b5ee5b387546 · outbound

This paper cites 2024 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2024 , url =

Reference 15

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.415803Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 9d638403-f8ee-45d8-9fce-e9e46c902f6c · outbound

This paper cites Jailbreaking Black Box Large Language Models in Twenty Queries.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Jailbreaking Black Box Large Language Models in Twenty Queries

Reference 16

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.418864Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation f6182295-1ae6-4d67-9182-e85e0d224286 · outbound

This paper cites Universal and Transferable Adversarial Attacks on Aligned Language Models.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Universal and Transferable Adversarial Attacks on Aligned Language Models

Reference 17

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.422657Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation f7ee0831-6047-4dda-b90b-85658c2f1e46 · outbound

This paper cites 2024 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2024 , url =

Reference 18

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.426297Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 846b7641-4a4a-4091-9478-3d0a9f6a37ff · outbound

This paper cites Constitutional.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Constitutional

Reference 19

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.429349Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation fc6aff80-f33c-4332-bba6-22d64f83a5cf · outbound

This paper cites Advances in Neural Information Processing Systems , volume =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Advances in Neural Information Processing Systems , volume =

Reference 20

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.432193Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation f9790650-daa7-4e46-9ef5-7cca0dd413b6 · outbound

This paper cites Advances in Neural Information Processing Systems , volume =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Advances in Neural Information Processing Systems , volume =

Reference 21

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.435175Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation c2bc4bc7-2dbf-4a2c-89a8-42902bc26b8f · outbound

This paper cites and others , booktitle =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection and others , booktitle =

Reference 22

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.438273Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 189f4930-9815-4868-996a-6f9dc90aca16 · outbound

This paper cites Advances in Neural Information Processing Systems , volume =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Advances in Neural Information Processing Systems , volume =

Reference 23

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.441044Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 4ce5cec2-84dc-456c-b2c6-6d189f232b81 · outbound

This paper cites Proceedings of the Annual Meeting of the Association for Computational Linguistics , year =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Proceedings of the Annual Meeting of the Association for Computational Linguistics , year =

Reference 24

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.443703Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 1bb4f15a-1882-4314-927d-ce47e14435ae · outbound

This paper cites Advances in Neural Information Processing Systems , volume =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Advances in Neural Information Processing Systems , volume =

Reference 25

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.446470Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 8fc0feaa-bbf0-412a-aa5f-0af62b0fbdc7 · outbound

This paper cites Compromising.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Compromising

Reference 26

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.449028Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 8e2b9935-0c73-4e56-a298-75b7498d5e79 · outbound

This paper cites 2024 , url =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection 2024 , url =

Reference 27

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.451950Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 063cf924-b0eb-4471-b496-b0454940bf64 · outbound

This paper cites Frontiers of Computer Science , year =.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Frontiers of Computer Science , year =

Reference 28

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.454633Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 7e33a91c-c267-499a-96d0-abc06cc61931 · outbound

This paper cites The Rise and Potential of Large Language Model Based Agents: A Survey.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection The Rise and Potential of Large Language Model Based Agents: A Survey

Reference 29

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.457576Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation c9373fb1-e977-40ae-a268-4deb497ea6a1 · outbound

This paper cites Prompt Infection:.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Prompt Infection:

Reference 30

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.460950Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation d50f9a3d-1c06-4442-938e-35e905fd822f · outbound

This paper cites Red-Teaming.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Red-Teaming

Reference 31

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.463791Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 16fce5b9-dc4e-4b9f-8ae6-446fd23733d5 · outbound

This paper cites Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on

Reference 32

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.466737Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation be1d85a4-5975-489e-9f0b-6517f3b994b3 · outbound

This paper cites A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents

Reference 33

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.469563Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 68444501-b105-4269-9ecc-3c00fdd0f4cb · outbound

This paper cites Correlated Errors in Large Language Models.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Correlated Errors in Large Language Models

Reference 34

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.473018Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 84e6eda4-d9c1-4aa6-8980-b53339ec34b6 · outbound

This paper cites Self-Inconsistency in.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Self-Inconsistency in

Reference 35

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.476262Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 434c2944-cfc8-4d31-83f4-cebc5b6a34f8 · outbound

This paper cites Agents at Risk: How Users Unwittingly Undermine LLM Safety.

PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection Agents at Risk: How Users Unwittingly Undermine LLM Safety

Reference 36

Resolution: unresolved; no resolver link, observed 2026-08-02T15:17:29.479184Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Pith citing papers

No inbound Pith citation observations are available.