{"as_of":"2026-08-09T19:32:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:f06140baecb2327764dec2689fd896d7b7f711d74322282da7d009279da79812","coverage":[{"denominator":94,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":94,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T00:54:57.479602Z","state":"measured"},{"denominator":94,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":94,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.02657/citation-record","integrity":"/paper/2608.02657/integrity","json":"/paper/2608.02657/citation-record.json","paper":"/paper/2608.02657"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.266213Z","title":"Get my drift? catching llm task drift with activation deltas","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.266213Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:59cafd066a06c633c61f77c02dc661f6f4fffd6fb470ef92a7cb95d189563e61","observation_id":"d08fbfda-b34e-4243-8c83-f0030f19dcda","resolution":{"observed_at":"2026-08-05T00:54:57.266213Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.268994Z","title":"Prompt leakage effect and mitigation strategies for multi-turn llm applications","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.268994Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:1071ee3e6d0985f7aca538cc040ac04d7842981653d0bee4d55e9151f8300320","observation_id":"66fab6d8-702a-4ecc-838a-c48f2fc9e688","resolution":{"observed_at":"2026-08-05T00:54:57.268994Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.271636Z","title":"Understanding intermediate layers using linear classifier probes","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.271636Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:cd831477fdc17452df7d7c26b5873bad02b879338fadb676478053a409de17c7","observation_id":"91de3c53-35a6-415b-95ed-0cf40ab86c8f","resolution":{"observed_at":"2026-08-05T00:54:57.271636Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.274153Z","title":"IPIGuard : A novel tool dependency graph-based defense against indirect prompt injection in LLM agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.274153Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:63cdf894fd154219e6f46daed2c886f65967a0444cf7a55767ae4d65d0ec4fc5","observation_id":"ff90bb45-4397-4ff9-956f-2edd8c5bd96a","resolution":{"observed_at":"2026-08-05T00:54:57.274153Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.276562Z","title":"Jailbreaking leading safety-aligned LLM s with simple adaptive attacks","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.276562Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:c7242c2574d6465f37489de031d7c157ee44d9e0a5564766515160f26dffadcd","observation_id":"e2e9699b-5c2f-453f-b38f-89a9b3e2222b","resolution":{"observed_at":"2026-08-05T00:54:57.276562Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.279035Z","title":"Many-shot jailbreaking","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.279035Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:e1399cc4277ec83df37864a14c855219f03e16e168fd15863b7c5919dba71530","observation_id":"8cc9763a-8480-4557-8eb1-bb1e64a55016","resolution":{"observed_at":"2026-08-05T00:54:57.279035Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.281666Z","title":"Refusal in language models is mediated by a single direction","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.281666Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:24c33a8b84c6ae84c024d2ec3d68c297e3a31d77ff503bcaf9a4fa3fbdf5674a","observation_id":"30cb68a9-404a-4d88-919d-0e074d8523f5","resolution":{"observed_at":"2026-08-05T00:54:57.281666Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.11926","last_updated":"2025-03-14T23:50:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-03-14T23:50:34Z","title":"Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.11926","snapshot_observed_at":"2026-08-05T00:54:57.283796Z","title":"Monitoring reasoning models for misbehavior and the risks of promoting obfuscation","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.283796Z"},"links":{"cited_paper":"/paper/2503.11926","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:1a8a57b33ab0d46c44a84ab29b5a8dd499e133af8a744ba302f2e3ce5a83180e","observation_id":"1dad014f-f556-4ac1-b8e3-dad75af88d13","resolution":{"observed_at":"2026-08-05T00:54:57.283796Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.287306Z","title":"Probing classifiers: Promises, shortcomings, and advances","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.287306Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:1bf3b85915702c518fb6a20364c5f65795facf5d48bdf536e76935e9406c3b1e","observation_id":"0e0e27b3-5bb3-4cae-92ed-2fa41f461abf","resolution":{"observed_at":"2026-08-05T00:54:57.287306Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.289469Z","title":"Language models can explain neurons in language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.289469Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:98073c04d911bc96dda2178d20b846f128d41098ebbccac5a30cd3b26c39ce3e","observation_id":"2e8ce96e-6279-4039-9eed-96ffd287cead","resolution":{"observed_at":"2026-08-05T00:54:57.289469Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.291652Z","title":"Bogdan, Uzay Macar, Neel Nanda, and Arthur Conmy","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.291652Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:66c07461716f166af4550b91d3cf27ab78e9ab2676e4de1425dce55cac74fb17","observation_id":"63e5737b-96ba-42cb-82fd-4e0fb201b452","resolution":{"observed_at":"2026-08-05T00:54:57.291652Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2603.05488","last_updated":"2026-05-28T15:25:50Z","snapshot_observed_at":"2026-07-15T14:29:32.870267Z","submitted_at":"2026-03-05T18:55:16Z","title":"Reasoning Theater: Disentangling Model Beliefs from Chain-of-Thought","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2603.05488","snapshot_observed_at":"2026-08-05T00:54:57.293790Z","title":"Reasoning theater: Disentangling model beliefs from chain-of-thought","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.293790Z"},"links":{"cited_paper":"/paper/2603.05488","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:f6849a64dac5bedfa21a2a1e50c1bd936cbbe0b8e5302d83cb88fce74b0887ba","observation_id":"a6a263c8-2f67-4aae-9e20-a3d706d5937e","resolution":{"observed_at":"2026-08-05T00:54:57.293790Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.296237Z","title":"Towards