{"id":"0afe29b2eed7eaec73171234e7478e9b6fc07d7500cc6609bc150da34515d097","title":"arXiv cs.AI: Lim and coauthors propose SPILLWAY to limit prompt injection in tool-using agents","argument":"Woosang Lim, Yeseul Chang and Jaewoo Lee propose SPILLWAY, a defense for agents that use tools to act on email, files and payments. Their central move is to separate deciding where an action may go from sanitizing text the agent reads. SPILLWAY checks target values—such as an email sender or payment account—against values returned by read-only tools in typed fields, or against fixed delegation rules. Typed fields are structured tool outputs; injected instructions, the authors say, arrive as free text. A deterministic sanitizer removes instruction-like regions matching fixed rules and keeps the removed spans as evidence. A local judge may restore a refused call, but not if its target appears in removed text.\n\nThe authors report that across three backbones and seven task suites on one backbone, no standard templated injection redirected an action to an attacker’s target. Under that attack, they report the highest observed mean utility and composite scores among the defenses they ran; a forged chat template produced a raw zero, and mean in-scope attack success under a released reinforcement-learning attacker was .007. They also say SPILLWAY adds almost no model call and triggers no defense-related backbone re-run. The proposal’s practical appeal is its stated aim: constrain where actions go without making a model decide every security check. These results describe the tested tasks","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported results concern the tested attacks and task suites; the supplied abstract does not give per-suite results or further detail about the evaluation conditions. The authors describe the results as applying to the defenses they ran; the supplied text does not identify those defenses or provide their individual scores.","speaker":{"name":"Lim, Woosang, Chang, Yeseul, Lee, Jaewoo","roleAtSource":"Article author"},"source":{"title":"SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.07222","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors propose SPILLWAY, which separates checking action targets from sanitizing instruction-like text, using tool outputs and fixed rules in its admission check.","excerpt":"SPILLWAY turns this observation into a deterministic floor with no per-task plan.","url":"https://arxiv.org/abs/2611.07222","relationship":"Source-stated"},{"text":"The authors say the check admits a call when target values found in tool output but not the user’s task come from a read-only tool’s typed field or a fixed delegation rule.","excerpt":"was returned by a read-only tool in a typed field or is covered by a fixed delegation rule.","url":"https://arxiv.org/abs/2611.07222","relationship":"Source-stated"},{"text":"Across three backbones and seven task suites on one, the authors report no standard templated injection redirected an action to an attacker’s target.","excerpt":"Across three backbones, and seven task suites on one of them, no standard templated injection redirects an action to an attacker's target","url":"https://arxiv.org/abs/2611.07222","relationship":"Source-stated"},{"text":"The authors report mean in-scope attack success of .007 under a released reinforcement-learning attacker.","excerpt":"mean in-scope attack success under a released reinforcement-learning attacker is .007.","url":"https://arxiv.org/abs/2611.07222","relationship":"Source-stated"},{"text":"The authors say SPILLWAY uses no defense-triggered backbone re-run and almost no added model call.","excerpt":"SPILLWAY reaches this floor with no defense-triggered backbone re-run and almost no added model call.","url":"https://arxiv.org/abs/2611.07222","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07222","checkedAt":"2026-11-08T17:18:07.506Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How do SPILLWAY’s results vary across the seven task suites, and what details do the authors report about those differences?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Lim and coauthors propose SPILLWAY to limit prompt injection in tool-using agents","summary":"Woosang Lim, Yeseul Chang and Jaewoo Lee propose SPILLWAY, a defense for agents that use tools to act on email, files and payments. Their central move is to separate deciding where an action may go from sanitizing text the agent reads. SPILLWAY checks target values—such as an email sender or payment account—against values returned by read-only tools in typed fields, or against fixed delegation rules. Typed fields are structured tool outputs; injected instructions, the authors say, arrive as free text. A deterministic sanitizer removes instruction-like regions matching fixed rules and keeps the removed spans as evidence. A local judge may restore a refused call, but not if its target appears in removed text.