{"id":"df9ac892e53ae231621ac4e805ff78da07a5f620052385bbff06acf3f1fc0777","title":"arXiv cs.AI: CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts","argument":"The authors of CapLite argue that small language model (SLM) agents cannot reliably write the security artifacts used by several prompt-injection defenses. Their alternative derives its policy from tool schemas and commits write calls before reading tool results. It allows a write only when the user’s request states every argument that determines whom or what the write affects. The authors say this design prevents injected text from adding a write or directing one to an unstated recipient, amount, object or destination. In 13,935 attacked AgentDojo episodes, they report that no attack succeeds. They also report utility under attack comparable to CaMeL’s, with fewer tokens per episode than every other enforcement defense and the undefended agent. CapLite’s approach is to constrain consequential tool actions without relying on the agent’s model to write a security artifact. The evidence here is the paper’s abstract and reported benchmark results; how the approach performs beyond those episodes remains unknown.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"These results are reported in the paper’s abstract and concern the tested models and attacked AgentDojo episodes; the evidence provided does not establish performance on other tasks.","speaker":{"name":"Xu, Zimo, Liu, Wenzhuo, Nakayama, Hideki","roleAtSource":"Article author"},"source":{"title":"CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.17115","publishedAt":"2026-11-12","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors report that small language model agents failed to reliably write security artifacts for several enforcement defenses across the models they tested.","excerpt":"Across 15 open-weight models, 13 of them between 1.7B and 12B parameters, they cannot:","url":"https://arxiv.org/abs/2611.17115","relationship":"Source-stated"},{"text":"CapLite derives its policy from tool schemas and commits write calls before reading tool results.","excerpt":"CapLite, which derives its policy from the tool schemas, commits the write calls before any tool result is read","url":"https://arxiv.org/abs/2611.17115","relationship":"Source-stated"},{"text":"CapLite admits a write only when the user request states every argument that determines whom or what it affects.","excerpt":"admits a write only if every argument that decides whom or what it affects is stated in the user's request.","url":"https://arxiv.org/abs/2611.17115","relationship":"Source-stated"},{"text":"The authors report no successful attacks in 13,935 attacked AgentDojo episodes.","excerpt":"No attack succeeds in 13,935 attacked AgentDojo episodes.","url":"https://arxiv.org/abs/2611.17115","relationship":"Source-stated"},{"text":"The authors report utility under attack comparable to CaMeL's, with CapLite using fewer tokens than every other enforcement defense and the undefended agent.","excerpt":"CapLite reaches utility under attack comparable to CaMeL's (29.0% vs. 27.2%) with fewer tokens than every other enforcement defense and than the undefended agent: 17.1k per episode","url":"https://arxiv.org/abs/2611.17115","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.17115","checkedAt":"2026-11-14T09:04:06.900Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would CapLite’s reported attack resistance and utility change on tasks beyond the attacked AgentDojo episodes?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts","summary":"The authors of CapLite argue that small language model (SLM) agents cannot reliably write the security artifacts used by several prompt-injection defenses. Their alternative derives its policy from tool schemas and commits write calls before reading tool results. It allows a write only when the user’s request states every argument that determines whom or what the write affects. The authors say this design prevents injected text from adding a write or directing one to an unstated recipient, amount, object or destination. In 13,935 attacked AgentDojo episodes, they report that no attack succeeds. They also report utility under attack comparable to CaMeL’s, with fewer tokens per episode than every other enforcement defense and the undefended agent. CapLite’s approach is to constrain consequential tool actions without relying on the agent’s model to write a security artifact. The evidence here is the paper’s abstract and reported benchmark results; how the approach performs beyond those episodes remains unknown.","question":"How would CapLite’s reported attack resistance and utility change on tasks beyond the attacked AgentDojo episodes?","claims":[{"text":"The authors report that small language model agents failed to reliably write security artifacts for several enforcement defenses across the models they tested.","excerpt":"Across 15 