monosemanticity: Decomposing language models with dictionary learning","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.296237Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:bc792cd135a50dba199bb4f690ce54d91826ddecdbb17ca11ddf82d11aa8023a","observation_id":"a28847c1-2e00-4907-a14e-ef00c900d453","resolution":{"observed_at":"2026-08-05T00:54:57.296237Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.298288Z","title":"Discovering latent knowledge in language models without supervision","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.298288Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:ad13c37c5df35c831349b24a0bd8bb69cb370d77bb95ab7f250176949ca897af","observation_id":"63baef44-47d6-4ed6-83ab-0f7c47353381","resolution":{"observed_at":"2026-08-05T00:54:57.298288Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.300455Z","title":"Vpi-bench: Visual prompt injection attacks for computer-use agents","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.300455Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:86eee5a02e3a0cf78d01aacef8603911894e13355e367cae62d269f355b4b875","observation_id":"56473867-639c-4524-b872-3b520e6d560d","resolution":{"observed_at":"2026-08-05T00:54:57.300455Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.302659Z","title":"Ghostei-bench: Do mobile agents resilience to environmental injection in dynamic on-device environments? In ICLR, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.302659Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:3b235f9414c85ecb10d5056d012f13226c33cc9ca7837e1bcd4790ff231c6160","observation_id":"72eeef71-88fe-4937-8ebc-8b431c533a5d","resolution":{"observed_at":"2026-08-05T00:54:57.302659Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.659817Z","title":"Struq: Defending against prompt injection with structured queries","venue":null,"work_id":"d0cf7c92-79e4-458f-99a4-082eb1526a6c","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.304848Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:6e8433bd20a89bc2fbd13eb408c5148688ffe1f23f74dc7155d711c4fe06ac67","observation_id":"4008ff70-ac65-45f8-949c-28426be73e33","resolution":{"observed_at":"2026-08-05T00:54:58.662574Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.307016Z","title":"Secalign: Defending against prompt injection with preference optimization","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.307016Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:4ba39cffeee3a681e259016ffe1d856936128b27b0dee9fcc906c2fd0e3766e8","observation_id":"89feb34e-ed98-4c2f-be38-e21986457ec7","resolution":{"observed_at":"2026-08-05T00:54:57.307016Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2508.04010","last_updated":"2025-08-06T01:49:32Z","snapshot_observed_at":"2026-08-09T10:49:53.210181Z","submitted_at":"2025-08-06T01:49:32Z","title":"HarmonyGuard: Toward Safety and Utility in Web Agents via Adaptive Policy Enhancement and Dual-Objective Optimization","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.04010","snapshot_observed_at":"2026-08-05T00:54:57.309027Z","title":"Harmonyguard: Toward safety and utility in web agents via adaptive policy enhancement and dual-objective optimization","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.309027Z"},"links":{"cited_paper":"/paper/2508.04010","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:872eaceb3c52b07088d9119698b47518339b9901f6f543c9d31344483e193349","observation_id":"a36b39f7-071b-415a-89e2-6df75d2f875a","resolution":{"observed_at":"2026-08-05T00:54:57.309027Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.03574","last_updated":"2025-05-06T14:34:21Z","snapshot_observed_at":"2026-08-07T15:49:30.311074Z","submitted_at":"2025-05-06T14:34:21Z","title":"LlamaFirewall: An open source guardrail system for building secure AI agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.03574","snapshot_observed_at":"2026-08-05T00:54:57.311523Z","title":"Llamafirewall: An open source guardrail system for building secure ai agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.311523Z"},"links":{"cited_paper":"/paper/2505.03574","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:5e07547eae0143400a48969767d9455725ad46c5bfb379cd688c4e9964ba8583","observation_id":"15ec6143-48ab-4c62-a8cc-746c2cf77db2","resolution":{"observed_at":"2026-08-05T00:54:57.311523Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.313974Z","title":"Constitutional classifiers++: Efficient production-grade defenses against universal jailbreaks","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.313974Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:31c6badae6536aec83e441ea7ca15ecf19d4b58cc979fc4a183e52c28d743669","observation_id":"b234a609-1001-450b-9c75-f1abcba9a8f2","resolution":{"observed_at":"2026-08-05T00:54:57.313974Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.646697Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents","venue":null,"work_id":"fd6000cc-c904-400e-9b5a-068516b94f30","year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.316139Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:acda6f47659749f26f339f86b6ac8bee07563ec6d3fed0ee425af0fb057f96bb","observation_id":"b0c0b495-3417-41f4-986a-d71828e8602e","resolution":{"observed_at":"2026-08-05T00:54:58.650024Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-07T19:59:01.081751Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-05T00:54:57.318137Z","title":"Defeating prompt injections by design","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.318137Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:4f138b1cfd911559f2027bf2a7e708948977cbc1e8643f5c11a29390bc696c9a","observation_id":"8ac70048-ae95-416f-a63d-231248544b44","resolution":{"observed_at":"2026-08-05T00:54:57.318137Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.638866Z","title":"`` I ' ve decided to leak'': Probing internals behind prompt leakage intents","venue":null,"work_id":"366815c0-cdab-4498-b3f4-666d9341e7a8","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.320597Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:4d9b77a1ab7e6bc484ffe77b3beeb6aaf378036a3e7a7184c2aa05fd890d39be","observation_id":"966911ef-668d-4ccc-ab43-9189468bdaca","resolution":{"observed_at":"2026-08-05T00:54:58.642090Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.631021Z","title":"Safesearch: Automated red-teaming of LLM -based search