---
title: "Ghost Context — paper by Namboothiri (2026)"
description: "Long-context LLMs in RAG pipelines and agents receive prompts assembled from many sources, and the system assumes the… 46 references."
authors: ["Rohith Namboothiri"]
year: 2026
venue: "Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)"
source: "https://aclanthology.org/2026.trustnlp-main.19/"
doi: "10.18653/v1/2026.trustnlp-main.19"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/namboothiri-2026-ghost-context-measuring-cross-context/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/namboothiri-2026-ghost-context-measuring-cross-context/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/35/) / Ghost Context: Measuring Cross-Context Interference in Long-Context Language Models

# Ghost Context: Measuring Cross-Context Interference in Long-Context Language Models

**Authors:** [Rohith Namboothiri](https://md.research.elamur.ai/free/en/authors/rohith-namboothiri/) · **Year:** 2026 · **Venue:** [Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)](https://md.research.elamur.ai/free/en/venues/trustnlp/) ([Workshop on Trustworthy NLP 2026](https://md.research.elamur.ai/free/en/venues/trustnlp/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.trustnlp-main.19/) · [PDF](https://aclanthology.org/2026.trustnlp-main.19.pdf) · [DOI 10.18653/v1/2026.trustnlp-main.19](https://doi.org/10.18653/v1/2026.trustnlp-main.19) · [OpenAlex](https://openalex.org/W7166851221)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Long-context LLMs in RAG pipelines and agents receive prompts assembled from many sources, and the system assumes the model will rely on the span that answers the query. This paper identifies a failure the author calls Ghost Context. An irrelevant span causally shapes the output, producing "misattributed grounding": a claim backed by genuine evidence, but from the wrong source. Such claims are entailed by something in the prompt, so source-blind faithfulness checks (e.g., FActScore, SummaC, MiniCheck) cannot catch them, as the paper argues formally. To measure the effect, the author builds a 272-case corpus of custom fictional cases plus items adapted from MuSiQue, HotpotQA and SituatedQA. Each distractor span is masked, the model is rerun with greedy decoding, and two LLM judges compare the outputs. Three models from three families are tested. The phenomenon is uncommon overall but rises sharply when contexts conflict, especially when they contain outdated versions of a fact. It is also cheap to fix: removing the single top-attributed span corrects nearly all detected cases. The protocol gives RAG and agent builders a practical audit tool and new robustness metrics.

## Key points
- **Metrics and taxonomy.** The paper proposes four metrics:
  - Ghost Context Rate (GCR)
  - Fix@k
  - Collateral Damage Rate (CDR)
  - Contextual Invariance Rate (CIR)

  It also defines four interference patterns: Temporal Bleed, Cross-Document Fusion, Distractor Dominance, and Instruction-Data Interference.
- **Prevalence.** Strict GCR is only 3.2% across all cases. Temporal contradictions push it to 38.3% on the most susceptible model, and open-ended (non-strictly-factual) distractor influence reaches 20.4%.
- **Remediation.** Masking the single highest-attributed distractor fixes 95.5% of detected errors (Fix@1). This comes with 2.4% collateral damage and no false positives on negative controls.
- **Judging setup.** The primary judge is Claude Sonnet 4.6, cross-checked by an unrelated second judge; raw agreement between the two is 97–99%. One tested model, Claude Haiku 4.5, shares a family with the primary judge. No human annotation study was run.
- **Limitations and release.** Contexts are short (about 479 words) compared with production RAG contexts of 5K–50K tokens, and the security implications are discussed but not tested. The corpus, pipeline and results are publicly released.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,894 works

## Cite

Cite as: Rohith Namboothiri. 2026. Ghost Context: Measuring Cross-Context Interference in Long-Context Language Models. Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{namboothiri2026ghost,
  title = {{Ghost Context: Measuring Cross-Context Interference in Long-Context Language Models}},
  author = {Rohith Namboothiri},
  booktitle = {Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)},
  year = {2026},
  doi = {10.18653/v1/2026.trustnlp-main.19},
  url = {https://doi.org/10.18653/v1/2026.trustnlp-main.19}
}
```

- [← previous GHAD NLP at AdabEval2026: Transformer-Based Approach for Arabic Politeness and Pragmatic Category Classification](https://md.research.elamur.ai/free/en/papers/alfattni-2026-ghad-nlp-adabeval2026-transformer-based/)
- [next → Ghost in the Shell: Synonym-Aware Logit Shaping Fingerprint for Copyright Protection of Large Vision-Language Models](https://md.research.elamur.ai/free/en/papers/zheng-2026-ghost-shell-synonym-aware-logit/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/35/)

## References

46 references, 25 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Akari Asai, Zeqiu Wu, Yizhong Wang, Avirup Sil, and Hannaneh Hajishirzi. 2024. [Self-RAG: Learning to retrieve, generate, and critique through self-reflection](https://md.research.elamur.ai/free/en/papers/asai-2023-self-rag-learning-retrieve-generate/). In ICLR.