open-weight models, 13 of them between 1.7B and 12B parameters, they cannot:","support":"source-stated"},{"text":"CapLite derives its policy from tool schemas and commits write calls before reading tool results.","excerpt":"CapLite, which derives its policy from the tool schemas, commits the write calls before any tool result is read","support":"source-stated"},{"text":"CapLite admits a write only when the user request states every argument that determines whom or what it affects.","excerpt":"admits a write only if every argument that decides whom or what it affects is stated in the user's request.","support":"source-stated"},{"text":"The authors report no successful attacks in 13,935 attacked AgentDojo episodes.","excerpt":"No attack succeeds in 13,935 attacked AgentDojo episodes.","support":"source-stated"},{"text":"The authors report utility under attack comparable to CaMeL's, with CapLite using fewer tokens than every other enforcement defense and the undefended agent.","excerpt":"CapLite reaches utility under attack comparable to CaMeL's (29.0% vs. 27.2%) with fewer tokens than every other enforcement defense and than the undefended agent: 17.1k per episode","support":"source-stated"}],"limitations":["These results are reported in the paper’s abstract and concern the tested models and attacked AgentDojo episodes; the evidence provided does not establish performance on other tasks."],"mediaId":"9a52a7565a239b1e9d8a0269d3b6ed832c813de1f3c41bd74543612057ccf4e9","correctionReason":null,"id":"df9ac892e53ae231621ac4e805ff78da07a5f620052385bbff06acf3f1fc0777","publicationId":"36613ae2-b176-4c2c-8aef-996ac2c174c0","version":1,"sourceUrl":"https://arxiv.org/abs/2611.17115","sourceTitle":"CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-12","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-13T07:40:12.310Z","createdAt":"2026-11-13T16:01:25.593Z","historical":false,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"9a52a7565a239b1e9d8a0269d3b6ed832c813de1f3c41bd74543612057ccf4e9","kind":"article","url":"https://arxiv.org/abs/2611.17115","sourceUrl":"https://arxiv.org/abs/2611.17115","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-13T15:36:25.691Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.17115","checkedAt":"2026-11-14T09:04:06.900Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v7","mediaId":"9a52a7565a239b1e9d8a0269d3b6ed832c813de1f3c41bd74543612057ccf4e9","confidence":0.81,"provider":"typesafe","model":"jev-1.13.0","inputHash":"6e540705b9ed8a2afea45ada2e074abf1c977540db6ea0c7c9a8800b6c2355dd","decidedAt":"2026-11-13T15:36:28.061Z"},"provenance":{"textHash":"01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e","observationId":"6f72d5dc295242467d6bb7c325c3e855a586d4a3515febd0c13eee569ec1cf5d","retrievedAt":"2026-11-13T15:36:25.365Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"dc956a96-cd6d-4381-8985-415107f4efef"},"reviewer":{"model":"gpt-6-luna","runId":"fda561a6-70e2-43e1-8e9f-d0496c27a7f5"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-13T16:01:25.593Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Xu, Zimo","url":null,"kind":"unknown"},{"name":"Liu, Wenzhuo","url":null,"kind":"unknown"},{"name":"Nakayama, Hideki","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Xu, Zimo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Xu, Zimo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.17115","locator":"head/meta[name=author|citation_author]"},"assertionId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T09:04:06.900Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23","sourceUrl":"https://arxiv.org/abs/2611.17115","contentSha256":"833e71d042e54b14a12372ef8d74a4e33f5057b4600ea707dcc1684b749dc105","textHash":"01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e","observedAt":"2026-11-14T09:04:06.900Z"}},{"actor":{"name":"Liu, Wenzhuo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Liu, Wenzhuo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.17115","locator":"head/meta[name=author|citation_author]"},"assertionId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T09:04:06.900Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23","sourceUrl":"https://arxiv.org/abs/2611.17115","contentSha256":"833e71d042e54b14a12372ef8d74a4e33f5057b4600ea707dcc1684b749dc105","textHash":"01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e","observedAt":"2026-11-14T09:04:06.900Z"}},{"actor":{"name":"Nakayama, Hideki","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Nakayama, Hideki","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.17115","locator":"head/meta[name=author|citation_author]"},"assertionId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T09:04:06.900Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23","sourceUrl":"https://arxiv.org/abs/2611.17115","contentSha256":"833e71d042e54b14a12372ef8d74a4e33f5057b4600ea707dcc1684b749dc105","textHash":"01