agents","venue":null,"work_id":"91cdbdcb-85cf-4ea9-8505-2c0f8087fa98","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.322864Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:7d543f142a30c6496429caac70236a83dc76ac74bf0426b2aade123cf8c5da79","observation_id":"d0d96b01-9b34-4a1c-b49f-a8102a1655d3","resolution":{"observed_at":"2026-08-05T00:54:58.633456Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.624098Z","title":"Memory injection attacks on llm agents via query-only interaction","venue":null,"work_id":"89826d7e-0f31-4c4e-ac3a-6289c352ca7c","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.324992Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:8c35689d2bd01470799dafe7362f89eeda203498ff6a3c784036f9b0100bd3a0","observation_id":"6d6264ae-f349-4461-8f4e-b0b2d5f9cefa","resolution":{"observed_at":"2026-08-05T00:54:58.626838Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.617213Z","title":"Transcoders find interpretable llm feature circuits","venue":null,"work_id":"5e36624c-3f64-4f28-b8f6-95dd59a543d9","year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.326982Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:9f9ef496cf310853faab725a1c4c90ba0a6a20c6123c46f01321b7639186a4c4","observation_id":"2eaef61b-b7c2-4df6-be65-02cc20df039d","resolution":{"observed_at":"2026-08-05T00:54:58.619747Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.329002Z","title":"How vulnerable are ai agents to indirect prompt injections? insights from a large-scale public competition","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.329002Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:9963bdfce12a9171dbd3ffdcc767e59c34d5e380a63ae5649f642811a575b89e","observation_id":"0b403446-6ee0-4ab2-aecb-e7567a98b1cf","resolution":{"observed_at":"2026-08-05T00:54:57.329002Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.609690Z","title":"WASP : Benchmarking web agent security against prompt injection attacks","venue":null,"work_id":"d5813f8d-b66f-4b0c-9c5d-0d9bf94e691c","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.331204Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:d4dbcf58bc83441f473425cd775782d164d9b439482bd78de1d25d24bd8ba1ae","observation_id":"c0cbdf7b-546c-42aa-b51a-009e357d52dc","resolution":{"observed_at":"2026-08-05T00:54:58.612970Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.602083Z","title":"Patchscopes: A unifying framework for inspecting hidden representations of language models","venue":null,"work_id":"bafba850-f612-4a9e-954f-3f126f3c5c7b","year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.333380Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:cb0f2aa0b57923684bda71f40a3d1dfb70c779add6878751f88f1064fd651d3c","observation_id":"64116890-5e9e-4b32-90d6-122cb6145892","resolution":{"observed_at":"2026-08-05T00:54:58.605163Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.595091Z","title":"Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection","venue":null,"work_id":"5c90aa3b-42b6-4c15-bd01-dfd78ea5bb88","year":2023},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.335491Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:7fb4d6e858bed7dfb948cd333469a3ab45cd77db62e2409b2e8749535526fd64","observation_id":"19713e46-219d-41af-8531-70043a946e9f","resolution":{"observed_at":"2026-08-05T00:54:58.597790Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.587893Z","title":"Agent smith: a single image can jailbreak one million multimodal llm agents exponentially fast","venue":null,"work_id":"1e01ee20-89e5-48fa-8039-e8a3011d59b7","year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.337811Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:805989927a1b30281c390d936ec957570824eb84c110e7b96120e6bf1d05a580","observation_id":"52dae4b0-414e-4e78-8dc9-83e6b29ee94d","resolution":{"observed_at":"2026-08-05T00:54:58.590704Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.580851Z","title":"Attriguard: Defeating indirect prompt injection in LLM agents via causal attribution of tool invocations","venue":null,"work_id":"8310bb5c-c01d-422e-9ccf-9d9f68e7b326","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.340036Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:55b34111ebdeef53bf34cf4c51dd4710635ce307bbe1a6b31f15c4e08c12fe72","observation_id":"151fd113-bd15-441c-a967-ae04ca36a7e6","resolution":{"observed_at":"2026-08-05T00:54:58.583531Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.342044Z","title":"Internal representations as indicators of hallucinations in agent tool selection","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.342044Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:7353b491bac259be553f410862288ee07a12723e52a20b5e916e7d744caf0412","observation_id":"e8380c2b-1bff-4d2a-aa42-494dbe876702","resolution":{"observed_at":"2026-08-05T00:54:57.342044Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-08-05T00:54:57.344108Z","title":"Defending against indirect prompt injection attacks with spotlighting","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.344108Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:fa8fbdc09232bbaf86c22c466875428c2bef67938ea580162d987923428100b8","observation_id":"857e5167-3ac0-41a7-a5e7-a6535be22dec","resolution":{"observed_at":"2026-08-05T00:54:57.344108Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.574193Z","title":"Hsu, and Pin-Yu Chen","venue":null,"work_id":"f2eff6e5-9cf6-400d-8eb0-a11921e963d0","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.346663Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:9df8bc168cb506d3ca2dc03c88033169176c3975819d85694f027bb00e159cfe","observation_id":"1b1909c9-be26-4bba-9d26-689ae0a87232","resolution":{"observed_at":"2026-08-05T00:54:58.576749Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.566818Z","title":"Safepath: Preventing harmful reasoning in chain-of-thought via early alignment","venue":null,"work_id":"7918993c-4b99-40ed-b6f0-aef3c3d6aae1","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.348740Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:5441b18d8f719793cccb406ec7d3d6ca13b016739b68a534fb29454366b6161b","observation_id":"753b8d18-880a-439d-9d6c-5efc25da638b","resolution":{"observed_at":"2026-08-05T00:54:58.569753Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.559820Z","title":"Llm internal states reveal hallucination risk faced with a