2. Scott Barnett, Stefanus Kurniawan, Srikanth Thudumu, Zach Brannelly, and Mohamed Abdelrazek. 2024. Seven failure points when engineering a retrieval augmented generation system. arXiv:2401.05856. — [arXiv:2401.05856](https://arxiv.org/abs/2401.05856) [find](https://scholar.google.com/scholar?q=Scott+Barnett%2C+Stefanus+Kurniawan%2C+Srikanth+Thudumu%2C+Zach+Brannelly%2C+and+Mohamed+Abdelrazek%2E+2024%2E+Seven+failure+points+when+engineering+a+retrieval+augmented+generation+system%2E+arXiv%3A2401%2E05856%2E+%E2%80%94+%5Ba)
3. Bernd Bohnet, Vinh Q. Tran, Pat Verga, Roee Aharoni, Daniel Andor, Livio Baldini Soares, Jacob Eisenstein, Kuzman Ganchev, Jonathan Herzig, Kai Hui, Tom Kwiatkowski, Ji Ma, Jianmo Ni, Liber Osber, Tal Schuster, William W. Cohen, Michael Collins, Dipanjan Das, Donald Metzler, and 2 others. 2022. Attr… — [Attributed Question Answering: Evaluation and Modeling for Attributed Large Language Models](https://md.research.elamur.ai/free/en/papers/bohnet-2022-attributed-question-answering-evaluation-modeling/)
4. Cheng-Han Chiang and Hung yi Lee. 2023. Can large language models be an alternative to human evaluations? arXiv:2305.01937. [find](https://scholar.google.com/scholar?q=Cheng%2DHan+Chiang+and+Hung+yi+Lee%2E+2023%2E+Can+large+language+models+be+an+alternative+to+human+evaluations%3F+arXiv%3A2305%2E01937%2E)
5. Shahul Es, Jithin James, Luis Espinosa-Anke, and Steven Schockaert. 2024. [RAGAS: Automated evaluation of retrieval augmented generation](https://md.research.elamur.ai/free/en/papers/es-2023-ragas-automated-evaluation-retrieval-augmented/). In EACL System Demonstrations, pages 150–163.
6. Alvan R. Feinstein and Domenic V. Cicchetti. 1990. High agreement but low kappa: I. the problems of two paradoxes. Journal of Clinical Epidemiology, 43(6):543–549. [find](https://scholar.google.com/scholar?q=Alvan+R%2E+Feinstein+and+Domenic+V%2E+Cicchetti%2E+1990%2E+High+agreement+but+low+kappa%3A+I%2E+the+problems+of+two+paradoxes%2E+Journal+of+Clinical+Epidemiology%2C+43%286%29%3A543%E2%80%93549%2E)
7. Tianyu Gao, Howard Yen, Jiatong Yu, and Danqi Chen. 2023. [Enabling large language models to generate text with citations](https://md.research.elamur.ai/free/en/papers/gao-2023-enabling-large-language-models-generate/). In EMNLP, pages 6465–6488.
8. Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yi Dai, Jiawei Sun, Meng Wang, and Haofen Wang. 2024. [Retrieval-augmented generation for large language models: A survey](https://md.research.elamur.ai/free/en/papers/gao-2023-retrieval-augmented-generation-large-language/). arXiv:2312.10997.
9. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. [Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection](https://md.research.elamur.ai/free/en/papers/greshake-2023-ve-signed-up-compromising-real/). In AISec.