\n\nThe authors report that across three backbones and seven task suites on one backbone, no standard templated injection redirected an action to an attacker’s target. Under that attack, they report the highest observed mean utility and composite scores among the defenses they ran; a forged chat template produced a raw zero, and mean in-scope attack success under a released reinforcement-learning attacker was .007. They also say SPILLWAY adds almost no model call and triggers no defense-related backbone re-run. The proposal’s practical appeal is its stated aim: constrain where actions go without making a model decide every security check. These results describe the tested tasks","question":"How do SPILLWAY’s results vary across the seven task suites, and what details do the authors report about those differences?","claims":[{"text":"The authors propose SPILLWAY, which separates checking action targets from sanitizing instruction-like text, using tool outputs and fixed rules in its admission check.","excerpt":"SPILLWAY turns this observation into a deterministic floor with no per-task plan.","support":"source-stated"},{"text":"The authors say the check admits a call when target values found in tool output but not the user’s task come from a read-only tool’s typed field or a fixed delegation rule.","excerpt":"was returned by a read-only tool in a typed field or is covered by a fixed delegation rule.","support":"source-stated"},{"text":"Across three backbones and seven task suites on one, the authors report no standard templated injection redirected an action to an attacker’s target.","excerpt":"Across three backbones, and seven task suites on one of them, no standard templated injection redirects an action to an attacker's target","support":"source-stated"},{"text":"The authors report mean in-scope attack success of .007 under a released reinforcement-learning attacker.","excerpt":"mean in-scope attack success under a released reinforcement-learning attacker is .007.","support":"source-stated"},{"text":"The authors say SPILLWAY uses no defense-triggered backbone re-run and almost no added model call.","excerpt":"SPILLWAY reaches this floor with no defense-triggered backbone re-run and almost no added model call.","support":"source-stated"}],"limitations":["The reported results concern the tested attacks and task suites; the supplied abstract does not give per-suite results or further detail about the evaluation conditions.","The authors describe the results as applying to the defenses they ran; the supplied text does not identify those defenses or provide their individual scores."],"mediaId":"163311fe87f0a7ae724ee76ed257516c98fccca88e8e54ae3074896544b633a8","correctionReason":null,"id":"0afe29b2eed7eaec73171234e7478e9b6fc07d7500cc6609bc150da34515d097","publicationId":"01262f99-84c1-47a0-88f6-333b3edf5055","version":1,"sourceUrl":"https://arxiv.org/abs/2611.07222","sourceTitle":"SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-06T05:01:04.337Z","createdAt":"2026-11-08T17:02:19.307Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"163311fe87f0a7ae724ee76ed257516c98fccca88e8e54ae3074896544b633a8","kind":"article","url":"https://arxiv.org/abs/2611.07222","sourceUrl":"https://arxiv.org/abs/2611.07222","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-08T16:48:41.907Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07222","checkedAt":"2026-11-08T17:18:07.506Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"163311fe87f0a7ae724ee76ed257516c98fccca88e8e54ae3074896544b633a8","confidence":0.91,"provider":"typesafe","model":"jev-1.13.0","inputHash":"af4e860d26e5dbccd29ada702852d45fbeea0f54b9e395215576299eaa1cb794","decidedAt":"2026-11-08T16:48:44.071Z"},"provenance":{"textHash":"e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2","observationId":"23b64b52789a6befd50d3b283ad638570f251f89b9e52135954065af80d08082","retrievedAt":"2026-11-08T16:48:41.612Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"8c064d16-41aa-44c5-891d-f09454e1edef"},"reviewer":{"model":"gpt-6-luna","runId":"578c57b7-7772-49d6-8ea2-cf6363f7c715"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-08T17:02:19.307Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Lim, Woosang","url":null,"kind":"unknown"},{"name":"Chang, Yeseul","url":null,"kind":"unknown"},{"name":"Lee, Jaewoo","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Lim, Woosang","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lim, Woosang","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07222","locator":"head/meta[name=author|citation_author]"},"assertionId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T17:18:07.506Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c","sourceUrl":"https://arxiv.org/abs/2611.07222","contentSha256":"20f7da2377ee2235f62a3aa88e66ac4c3da8147a2e337720f271aa3e3c5d4351","textHash":"e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2","observedAt":"2026-11-08T17:18:07.506Z"}},{"actor":{"name":"Chang, Yeseul","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Chang, Yeseul","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07222","locator":"head/meta[name=author|citation_author]"},"assertionId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T17:18:07.506Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c","sourceUrl":"https://arxiv.org/abs/2611.07222","contentSha256":"20f7da2377ee2235f62a3aa88e66ac4c3da8147a2e337720f271aa3e3c5d4351","textHash":"e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2","observedAt":"2026-11-08T17:18:07.506Z"}},{"actor":{"name":"Lee, Jaewoo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lee, Jaewoo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07222","locator":"head/meta[name=author|citation_author]"},"assertionId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T17:18:07.506Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c","sourceUrl":"https://arxiv.org/abs/2611.07222","contentSha256":"20f7da2377ee2235f62a3aa88e66ac4c3da8147a2e337720f271aa3e3c5d4351","textHash":"e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2","observedAt":"2026-11-08T17:18:07.506Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.07222","snapshotId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c","contentSha256":"20f7da2377ee2235f62a3aa88e66ac4c3da8147a2e337720f271aa3e3c5d4351","textHash":"e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2","observedAt":"2026-11-08T17:18:07.506Z","basis":"publisher-page-metadata","sourceLinks":42,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/0afe29b2eed7eaec73171234e7478e9b6fc07d7500cc6609bc150da34515d097/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-lim-and-coauthors-propose-spillway-to-limit-prompt-0afe29b2","formats":{"html":"/readings/arxiv-cs-ai-lim-and-coauthors-propose-spillway-to-limit-prompt-0afe29b2","markdown":"/readings/arxiv-cs-ai-lim-and-coauthors-propose-spillway-to-limit-prompt-0afe29b2.md","json":"/readings/arxiv-cs-ai-lim-and-coauthors-propose-spillway-to-limit-prompt-0afe29b2.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-prompt-injection","name":"Prompt injection","explanation":"Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.","referenceUrl":"https://en.wikipedia.org/wiki/Prompt_injection"},{"id":"term-reinforcement-learning","name":"Reinforcement learning","explanation":"Training by trial and error, in which a system is rewarded for the outcomes its designers want.","referenceUrl":"https://developers.google.com/machine-learning/glossary#reinforcement-learning-rl"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"0afe29b2eed7eaec73171234e7478e9b6fc07d7500cc6609bc150da34515d097","revision":"01262f99-84c1-47a0-88f6-333b3edf5055","revisionKind":"publication-id","title":"arXiv cs.AI: Lim and coauthors propose SPILLWAY to limit prompt injection in tool-using agents","url":"https://escapemeridian.com/readings/arxiv-cs-ai-lim-and-coauthors-propose-spillway-to-limit-prompt-0afe29b2"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.07222","revision":"e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2","revisionKind":"sha256-source-text","title":"SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection","url":"https://arxiv.org/abs/2611.07222"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"0afe29b2eed7eaec73171234e7478e9b6fc07d7500cc6609bc150da34515d097","title":"arXiv cs.AI: Lim and coauthors propose SPILLWAY to limit prompt injection in tool-using agents","argument":"Woosang Lim, Yeseul Chang and Jaewoo Lee propose SPILLWAY, a defense for agents that use tools to act on email, files and payments. Their central move is to separate deciding where an action may go from sanitizing text the agent reads. SPILLWAY checks target values—such as an email sender or payment account—against values returned by read-only tools in typed fields, or against fixed delegation rules. Typed fields are structured tool outputs; injected instructions, the authors say, arrive as free text. A deterministic sanitizer removes instruction-like regions matching fixed rules and keeps the removed spans as evidence. A local judge may restore a refused call, but not if its target appears in removed text.\n\nThe authors report that across three backbones and seven task suites on one backbone, no standard templated injection redirected an action to an attacker’s target. Under that attack, they report the highest observed mean utility and composite scores among the defenses they ran; a forged chat template produced a raw zero, and mean in-scope attack success under a released reinforcement-learning attacker was .007. They also say SPILLWAY adds almost no model call and triggers no defense-related backbone re-run. The proposal’s practical appeal is its stated aim: constrain where actions go without making a model decide every security check. These results describe the tested tasks","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported results concern the tested attacks and task suites; the supplied abstract does not give per-suite results or further detail about the evaluation conditions. The authors describe the results as applying to the defenses they ran; the supplied text does not identify those defenses or provide their individual scores.","speaker":{"name":"Lim, Woosang, Chang, Yeseul, Lee, Jaewoo","roleAtSource":"Article author"},"source":{"title":"SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.07222","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors propose SPILLWAY, which separates checking action targets from sanitizing instruction-like text, using tool outputs and fixed rules in its admission check.","excerpt":"SPILLWAY turns this observation into a deterministic floor with no per-task plan.","url":"https://arxiv.org/abs/2611.07222","relationship":"Source-stated"},{"text":"The authors say the check admits a call when target values found in tool output but not the user’s task come from a read-only tool’s typed field or a fixed delegation rule.","excerpt":"was returned by a read-only tool in a typed field or is covered by a fixed delegation rule.","url":"https://arxiv.org/abs/2611.07222","relationship":"Source-stated"},{"text":"Across three backbones and seven task suites on one, the authors report no standard templated injection redirected an action to an attacker’s