Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 5

The DOI matches its Crossref record; 3 of the 3 references it cites were found in a registry or an index.

Understanding and Detecting File Knowledge Leakage in GPT App Ecosystem

Yan, Chuan, Guan, Bowei, Li, Yazhi, Meng, Mark Huasong, Wan, Liuhuo, Bai, Guangdong·2025·Proceedings of the ACM on Web Conference 2025
DOI 10.1145/3696410.3714755
Open this paper in CoChat — free account

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/3696410.3714755

Cites

3 of 3 references verified0 citation errors · 0 not checkable

Statistics

Figures

Figure 1 Workflow of File Knowledge in GPTs user interactions
Figure 1 Workflow of File Knowledge in GPTs user interactionsCC-BY · From the PDF
Figure 2 Web-side GPT auto-prompt injection test script process
Figure 2 Web-side GPT auto-prompt injection test script processCC-BY · From the PDF
Figure 3 A simplified example of a conversation packet response and the explanation of each role attribute
Figure 3 A simplified example of a conversation packet response and the explanation of each role attributeCC-BY · From the PDF
Figure 5 File knowledge distribution across different categories of GPTs
Figure 5 File knowledge distribution across different categories of GPTsCC-BY · From the PDF
Figure 6 The distribution of uploaded file quantities across different categories of GPTs
Figure 6 The distribution of uploaded file quantities across different categories of GPTsCC-BY · From the PDF

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Research works printed but not linked: 23

  1. Bang An, Sicheng Zhu, Ruiyi Zhang, Michael-Andrei Panaitescu-Liess, Yuancheng Xu, and Furong Huang. 2024. Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Models. In First Conference on Language Modeling. https://openreview.net/forum?id=ljFgX6A8NL
  2. Hannah Bast Björn Buchhold Elmar Haussmann et al. 2016. Semantic search on text and knowledge bases. Foundations and Trends® in Information Retrieval 10 2--3 (2016) 119--271. · DOI
  3. Roman Capellini Frank Atienza and Melanie Sconfield. 2024. Knowledge Accuracy and Reducing Hallucinations in LLMs via Dynamic Domain Knowledge Injection. (2024). · DOI
  4. Chao Feng, Xinyu Zhang, and Zichu Fei. 2023. Knowledge solver: Teaching llms to search for domain knowledge from knowledge graphs. arXiv preprint arXiv:2309.03118 (2023). · arXiv
  5. 10.1145/3605764.3623985 · DOI · Paper page
  6. Xinyi Hou, Yanjie Zhao, and Haoyu Wang. 2024. On the (In) Security of LLM App Stores. arXiv preprint arXiv:2407.08422 (2024). · arXiv
  7. Umar Iqbal, Tadayoshi Kohno, and Franziska Roesner. 2023. LLM Platform Security: Applying a Systematic Evaluation Framework to OpenAI's ChatGPT Plugins. arXiv preprint arXiv:2309.10254 (2023). · arXiv
  8. Yi Liu Gelei Deng Yuekang Li Kailong Wang Zihao Wang Xiaofeng Wang Tianwei Zhang Yepang Liu Haoyu Wang Yan Zheng et al. 2023. Prompt Injection attack against LLM-integrated Applications. arXiv preprint arXiv:2306.05499 (2023). · arXiv
  9. Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024. Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24). 1831--1847.
  10. 10.1609/aaai.v35i17.17745 · DOI
  11. Rodrigo Pedro, Daniel Castro, Paulo Carreira, and Nuno Santos. 2023. From prompt injections to sql injection attacks: How protected is your llm-integrated web application? arXiv preprint arXiv:2308.01990 (2023). · arXiv
  12. Mansi Phute, Alec Helbling, Matthew Hull, ShengYun Peng, Sebastian Szyller, Cory Cornelius, and Duen Horng Chau. 2023. Llm self defense: By self examination, llms know they are being tricked. arXiv preprint arXiv:2308.07308 (2023). · arXiv
  13. 10.1007/978-3-031-70879-4_6 · DOI
  14. Jiawen Shi, Zenghui Yuan, Yinuo Liu, Yue Huang, Pan Zhou, Lichao Sun, and Neil Zhenqiang Gong. 2024. Optimization-based Prompt Injection Attack to LLM-as-a-Judge. arXiv preprint arXiv:2403.17710 (2024). · arXiv
  15. Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems 30 (2017).
  16. 10.1145/3589334.3645721 · DOI
  17. ZihanWang, Zhongkui Ma, Xinguo Feng, Ruoxi Sun, HuWang, Minhui Xue, and Guangdong Bai. 2024. CoreLocker: Neuron-level Usage Control. In 2024 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2497--2514.
  18. Yuanwei Wu, Xiang Li, Yixin Liu, Pan Zhou, and Lichao Sun. 2023. Jailbreaking gpt-4v via self-adversarial attacks with system prompts. arXiv preprint arXiv:2311.09127 (2023). · arXiv
  19. Xilie Xu, Keyi Kong, Ning Liu, Lizhen Cui, Di Wang, Jingfeng Zhang, and Mohan Kankanhalli. 2023. An LLM can Fool Itself: A Prompt-Based Adversarial Attack. arXiv preprint arXiv:2310.13345 (2023). · arXiv
  20. 10.1145/3660826 · DOI
  21. 10.1145/3691620.3695510 · DOI
  22. Jiahao Yu, Yuhang Wu, Dong Shu, Mingyu Jin, and Xinyu Xing. 2023. Assessing prompt injection risks in 200 custom gpts. arXiv preprint arXiv:2311.11538 (2023). · arXiv
  23. Yichi Zhang, Zhuo Chen, Yin Fang, Lei Cheng, Yanxi Lu, Fangming Li, Wen Zhang, and Huajun Chen. 2023. Knowledgeable preference alignment for llms in domain-specific question answering. arXiv preprint arXiv:2311.06503 (2023). · arXiv

Cited by

See all 5

Metadata

Authors
Yan, C., Guan, B., Li, Y., Meng, M. H., Wan, L., & Bai, G.
Venue
Proceedings of the ACM on Web Conference 2025
Publisher
ACM
Published
2025-04-22
Pages
3831-3839
DOI
10.1145/3696410.3714755
Cited by
5
References
3
Licence
creativecommons.org/licenses/by/4.0/ (vor)

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.