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e","observedAt":"2026-11-14T09:04:06.900Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.17115","snapshotId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23","contentSha256":"833e71d042e54b14a12372ef8d74a4e33f5057b4600ea707dcc1684b749dc105","textHash":"01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e","observedAt":"2026-11-14T09:04:06.900Z","basis":"publisher-page-metadata","sourceLinks":43,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/df9ac892e53ae231621ac4e805ff78da07a5f620052385bbff06acf3f1fc0777/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-caplite-prompt-injection-defense-for-small-language-df9ac892","formats":{"html":"/readings/arxiv-cs-ai-caplite-prompt-injection-defense-for-small-language-df9ac892","markdown":"/readings/arxiv-cs-ai-caplite-prompt-injection-defense-for-small-language-df9ac892.md","json":"/readings/arxiv-cs-ai-caplite-prompt-injection-defense-for-small-language-df9ac892.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"conditions":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-prompt-injection","name":"Prompt injection","explanation":"Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.","referenceUrl":"https://en.wikipedia.org/wiki/Prompt_injection"},{"id":"term-benchmark","name":"Benchmark","explanation":"A defined set of tests used to compare systems. Results depend on the tasks and measures selected.","referenceUrl":"https://arxiv.org/abs/2211.09110"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"df9ac892e53ae231621ac4e805ff78da07a5f620052385bbff06acf3f1fc0777","revision":"36613ae2-b176-4c2c-8aef-996ac2c174c0","revisionKind":"publication-id","title":"arXiv cs.AI: CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts","url":"https://escapemeridian.com/readings/arxiv-cs-ai-caplite-prompt-injection-defense-for-small-language-df9ac892"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.17115","revision":"01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e","revisionKind":"sha256-source-text","title":"CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts","url":"https://arxiv.org/abs/2611.17115"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"df9ac892e53ae231621ac4e805ff78da07a5f620052385bbff06acf3f1fc0777","title":"arXiv cs.AI: CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts","argument":"The authors of CapLite argue that small language model (SLM) agents cannot reliably write the security artifacts used by several prompt-injection defenses. Their alternative derives its policy from tool schemas and commits write calls before reading tool results. It allows a write only when the user’s request states every argument that determines whom or what the write affects. The authors say this design prevents injected text from adding a write or directing one to an unstated recipient, amount, object or destination. In 13,935 attacked AgentDojo episodes, they report that no attack succeeds. They also report utility under attack comparable to CaMeL’s, with fewer tokens per episode than every other enforcement defense and the undefended agent. CapLite’s approach is to constrain consequential tool actions without relying on the agent’s model to write a security artifact. The evidence here is the paper’s abstract and reported benchmark results; how the approach performs beyond those episodes remains unknown.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"These results are reported in the paper’s abstract and concern the tested models and attacked AgentDojo episodes; the evidence provided does not establish performance on other tasks.","speaker":{"name":"Xu, Zimo, Liu, Wenzhuo, Nakayama, Hideki","roleAtSource":"Article author"},"source":{"title":"CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.17115","publishedAt":"2026-11-12","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors report that small language model agents failed to reliably write security artifacts for several enforcement defenses across the models they tested.","excerpt":"Across 15 open-weight models, 13 of them between 1.7B and 12B parameters, they cannot:","url":"https://arxiv.org/abs/2611.17115","relationship":"Source-stated"},{"text":"CapLite derives its policy from tool schemas and commits write calls before reading tool results.","excerpt":"CapLite, which derives its policy from the tool schemas, commits the write calls before any tool result is read","url":"https://arxiv.org/abs/2611.17115","relationship":"Source-stated"},{"text":"CapLite admits a write only when the user request states every argument that determines whom or what it affects.","excerpt":"admits a write only if every argument that decides whom or what it affects is stated in the user's request.","url":"https://arxiv.org/abs/2611.17115","relationship":"Source-stated"},{"text":"The authors report no successful attacks in 13,935 attacked AgentDojo episodes.","excerpt":"No attack succeeds in 