target.","excerpt":"Across three backbones, and seven task suites on one of them, no standard templated injection redirects an action to an attacker's target","url":"https://arxiv.org/abs/2611.07222","relationship":"Source-stated"},{"text":"The authors report mean in-scope attack success of .007 under a released reinforcement-learning attacker.","excerpt":"mean in-scope attack success under a released reinforcement-learning attacker is .007.","url":"https://arxiv.org/abs/2611.07222","relationship":"Source-stated"},{"text":"The authors say SPILLWAY uses no defense-triggered backbone re-run and almost no added model call.","excerpt":"SPILLWAY reaches this floor with no defense-triggered backbone re-run and almost no added model call.","url":"https://arxiv.org/abs/2611.07222","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07222","checkedAt":"2026-11-08T17:18:07.506Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How do SPILLWAY’s results vary across the seven task suites, and what details do the authors report about those differences?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Lim and coauthors propose SPILLWAY to limit prompt injection in tool-using agents","summary":"Woosang Lim, Yeseul Chang and Jaewoo Lee propose SPILLWAY, a defense for agents that use tools to act on email, files and payments. Their central move is to separate deciding where an action may go from sanitizing text the agent reads. SPILLWAY checks target values—such as an email sender or payment account—against values returned by read-only tools in typed fields, or against fixed delegation rules. Typed fields are structured tool outputs; injected instructions, the authors say, arrive as free text. A deterministic sanitizer removes instruction-like regions matching fixed rules and keeps the removed spans as evidence. A local judge may restore a refused call, but not if its target appears in removed text.\n\nThe authors report that across three backbones and seven task suites on one backbone, no standard templated injection redirected an action to an attacker’s target. Under that attack, they report the highest observed mean utility and composite scores among the defenses they ran; a forged chat template produced a raw zero, and mean in-scope attack success under a released reinforcement-learning attacker was .007. They also say SPILLWAY adds almost no model call and triggers no defense-related backbone re-run. The proposal’s practical appeal is its stated aim: constrain where actions go without making a model decide every security check. These results describe the tested tasks","question":"How do SPILLWAY’s results vary across the seven task suites, and what details do the authors report about those differences?","claims":[{"text":"The authors propose SPILLWAY, which separates checking action targets from sanitizing instruction-like text, using tool outputs and fixed rules in its admission check.","excerpt":"SPILLWAY turns this observation into a deterministic floor with no per-task plan.","support":"source-stated"},{"text":"The authors say the check admits a call when target values found in tool output but not the user’s task come from a read-only tool’s typed field or a fixed delegation rule.","excerpt":"was returned by a read-only tool in a typed field or is covered by a fixed delegation rule.","support":"source-stated"},{"text":"Across three backbones and seven task suites on one, the authors report no standard templated injection redirected an action to an attacker’s target.","excerpt":"Across three backbones, and seven task suites on one of them, no standard templated injection redirects an action to an attacker's target","support":"source-stated"},{"text":"The authors report mean in-scope attack success of .007 under a released reinforcement-learning attacker.","excerpt":"mean in-scope attack success under a released reinforcement-learning attacker is .007.","support":"source-stated"},{"text":"The authors say SPILLWAY uses no defense-triggered backbone re-run and almost no added model call.","excerpt":"SPILLWAY reaches this floor with no defense-triggered backbone re-run and almost no added model call.","support":"source-stated"}],"limitations":["The reported results concern the tested attacks and task suites; the supplied abstract does not give per-suite results or further detail about the evaluation conditions.","The authors describe the results as applying to the defenses they ran; the supplied text does not identify those defenses or provide their individual scores."],"mediaId":"163311fe87f0a7ae724ee76ed257516c98fccca88e8e54ae3074896544b633a8","correctionReason":null,"id":"0afe29b2eed7eaec73171234e7478e9b6fc07d7500cc6609bc150da34515d097","publicationId":"01262f99-84c1-47a0-88f6-333b3edf5055","version":1,"sourceUrl":"https://arxiv.org/abs/2611.07222","sourceTitle":"SPILLWAY: Separating Target Admission from Sanitization to Defend Tool-Using Agents against Prompt