query","venue":null,"work_id":"17d42477-584d-47fe-8817-6f54be224d43","year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.350855Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:ce6db0acb0ae8c906f9ceb394aa8b3f695ab97b1731c372993f78fbc33e1be5c","observation_id":"20cdfd49-d376-474e-a572-fa398ec22ad7","resolution":{"observed_at":"2026-08-05T00:54:58.562396Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.552481Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents","venue":null,"work_id":"7a943253-9f3a-4eb7-b90a-e73814dfbd13","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.352864Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:bb4b3ce413c566c32c4aec6698b904525535da45ad4d54ff0e1fefbdefee4df4","observation_id":"6ba31737-4ee0-47ed-b5f0-f41c446651a3","resolution":{"observed_at":"2026-08-05T00:54:58.555511Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.545230Z","title":"Promptlocate: Localizing prompt injection attacks","venue":null,"work_id":"3f48441d-72fa-418c-97d2-fd864c5a91a4","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.354992Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:5ce827d23b9040a80ab00ad932a836d9b4dd6c0907d34ba9fa7c9529590d4201","observation_id":"09de3710-9633-48d0-9eb8-04646cbf2200","resolution":{"observed_at":"2026-08-05T00:54:58.548137Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.357115Z","title":"Activation oracles: Training and evaluating llms as general-purpose activation explainers","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.357115Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:019660bac471bb32236b576a18378969a194c091b7db869764f6342e9972bf77","observation_id":"2fc9f139-ca42-42a9-9e5a-391b474f2f18","resolution":{"observed_at":"2026-08-05T00:54:57.357115Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.537931Z","title":"Le, and Tomas Pfister","venue":null,"work_id":"595368da-8f8b-4bac-af45-d9d513d84a5c","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.359236Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:84af886720abe36452eb336fede0000c85718c11e1839030ab4ed62bb0ef9f84","observation_id":"c531c47a-d446-4eb7-b2a2-98407dffcc16","resolution":{"observed_at":"2026-08-05T00:54:58.540719Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.530875Z","title":"Hendryx, Summer Yue, and Zifan Wang","venue":null,"work_id":"61150f08-b3d1-443e-9506-6d82156a5714","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.361278Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:1842f205d0910ffc861c603152e16ce6247affd4c80271a0c2ea0d55a7752797","observation_id":"132747cf-e63c-4979-82ce-86949a8c70b2","resolution":{"observed_at":"2026-08-05T00:54:58.533495Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.523875Z","title":"OS -harm: A benchmark for measuring safety of computer use agents","venue":null,"work_id":"8445ef22-6f29-49ca-9f84-5c621c8ba5eb","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.363431Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:84e460611b34af34106228a0c59656774c61f4b16e5ba79ff112c076068e8035","observation_id":"9c11e71a-89f3-4c64-94a6-067cddbbacce","resolution":{"observed_at":"2026-08-05T00:54:58.526544Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.517227Z","title":"Measuring AI ability to complete long software tasks","venue":null,"work_id":"d32325f4-e18a-4ccb-b9df-6cc08abf7c6f","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.365409Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:d47e7ced046cbb50da7b2aeb9c021cbfecb1fb0879a7bc182d80bcd0561349ae","observation_id":"5aaea5ae-c316-4783-9714-1b9170c73a5a","resolution":{"observed_at":"2026-08-05T00:54:58.519743Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.510125Z","title":"Efficient memory management for large language model serving with pagedattention","venue":null,"work_id":"53a5c5d0-1b75-471c-9a0b-7e6379ff0993","year":2023},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.367501Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:c6597d92750e5c6f22581342a57a94f13234b5a266f030cef8986b9d78bbcf85","observation_id":"bbed69b4-bd07-4688-a003-e43f2c3f5d5d","resolution":{"observed_at":"2026-08-05T00:54:58.512771Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.13702","last_updated":"2023-07-17T01:08:39Z","snapshot_observed_at":"2026-07-31T04:21:27.501709Z","submitted_at":"2023-07-17T01:08:39Z","title":"Measuring Faithfulness in Chain-of-Thought Reasoning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.13702","snapshot_observed_at":"2026-08-05T00:54:57.369612Z","title":"Measuring faithfulness in chain-of-thought reasoning","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.369612Z"},"links":{"cited_paper":"/paper/2307.13702","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:c7fe3c94e57b856f35d3f0d950890ce43af85b4c6f859a38721596f78210cdc7","observation_id":"e7c7ba09-adf7-4d49-99a4-c14604383937","resolution":{"observed_at":"2026-08-05T00:54:57.369612Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-05T00:54:57.371881Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.371881Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:c84fbba609ae29d1720eddb10d7116d9ae672c2eacee5603024ed3f85d7e9b32","observation_id":"39a8ec91-4374-48f9-80f7-73e24dbbf8c2","resolution":{"observed_at":"2026-08-05T00:54:57.371881Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.503297Z","title":"Inference-time intervention: Eliciting truthful answers from a language model","venue":null,"work_id":"63061216-f660-4fdb-82e3-86f5750dc9ba","year":2023},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.374245Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:3145acc0dbfb509258bb4fdd378f5e2c143b98040ebd09b0818fc31aef16a35d","observation_id":"f42caaef-7e1f-422e-8307-c64c9ca00cbe","resolution":{"observed_at":"2026-08-05T00:54:58.505775Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2606.22864","last_updated":"2026-06-22T05:13:25Z","snapshot_observed_at":"2026-08-02T16:33:47.655259Z","submitted_at":"2026-06-22T05:13:25Z","title":"When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents","version":1},"cited_work":{"arxiv_id":"2606.22864","doi":null,"metadata_source":"pith","pith_arxiv_id":"2606.22864","snapshot_observed_at":"2026-08-05T00:54:57.894433Z","title":"When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents","venue":"cs.LG","work_id":"e91990bb-6aa1-4650-ba62-8403da10b70b","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":50,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.376303Z"},"links":{"cited_paper":"/paper/2606.22864","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:bad36632e07a82d3be968070c53d5459dcf74e09a22aa3f82aae667d18e489f8","observation_id":"6fcfaa42-5014-467e-adb2-77b49e572752","resolution":{"observed_at":"2026-08-05T00:54:57.900478Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.496604Z","title":"Eia: Environmental injection attack on generalist web agents for privacy leakage","venue":null,"work_id":"40cd247b-75d7-4cc5-88f0-770e52377a22","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.378711Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:7e9557dc1f77294ffff9c547081dbd69b79eafaae262cbd3c4d602f6d81f4277","observation_id":"e3e69242-191e-4971-bbae-f7de1d05b9dc","resolution":{"observed_at":"2026-08-05T00:54:58.499125Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.380837Z","title":"Vigil: Defending llm agents against tool stream injection via verify-before-commit","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.380837Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:5fc5953358a2e400320dca4a2e463ceebb9ec9ffe52ff0c532f5c31e0dc0d5fa","observation_id":"a21ab69d-9501-4b4d-8754-cdc997fe6bdd","resolution":{"observed_at":"2026-08-05T00:54:57.380837Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.13630","last_updated":"2026-05-11T07:00:12Z","snapshot_observed_at":"2026-07-06T23:01:37.207817Z","submitted_at":"2026-04-15T08:59:00Z","title":"SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deployment","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.13630","snapshot_observed_at":"2026-08-05T00:54:57.382991Z","title":"Safeharness: Lifecycle-integrated security architecture for llm-based agent deployment","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":53,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.382991Z"},"links":{"cited_paper":"/paper/2604.13630","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:c1cc6458ac8fe5d69823ffea81039dccb026791e02953c2b57fcebea69e6e23b","observation_id":"58686ce0-c64a-498a-bb7f-8efaaba781bf","resolution":{"observed_at":"2026-08-05T00:54:57.382991Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.385335Z","title":"Traceaegis: Securing llm-based agents via hierarchical and behavioral anomaly detection","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.385335Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:031ab164ab14c15a6a914e5ab46006d000e97588060efb0220dd56516cbdb7cb","observation_id":"05a13b9a-444d-4532-bbee-ba60d073641f","resolution":{"observed_at":"2026-08-05T00:54:57.385335Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-07-06T15:40:27.639368Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-08-05T00:54:57.388047Z","title":"Prompt injection attack against llm-integrated applications","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.388047Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:b4ab44d7e0a9e257d7bc7c7608721273b9f259bbe8d9501b09e9f00d27d74988","observation_id":"0979778b-760e-4726-baed-2337ad6f4e30","resolution":{"observed_at":"2026-08-05T00:54:57.388047Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.489811Z","title":"Formalizing and benchmarking prompt injection attacks and defenses","venue":null,"work_id":"7789ef89-ba04-4dc0-8218-5ba378fba973","year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.390559Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:c801bf44a45cb3ec92dacedbfda11d6fa2ca6fd682868ba78f09534e6684974a","observation_id":"7b178dcf-91be-47ec-9a6d-c6d8c194ea2f","resolution":{"observed_at":"2026-08-05T00:54:58.492224Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.482882Z","title":"Bogdan, Senthooran Rajamanoharan, and Neel Nanda","venue":null,"work_id":"4e9253ed-5432-45b6-be95-1918c572b56c","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.392735Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:6acbfa33ef62ee5e1973e59bf5c516f899ec3f6458e6d4f0219d1a12e0466b34","observation_id":"71eee48b-2e5a-47dc-bf87-71ffb9f381d7","resolution":{"observed_at":"2026-08-05T00:54:58.485385Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.475726Z","title":"s1: Simple test-time scaling","venue":null,"work_id":"81a61ee9-e95b-45cf-bffc-c8dc0acd9b1e","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.394793Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:865a6e72f59f86a27c3023605fdec044496b0d37ec27f47042abcf50b605cdcf","observation_id":"c4d8cee7-3389-4157-b64f-ca4ec9ef9547","resolution":{"observed_at":"2026-08-05T00:54:58.478348Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.09023","last_updated":"2025-10-10T05:51:04Z","snapshot_observed_at":"2026-08-03T03:11:42.084785Z","submitted_at":"2025-10-10T05:51:04Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2510.09023","snapshot_observed_at":"2026-08-05T00:54:57.396764Z","title":"Attacker moves second: Stronger adaptive attacks bypass defenses against llm jailbreaks and prompt injections","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.396764Z"},"links":{"cited_paper":"/paper/2510.09023","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:d9be6da9c6343d79a405ef3c11215b7a0fc16e6fd9bb7a861a8ea4f23d177eb2","observation_id":"893b2cf9-786d-4bd2-aa9f-68352e604a15","resolution":{"observed_at":"2026-08-05T00:54:57.396764Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.468852Z","title":"GPT-5.6 System Card","venue":null,"work_id":"da3c9172-9513-457e-a52a-829baed8a8ab","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":60,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.399009Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:64c5275fc99d29733b60ef9d190a97920c224ce67d475fbfa67a58a85880c55f","observation_id":"c718d3d1-ec12-45bf-b72d-60bea70b0055","resolution":{"observed_at":"2026-08-05T00:54:58.471150Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.462006Z","title":"GPT‑5.5 System Card","venue":null,"work_id":"a4e05695-89cf-4763-9f7d-2c5424ce8684","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":61,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.401172Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:77136ff0d29801a411dcc2af1c2a333024ac212c0256ab3dc205da159222dae7","observation_id":"04037920-c5bb-4d12-9836-f7b1aad4e620","resolution":{"observed_at":"2026-08-05T00:54:58.464321Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.454821Z","title":"LLM s know more than they show: On the intrinsic representation of LLM