13,935 attacked AgentDojo episodes.","url":"https://arxiv.org/abs/2611.17115","relationship":"Source-stated"},{"text":"The authors report utility under attack comparable to CaMeL's, with CapLite using fewer tokens than every other enforcement defense and the undefended agent.","excerpt":"CapLite reaches utility under attack comparable to CaMeL's (29.0% vs. 27.2%) with fewer tokens than every other enforcement defense and than the undefended agent: 17.1k per episode","url":"https://arxiv.org/abs/2611.17115","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.17115","checkedAt":"2026-11-14T09:04:06.900Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would CapLite’s reported attack resistance and utility change on tasks beyond the attacked AgentDojo episodes?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts","summary":"The authors of CapLite argue that small language model (SLM) agents cannot reliably write the security artifacts used by several prompt-injection defenses. Their alternative derives its policy from tool schemas and commits write calls before reading tool results. It allows a write only when the user’s request states every argument that determines whom or what the write affects. The authors say this design prevents injected text from adding a write or directing one to an unstated recipient, amount, object or destination. In 13,935 attacked AgentDojo episodes, they report that no attack succeeds. They also report utility under attack comparable to CaMeL’s, with fewer tokens per episode than every other enforcement defense and the undefended agent. CapLite’s approach is to constrain consequential tool actions without relying on the agent’s model to write a security artifact. The evidence here is the paper’s abstract and reported benchmark results; how the approach performs beyond those episodes remains unknown.","question":"How would CapLite’s reported attack resistance and utility change on tasks beyond the attacked AgentDojo episodes?","claims":[{"text":"The authors report that small language model agents failed to reliably write security artifacts for several enforcement defenses across the models they tested.","excerpt":"Across 15 open-weight models, 13 of them between 1.7B and 12B parameters, they cannot:","support":"source-stated"},{"text":"CapLite derives its policy from tool schemas and commits write calls before reading tool results.","excerpt":"CapLite, which derives its policy from the tool schemas, commits the write calls before any tool result is read","support":"source-stated"},{"text":"CapLite admits a write only when the user request states every argument that determines whom or what it affects.","excerpt":"admits a write only if every argument that decides whom or what it affects is stated in the user's request.","support":"source-stated"},{"text":"The authors report no successful attacks in 13,935 attacked AgentDojo episodes.","excerpt":"No attack succeeds in 13,935 attacked AgentDojo episodes.","support":"source-stated"},{"text":"The authors report utility under attack comparable to CaMeL's, with CapLite using fewer tokens than every other enforcement defense and the undefended agent.","excerpt":"CapLite reaches utility under attack comparable to CaMeL's (29.0% vs. 27.2%) with fewer tokens than every other enforcement defense and than the undefended agent: 17.1k per episode","support":"source-stated"}],"limitations":["These results are reported in the paper’s abstract and concern the tested models and attacked AgentDojo episodes; the evidence provided does not establish performance on other tasks."],"mediaId":"9a52a7565a239b1e9d8a0269d3b6ed832c813de1f3c41bd74543612057ccf4e9","correctionReason":null,"id":"df9ac892e53ae231621ac4e805ff78da07a5f620052385bbff06acf3f1fc0777","publicationId":"36613ae2-b176-4c2c-8aef-996ac2c174c0","version":1,"sourceUrl":"https://arxiv.org/abs/2611.17115","sourceTitle":"CapLite: Prompt-Injection Defense for Small Language Model Agents without Model-Written Security Artifacts","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-12","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-13T07:40:12.310Z","createdAt":"2026-11-13T16:01:25.593Z","historical":false,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"9a52a7565a239b1e9d8a0269d3b6ed832c813de1f3c41bd74543612057ccf4e9","kind":"article","url":"https://arxiv.org/abs/2611.17115","sourceUrl":"https://arxiv.org/abs/2611.17115","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-13T15:36:25.691Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.17115","checkedAt":"2026-11-14T09:04:06.900Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v7","mediaId":"9a52a7565a239b1e9d8a0269d3b6ed832c813de1f3c41bd74543612057ccf4e9","confidence":0.81,"provider":"typesafe","model":"jev-1.13.0","inputHash":"6e540705b9ed8a2afea45ada2e074abf1c977540db6ea0c7c9a8800b6c2355dd","decidedAt":"2026-11-13T15:36:28.061Z"},"provenance":{"textHash":"01