Injection","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-06T05:01:04.337Z","createdAt":"2026-11-08T17:02:19.307Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"163311fe87f0a7ae724ee76ed257516c98fccca88e8e54ae3074896544b633a8","kind":"article","url":"https://arxiv.org/abs/2611.07222","sourceUrl":"https://arxiv.org/abs/2611.07222","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-08T16:48:41.907Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07222","checkedAt":"2026-11-08T17:18:07.506Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"163311fe87f0a7ae724ee76ed257516c98fccca88e8e54ae3074896544b633a8","confidence":0.91,"provider":"typesafe","model":"jev-1.13.0","inputHash":"af4e860d26e5dbccd29ada702852d45fbeea0f54b9e395215576299eaa1cb794","decidedAt":"2026-11-08T16:48:44.071Z"},"provenance":{"textHash":"e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2","observationId":"23b64b52789a6befd50d3b283ad638570f251f89b9e52135954065af80d08082","retrievedAt":"2026-11-08T16:48:41.612Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"8c064d16-41aa-44c5-891d-f09454e1edef"},"reviewer":{"model":"gpt-6-luna","runId":"578c57b7-7772-49d6-8ea2-cf6363f7c715"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-08T17:02:19.307Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Lim, Woosang","url":null,"kind":"unknown"},{"name":"Chang, Yeseul","url":null,"kind":"unknown"},{"name":"Lee, Jaewoo","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Lim, Woosang","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lim, Woosang","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07222","locator":"head/meta[name=author|citation_author]"},"assertionId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T17:18:07.506Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c","sourceUrl":"https://arxiv.org/abs/2611.07222","contentSha256":"20f7da2377ee2235f62a3aa88e66ac4c3da8147a2e337720f271aa3e3c5d4351","textHash":"e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2","observedAt":"2026-11-08T17:18:07.506Z"}},{"actor":{"name":"Chang, Yeseul","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Chang, Yeseul","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07222","locator":"head/meta[name=author|citation_author]"},"assertionId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T17:18:07.506Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c","sourceUrl":"https://arxiv.org/abs/2611.07222","contentSha256":"20f7da2377ee2235f62a3aa88e66ac4c3da8147a2e337720f271aa3e3c5d4351","textHash":"e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2","observedAt":"2026-11-08T17:18:07.506Z"}},{"actor":{"name":"Lee, Jaewoo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Lee, Jaewoo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07222","locator":"head/meta[name=author|citation_author]"},"assertionId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T17:18:07.506Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c","sourceUrl":"https://arxiv.org/abs/2611.07222","contentSha256":"20f7da2377ee2235f62a3aa88e66ac4c3da8147a2e337720f271aa3e3c5d4351","textHash":"e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2","observedAt":"2026-11-08T17:18:07.506Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.07222","snapshotId":"437d4a2c069f7425b8493cd507777fac91b4564d5558769695fa0df0d1be973c","contentSha256":"20f7da2377ee2235f62a3aa88e66ac4c3da8147a2e337720f271aa3e3c5d4351","textHash":"e1b62bbcb538492119f5c4ecc04ebea2809daa931d8c3108594e61b500c3eac2","observedAt":"2026-11-08T17:18:07.506Z","basis":"publisher-page-metadata","sourceLinks":42,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/0afe29b2eed7eaec73171234e7478e9b6fc07d7500cc6609bc150da34515d097/source"}}}],"audits":[{"publicationId":"01262f99-84c1-47a0-88f6-333b3edf5055","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading correctly credits Woosang Lim, Yeseul Chang and Jaewoo Lee as authors and keeps the results as their reported claims. Labeling the publisher as arXiv cs.AI matches the feed; the paper is primarily cs.CR and cross-listed to cs.AI.","excerpt":"Authors:Woosang Lim (1 and 2), Yeseul Chang (3), Jaewoo Lee (3)"},{"dimension":"summary","status":"uncertain","explanation":"The summary is cut off mid-sentence at 'These results describe the tested tasks', with no period or completion. Smallest repair: finish the sentence. It also never explains prompt injection in plain terms, although the abstract supplies it: hidden instructions in a web page or document can make an agent send data or money to an attacker. Adding that would show general readers the stakes. 'Backbones' (the underlying language models) and 'raw zero' also need term-library tooltips. The question about per-suite variation is a legitimate unresolved issue.","excerpt":"an instruction hidden in a web page or a shared document can make an agent send data or money to an attacker"},{"dimension":"date","status":"pass","explanation":"originalPublished 2026-11-04 matches the v1 submission date. The feed date of 2026-11-06 is correctly not used.","excerpt":"[Submitted on 4 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"All the claims are attributed and supported by the abstract, including the admission rule, the sanitizer and judge behavior, the zero redirects under templated injection, the .007 RL-attacker success rate and the minimal added model calls. The stated aim of constraining action targets without per-check model decisions matches the abstract's deterministic floor. The limitations appropriately note that per-suite results and the competing defenses are not identified.","excerpt":"SPILLWAY reaches this floor with no defense-triggered backbone re-run and almost no added model call."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access to the source.","excerpt":null}],"createdAt":"2026-11-08T17:02:19.307Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}