hallucinations","venue":null,"work_id":"a802e8eb-fee3-4dca-bc30-8fc8e26f1240","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":62,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.403270Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:d6e5a8431934d38b9bc309275efd1284090d4ad18e79d0795cb2f33d1f2613ef","observation_id":"e515aa37-cf34-42f9-8805-3b0760dd2846","resolution":{"observed_at":"2026-08-05T00:54:58.457553Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.447881Z","title":"Owasp top 10 for agentic applications for 2026, 2025","venue":null,"work_id":"8f2bb2ab-0eeb-4101-861c-ad63b876d0ec","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":63,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.405390Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:d21bf8498c4490142b4f990e3f6c5541fdacbb62a7dd91d1267b6996d0d9d4d2","observation_id":"9a0ba171-7d4a-472c-9b56-b401a90e7323","resolution":{"observed_at":"2026-08-05T00:54:58.450194Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.440479Z","title":"Latent QA : Teaching LLM s to decode activations into natural language","venue":null,"work_id":"472f7119-652f-44d6-a0d4-8c5a196f7b5c","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":64,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.407798Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:8d32dd8410a0cb2dc6d41f24bafaa0f710f5e51f66bc9e4a16bdb9cab7f9edef","observation_id":"d6bff5c4-1b84-4aa0-81c9-a23ebc63fc4a","resolution":{"observed_at":"2026-08-05T00:54:58.443308Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.409979Z","title":"The linear representation hypothesis and the geometry of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.409979Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:9067894e79a893f9a9e245d41eb139c70f09682c547cb61f653caf887c89d72d","observation_id":"78ca08a7-dca1-4c8f-89db-4590e1a59204","resolution":{"observed_at":"2026-08-05T00:54:57.409979Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.412072Z","title":"Scikit-learn: Machine learning in python","venue":null,"work_id":null,"year":2011},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":66,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.412072Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:aad8fc1bedc23f3259137a5d3acfb24ac21357323a8e7afc46f164cf441e9f0f","observation_id":"d03875ff-f35d-4ec4-98f4-7b63a190030b","resolution":{"observed_at":"2026-08-05T00:54:57.412072Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.424769Z","title":"Ignore previous prompt: Attack techniques for language models","venue":null,"work_id":"ecb292fb-882a-4cbb-98e1-df0e92febee0","year":2022},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.414164Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:1b5669b652f7701960e0149ed155730e305b06ff3a80c5012d714b3487e7cc6b","observation_id":"bd11d624-c7f0-4fc0-97cc-22b34db60500","resolution":{"observed_at":"2026-08-05T00:54:58.427292Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.417448Z","title":"Steering llama 2 via contrastive activation addition","venue":null,"work_id":"f907bf86-5af6-428d-8e02-c2e0584878ed","year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":68,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.416198Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:6bd5c739cded66be59b9bec2913f423f3ea487627a3fed4bc4b4025394f178b3","observation_id":"5d5ee724-8cc8-41e5-ae4f-6fe05c7b9439","resolution":{"observed_at":"2026-08-05T00:54:58.420169Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.410071Z","title":"Great, now write an article about that: The crescendo multi-turn llm jailbreak attack","venue":null,"work_id":"d87ef4b5-2271-4add-8ade-252acdf3f991","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.418435Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:d91483ac7407a18db7051210ddb7072faa8a540bea7f7941d76ca59d218755cb","observation_id":"86e8a1cb-7287-4fce-9297-bc8354c6458c","resolution":{"observed_at":"2026-08-05T00:54:58.412600Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.401875Z","title":"Ignore this title and hackaprompt: Exposing systemic vulnerabilities of llms through a global prompt hacking competition","venue":null,"work_id":"23ce15c1-90b6-4c54-a53f-c0fb8bc0edb4","year":2023},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":70,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.420548Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:847f27ea69ff9617820a867da5f6cdf591168ff9433732b9d2dc820ff48d190c","observation_id":"863184d2-8aa0-42be-814d-e1743bc4b8c1","resolution":{"observed_at":"2026-08-05T00:54:58.404536Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.15219","last_updated":"2025-07-21T03:41:44Z","snapshot_observed_at":"2026-08-06T15:35:31.690602Z","submitted_at":"2025-07-21T03:41:44Z","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2507.15219","snapshot_observed_at":"2026-08-05T00:54:57.422665Z","title":"Promptarmor: Simple yet effective prompt injection defenses","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":71,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.422665Z"},"links":{"cited_paper":"/paper/2507.15219","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:022643d3e87303c3e0980f60a4cf5ad54f3f3bc25a5122cbb0a886f10b25dce2","observation_id":"1f4cf12f-5893-4691-8b22-b7ef8e271ac8","resolution":{"observed_at":"2026-08-05T00:54:57.422665Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.424978Z","title":"Daniel Freeman, Theodore R","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":72,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.424978Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:a99dc557ab6f75ea3e039e91b8cc4c48ad4db381bc102b01f94faa6488837690","observation_id":"6472a7d6-1abf-4bdd-9660-c053fd77c4d3","resolution":{"observed_at":"2026-08-05T00:54:57.424978Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.390568Z","title":"Tensor trust: Interpretable prompt injection attacks from an online game","venue":null,"work_id":"5f272627-dca4-4d2a-afe4-cd3bea49c2a3","year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":73,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.427297Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:58bf35e5a4c3a77b78315d557e9ebfdb43fb07487e37b74955ce5740f5161afd","observation_id":"732b4a58-e52c-4901-aefa-6e93afcece8d","resolution":{"observed_at":"2026-08-05T00:54:58.393335Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-02T11:48:17.206729Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-05T00:54:57.429487Z","title":"The instruction hierarchy: Training llms to prioritize privileged instructions","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":74,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.429487Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:f53546493327cfc4c82a0ed3657620686f208f59dce1f3513ffbdbccd75c6967","observation_id":"304d6cf6-3ab3-4819-bb76-258b988ee964","resolution":{"observed_at":"2026-08-05T00:54:57.429487Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.383984Z","title":"Raccoon: Prompt extraction benchmark of llm-integrated applications","venue":null,"work_id":"d8e5bdec-d465-4606-a9f3-d10140cfb960","year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":75,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.431865Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:c534ba2fad20a8d02f5d1eb075e1ab2e3e11e06398d7f8738f6d71580355b858","observation_id":"79e606ba-5f75-47a2-b994-d20998f4f783","resolution":{"observed_at":"2026-08-05T00:54:58.386468Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.434034Z","title":"Agentarmor: Enforcing program analysis on agent runtime trace to defend against prompt injection","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":76,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.434034Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:e064c391c82c9f273e4f8a2d74cef74e8a5eac43f13ca39fcaad09ceb620a870","observation_id":"8f6737ba-73f0-4be0-a105-0ee6ecf82c30","resolution":{"observed_at":"2026-08-05T00:54:57.434034Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.377591Z","title":"Automatic layer selection for hallucination detection","venue":null,"work_id":"905e4022-1192-4dce-a43e-4dfdec5ae33e","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":77,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.436433Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:3ca12f472bd9dff7f55f9ceb4954560d02e5b6c287463475adc9b0a2ab80a54c","observation_id":"86c19c39-f6c1-4edf-83cc-2e23a301e48b","resolution":{"observed_at":"2026-08-05T00:54:58.379900Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.371129Z","title":"Defending against indirect prompt injection by instruction detection","venue":null,"work_id":"202d111a-901c-42d1-93ba-0eca33465e91","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":78,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.439190Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:08e46af3129a6568491a549250e497b77eab3a5ad6f7b0a688fcbb1ca26b8d4b","observation_id":"15774ad1-a8ea-4106-b132-d3bab8aa8cfd","resolution":{"observed_at":"2026-08-05T00:54:58.373573Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.364775Z","title":null,"venue":null,"work_id":"9287b4f3-f0e7-47ca-8ca4-06778a024b0e","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":79,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.441842Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:f75b5131118caf6ee6c158323c1a1b038819c1bcd2564de02bc759d10d6322b4","observation_id":"262a2156-1068-4ed9-8947-a7e8191de3eb","resolution":{"observed_at":"2026-08-05T00:54:58.367004Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.357776Z","title":"Guardagent: Safeguard LLM agents via knowledge-enabled reasoning","venue":null,"work_id":"87153ac4-6b73-4b97-95d9-4ef11d6c76d8","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":80,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.444509Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:0226e103d53cb7c92c544c2c50a2dff5964961efd9a6d0cc361443ec6ef206ce","observation_id":"6ef89cfa-42d3-4f04-9db6-015860dea1f5","resolution":{"observed_at":"2026-08-05T00:54:58.360303Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.09388","last_updated":"2025-05-14T13:41:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-05-14T13:41:34Z","title":"Qwen3 Technical Report","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.09388","snapshot_observed_at":"2026-08-05T00:54:57.447210Z","title":"Qwen3 technical report","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":81,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.447210Z"},"links":{"cited_paper":"/paper/2505.09388","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:f7eb432db24080775b6a4e4cfccd197ca706aa4486ba76528b142cf88ea69e1a","observation_id":"1d493fda-8275-47c3-aafe-268b4c406d5e","resolution":{"observed_at":"2026-08-05T00:54:57.447210Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.350727Z","title":"RAP-ID : Mechanistic prompt injection detection via impostor behavior analysis","venue":null,"work_id":"74d41305-2dd2-44d6-b83b-39b89489a941","year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":82,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.449730Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:6e67dc01ad34f202310794a142d8abbbe27039c6606d3f2daffd8c26fd314b9c","observation_id":"6fe9ac39-009d-4c96-9856-8ad2cf964fa3","resolution":{"observed_at":"2026-08-05T00:54:58.353289Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.22977","last_updated":"2026-04-17T17:15:28Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-10-27T03:58:29Z","title":"The Reasoning Trap: How Enhancing LLM Reasoning Amplifies Tool Hallucination","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2510.22977","snapshot_observed_at":"2026-08-05T00:54:57.452102Z","title":"The reasoning trap: How enhancing llm reasoning amplifies tool hallucination","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":83,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.452102Z"},"links":{"cited_paper":"/paper/2510.22977","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:a4dcc04685bfc1c3a592c37368bfc01b5f6887dc8999d39ce3acb9d9efea3e94","observation_id":"a53c2fca-6392-45a8-b876-3621dc0f40b5","resolution":{"observed_at":"2026-08-05T00:54:57.452102Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.343637Z","title":"Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents","venue":null,"work_id":"aff25e56-9642-4152-9944-a0fbf3ee0d30","year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":84,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.454810Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:4732bb2586d9e79951b354ce652e7f6572b08f68c5a5bcdba6b13958773484de","observation_id":"fba3050a-4673-47d2-9efc-7f027e406c2d","resolution":{"observed_at":"2026-08-05T00:54:58.346219Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.336355Z","title":"Adaptive attacks break defenses against indirect prompt