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e","observationId":"6f72d5dc295242467d6bb7c325c3e855a586d4a3515febd0c13eee569ec1cf5d","retrievedAt":"2026-11-13T15:36:25.365Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"dc956a96-cd6d-4381-8985-415107f4efef"},"reviewer":{"model":"gpt-6-luna","runId":"fda561a6-70e2-43e1-8e9f-d0496c27a7f5"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-13T16:01:25.593Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Xu, Zimo","url":null,"kind":"unknown"},{"name":"Liu, Wenzhuo","url":null,"kind":"unknown"},{"name":"Nakayama, Hideki","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Xu, Zimo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Xu, Zimo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.17115","locator":"head/meta[name=author|citation_author]"},"assertionId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T09:04:06.900Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23","sourceUrl":"https://arxiv.org/abs/2611.17115","contentSha256":"833e71d042e54b14a12372ef8d74a4e33f5057b4600ea707dcc1684b749dc105","textHash":"01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e","observedAt":"2026-11-14T09:04:06.900Z"}},{"actor":{"name":"Liu, Wenzhuo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Liu, Wenzhuo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.17115","locator":"head/meta[name=author|citation_author]"},"assertionId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T09:04:06.900Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23","sourceUrl":"https://arxiv.org/abs/2611.17115","contentSha256":"833e71d042e54b14a12372ef8d74a4e33f5057b4600ea707dcc1684b749dc105","textHash":"01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e","observedAt":"2026-11-14T09:04:06.900Z"}},{"actor":{"name":"Nakayama, Hideki","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Nakayama, Hideki","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.17115","locator":"head/meta[name=author|citation_author]"},"assertionId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T09:04:06.900Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23","sourceUrl":"https://arxiv.org/abs/2611.17115","contentSha256":"833e71d042e54b14a12372ef8d74a4e33f5057b4600ea707dcc1684b749dc105","textHash":"01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e","observedAt":"2026-11-14T09:04:06.900Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.17115","snapshotId":"2a5998abfa5752a4a937fdc5d042b6eedbfb97da5c593fa60e4dc1198fe02e23","contentSha256":"833e71d042e54b14a12372ef8d74a4e33f5057b4600ea707dcc1684b749dc105","textHash":"01c5c72409b200ebdc6a2ef67ba4371279dc39e1c9793a331c17fc69abd5c36e","observedAt":"2026-11-14T09:04:06.900Z","basis":"publisher-page-metadata","sourceLinks":43,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/df9ac892e53ae231621ac4e805ff78da07a5f620052385bbff06acf3f1fc0777/source"}}}],"audits":[{"publicationId":"36613ae2-b176-4c2c-8aef-996ac2c174c0","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading attributes the argument, design and benchmark results to the paper's authors. Phrasing such as 'they report' and 'the authors say' keeps source claims attributed. The arXiv listing names Zimo Xu, Wenzhuo Liu and Hideki Nakayama as the authors.","excerpt":"Authors:Zimo Xu, Wenzhuo Liu, Hideki Nakayama"},{"dimension":"summary","status":"uncertain","explanation":"The reading tracks the abstract faithfully, but its central terms are left unexplained for a general reader. It never says what prompt injection is: malicious text in tool results that tries to steer an agent. It also leaves 'security artifacts', 'write calls', 'tool schemas', AgentDojo, CaMeL and 'enforcement defense' unexplained. Omitting the 29.0% vs. 27.2% figures hides that utility under attack is low in absolute terms for both defenses. Smallest repair: add a plain one-clause gloss of prompt injection and AgentDojo, and keep the utility percentages.","excerpt":"CapLite reaches utility under attack comparable to CaMeL's (29.0% vs. 27.2%)"},{"dimension":"date","status":"pass","explanation":"The evidence.originalPublished value is 2026-11-12. This matches the arXiv v1 submission date, which is the first publication, not the later feed entry.","excerpt":"[Submitted on 12 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"Each claim matches an abstract excerpt. The draft softens 'guarantees write integrity' to what the authors say the design prevents. The limitation and the question about performance beyond the attacked AgentDojo episodes do not overreach and add no unsupported benefits or costs.","excerpt":"No attack succeeds in 13,935 attacked AgentDojo episodes."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page for this paper. It matches the source URL and is the most direct way for a reader to reach the original.","excerpt":null}],"createdAt":"2026-11-13T16:01:25.593Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}