injection attacks on llm agents","venue":null,"work_id":"d78ed9f8-b671-4376-ae2a-5b4513aaf226","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":85,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.457263Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:dc0a0885ff11b4bcc6a22145b99341b80397d0be9c27e51640479a7d0f6d2d4d","observation_id":"345000b5-0375-4133-b06d-bbf6b52daf2a","resolution":{"observed_at":"2026-08-05T00:54:58.339017Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.328518Z","title":"Agent security bench ( ASB ): Formalizing and benchmarking attacks and defenses in LLM -based agents","venue":null,"work_id":"8d9cf72c-1763-4f9a-8987-70a34d99035d","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":86,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.460027Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:e3285e2080abc29700cbb48040d83473da0548baa0def1107e6f85014fde11fd","observation_id":"1b723bfd-acaa-4072-bbc1-098d825e287e","resolution":{"observed_at":"2026-08-05T00:54:58.331177Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.321274Z","title":"Defense against prompt injection attacks via mixture of encodings","venue":null,"work_id":"5ba7bcf8-0f14-4279-ac16-c8cd3eb58a4e","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":87,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.462499Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:df49b708baeb86cef0238b085d885d90ac8e34f30a2c5d0e7c6365663783148c","observation_id":"6f700c98-420c-45a9-ab76-da7a81683c1a","resolution":{"observed_at":"2026-08-05T00:54:58.323879Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.313335Z","title":"Toolbehonest: A multi-level hallucination diagnostic benchmark for tool-augmented large language models","venue":null,"work_id":"ce0efe7e-ddf0-43f4-9272-3fbbfa6b4515","year":2024},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":88,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.464901Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:189549e7a258789b0a1a003db71c810d95937d40e9f2c5433b3551387901eb78","observation_id":"5244c1af-d5fe-4fe5-93b3-f3e7a6e68f39","resolution":{"observed_at":"2026-08-05T00:54:58.316206Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.306180Z","title":"Iheval: Evaluating language models on following the instruction hierarchy","venue":null,"work_id":"e5473eda-ddc2-4cc2-8085-1efd03627114","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":89,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.467554Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:1117fbff51ee7a3b53df372ed8d0ef06c75f176bf95adf5d1f801f3556df3186","observation_id":"ce8c1d43-1646-4b00-85f2-cf3c0e528993","resolution":{"observed_at":"2026-08-05T00:54:58.308618Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.297466Z","title":"Attention is all you need to defend against indirect prompt injection attacks in llms","venue":null,"work_id":"4473c0ac-68a2-4fe4-add8-d24661e75f38","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":90,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.470032Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:7eb73c2d8542364cda04113f54afd0f461da900368785650d6197b270a5a3542","observation_id":"21c06b96-d2df-4fde-88d3-b7fe379aefa8","resolution":{"observed_at":"2026-08-05T00:54:58.301434Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:58.290039Z","title":"MELON : Provable defense against indirect prompt injection attacks in AI agents","venue":null,"work_id":"076ae092-d685-4a88-83d6-d562c6ae5bfe","year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":91,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.472226Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:f9c0d12da8ed30613a59b88e47b6648c24d1987263884287d61ee1f82c0ae7e1","observation_id":"8223654b-2157-406e-b45c-b8ecaefc50dd","resolution":{"observed_at":"2026-08-05T00:54:58.292845Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.03870","last_updated":"2026-04-04T21:27:04Z","snapshot_observed_at":"2026-08-02T20:31:53.818509Z","submitted_at":"2026-04-04T21:27:04Z","title":"Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.03870","snapshot_observed_at":"2026-08-05T00:54:57.474502Z","title":"Your agent is more brittle than you think: Uncovering indirect injection vulnerabilities in agentic llms","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":92,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.474502Z"},"links":{"cited_paper":"/paper/2604.03870","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:93f80313f9f43b14fd048ff3c67ac9e50b40f3d08f955a1369907d56e2ff43b2","observation_id":"1ff8edec-df0e-4de2-a9c9-0cec8a9caa21","resolution":{"observed_at":"2026-08-05T00:54:57.474502Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.01405","last_updated":"2025-03-03T06:14:14Z","snapshot_observed_at":"2026-07-06T16:26:38.284922Z","submitted_at":"2023-10-02T17:59:07Z","title":"Representation Engineering: A Top-Down Approach to AI Transparency","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.01405","snapshot_observed_at":"2026-08-05T00:54:57.476993Z","title":"Representation engineering: A top-down approach to ai transparency","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":93,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.476993Z"},"links":{"cited_paper":"/paper/2310.01405","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:42a78a330d883830ee5d24a907a7d1debbce68bbbecd85b0eb8867b4c7b5ff8d","observation_id":"eb73bb13-2cdf-4042-afa8-7ed1493e80ed","resolution":{"observed_at":"2026-08-05T00:54:57.476993Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T00:54:57.479602Z","title":"Pishield: Detecting prompt injection attacks via intrinsic llm features","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":94,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.479602Z"},"links":{"citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:bad3751dc582cdef79c2273a134966e154cd623839c2890e6c1b02b6201a4876","observation_id":"b2b6154e-2b53-4867-94d6-4e6d841655d0","resolution":{"observed_at":"2026-08-05T00:54:57.479602Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure"},"reference_resolution":{"displayed":94,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":44,"verified_exact":1,"verified_fuzzy":49},"total_outbound_references":94},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 94 of 94 outbound references and 0 inbound Pith citation observations for arXiv:2608.02657."}