10. Or Honovich, Leshem Choshen, Roee Aharoni, Ella Neeman, Idan Szpektor, and Omri Abend. 2022. [TRUE: Re-evaluating factual consistency evaluation](https://md.research.elamur.ai/free/en/papers/honovich-2022-true-re-evaluating-factual-consistency/). In NAACL, pages 3905–3920.
11. Cheng-Ping Hsieh, Simeng Sun, Samuel Kriman, Shantanu Acharya, Dima Rekesh, Fei Jia, Yang Zhang, and Boris Ginsburg. 2024. [RULER: What’s the real context size of your long-context language models?](https://md.research.elamur.ai/free/en/papers/hsieh-2024-ruler-s-real-context-size/) arXiv:2404.06654.
12. Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, and Ting Liu. 2023. [A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions](https://md.research.elamur.ai/free/en/papers/huang-2023-survey-hallucination-large-language-models/). arXiv:2311.05232.
13. Sarthak Jain and Byron C. Wallace. 2019. [Attention is not explanation](https://md.research.elamur.ai/free/en/papers/jain-2019-attention-is-not-explanation/). In NAACL, pages 3543–3556.
14. Joel Jang, Seungone Kim, Seonghyeon Ye, Doyoung Kim, Lajanugen Logeswaran, Moontae Lee, Kyungjae Lee, and Minjoon Seo. 2023. Can large language models truly follow your instructions? In EMNLP Findings. [find](https://scholar.google.com/scholar?q=Joel+Jang%2C+Seungone+Kim%2C+Seonghyeon+Ye%2C+Doyoung+Kim%2C+Lajanugen+Logeswaran%2C+Moontae+Lee%2C+Kyungjae+Lee%2C+and+Minjoon+Seo%2E+2023%2E+Can+large+language+models+truly+follow+your+instructions%3F+In+EMNLP+Findings)
15. Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Ye Jin Bang, Andrea Madotto, and Pascale Fung. 2023. [Survey of hallucination in natural language generation](https://md.research.elamur.ai/free/en/papers/ji-2022-survey-hallucination-natural-language-generation/). ACM Computing Surveys, 55(12):1–38.
16. Jieun Kim and 1 others. 2025. Semantic inversion, identical replies: Revisiting negation blindness in large language models. In EMNLP. [find](https://scholar.google.com/scholar?q=Jieun+Kim+and+1+others%2E+2025%2E+Semantic+inversion%2C+identical+replies%3A+Revisiting+negation+blindness+in+large+language+models%2E+In+EMNLP%2E)
17. Pang Wei Koh and Percy Liang. 2017. [Understanding black-box predictions via influence functions](https://md.research.elamur.ai/free/en/papers/koh-2017-understanding-black-box-predictions-influence/). In ICML, pages 1885–1894.
18. Helen Nissenbaum. 2004. Privacy as contextual integrity. Washington Law Review, 79(1):119–158. [find](https://scholar.google.com/scholar?q=Helen+Nissenbaum%2E+2004%2E+Privacy+as+contextual+integrity%2E+Washington+Law+Review%2C+79%281%29%3A119%E2%80%93158%2E)
19. Philippe Laban, Tobias Schnabel, Paul N. Bennett, and Marti A. Hearst. 2022. SummaC: Re-visiting NLI-based models for inconsistency detection in summarization. In TACL, volume 10, pages 163–177. [find](https://scholar.google.com/scholar?q=Philippe+Laban%2C+Tobias+Schnabel%2C+Paul+N%2E+Bennett%2C+and+Marti+A%2E+Hearst%2E+2022%2E+SummaC%3A+Re%2Dvisiting+NLI%2Dbased+models+for+inconsistency+detection+in+summarization%2E+In+TACL%2C+volume+10%2C+pages+163%E2%80%93177%2E)
20. J. Richard Landis and Gary G. Koch. 1977. The measurement of observer agreement for categorical data. Biometrics, 33(1):159–174. [find](https://scholar.google.com/scholar?q=J%2E+Richard+Landis+and+Gary+G%2E+Koch%2E+1977%2E+The+measurement+of+observer+agreement+for+categorical+data%2E+Biometrics%2C+33%281%29%3A159%E2%80%93174%2E)
21. Mosh Levy, Alon Jacoby, and Yoav Goldberg. 2024. [Same task, more tokens: the impact of input length on the reasoning performance of large language models](https://md.research.elamur.ai/free/en/papers/levy-2024-same-task-more-tokens-impact/). arXiv:2402.14848.
22. Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. 2020. [Retrieval-augmented generation for knowledge-intensive NLP tasks](https://md.research.elamur.ai/free/en/papers/lewis-2020-retrieval-augmented-generation-knowledge-intensive/). In NeurIPS, volume 33, pages 9459–9474…
23. Mo Li, Songyang Zhang, Yunxin Liu, and Kai Chen. 2024. NeedleBench: Can LLMs do retrieval and reasoning in 1 million context window? arXiv:2407.11963. — [arXiv:2407.11963](https://arxiv.org/abs/2407.11963) [find](https://scholar.google.com/scholar?q=Mo+Li%2C+Songyang+Zhang%2C+Yunxin+Liu%2C+and+Kai+Chen%2E+2024%2E+NeedleBench%3A+Can+LLMs+do+retrieval+and+reasoning+in+1+million+context+window%3F+arXiv%3A2407%2E11963%2E+%E2%80%94+%5BarXiv%3A2407%2E11963%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2407%2E1)
24. Feiyang Liu, Nikhil Kandpal, and Colin Raffel. 2024a. AttriBoT: A bag of tricks for efficiently approximating leave-one-out context attribution. arXiv:2411.15102. [find](https://scholar.google.com/scholar?q=Feiyang+Liu%2C+Nikhil+Kandpal%2C+and+Colin+Raffel%2E+2024a%2E+AttriBoT%3A+A+bag+of+tricks+for+efficiently+approximating+leave%2Done%2Dout+context+attribution%2E+arXiv%3A2411%2E15102%2E)
25. Nelson F. Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang. 2024b. [Lost in the middle: How language models use long contexts](https://md.research.elamur.ai/free/en/papers/liu-2023-lost-middle-language-models-use/). TACL, 12:157–173.
26. Potsawee Manakul, Adian Liusie, and Mark J.F. Gales. 2023. SelfCheckGPT: Zero-resource black-box hallucination detection for generative large language models. arXiv:2303.08896. [find](https://scholar.google.com/scholar?q=Potsawee+Manakul%2C+Adian+Liusie%2C+and+Mark+J%2EF%2E+Gales%2E+2023%2E+SelfCheckGPT%3A+Zero%2Dresource+black%2Dbox+hallucination+detection+for+generative+large+language+models%2E+arXiv%3A2303%2E08896%2E)
27. Joon Sung Park, Joseph C. O’Brien, Carrie J. Cai, Meredith Ringel Morris, Percy Liang, and Michael S. Bernstein. 2023a. Generative agents: Interactive simulacra of human behavior. In UIST. [find](https://scholar.google.com/scholar?q=Joon+Sung+Park%2C+Joseph+C%2E+O%E2%80%99Brien%2C+Carrie+J%2E+Cai%2C+Meredith+Ringel+Morris%2C+Percy+Liang%2C+and+Michael+S%2E+Bernstein%2E+2023a%2E+Generative+agents%3A+Interactive+simulacra+of+human+behavior%2E+In+UIST%2E)
28. Sung Min Park, Kristian Georgiev, Andrew Ilyas, Guillaume Leclerc, and Aleksander Madry. 2023b. TRAK: Attributing model behavior at scale. In ICML. [find](https://scholar.google.com/scholar?q=Sung+Min+Park%2C+Kristian+Georgiev%2C+Andrew+Ilyas%2C+Guillaume+Leclerc%2C+and+Aleksander+Madry%2E+2023b%2E+TRAK%3A+Attributing+model+behavior+at+scale%2E+In+ICML%2E)
29. Judea Pearl. 2009. Causality, 2nd edition. Cambridge University Press. [find](https://scholar.google.com/scholar?q=Judea+Pearl%2E+2009%2E+Causality%2C+2nd+edition%2E+Cambridge+University+Press%2E)
30. Fabián Perez and Ian Ribeiro. 2022. [Ignore previous prompt: Attack techniques for language models](https://md.research.elamur.ai/free/en/papers/perez-2022-ignore-previous-prompt-attack-techniques/). In NeurIPS ML Safety Workshop.
31. Freda Shi, Xinyun Chen, Kanishka Misra, Nathan Scales, David Dohan, Ed Chi, Nathanael Schärli, and Denny Zhou. 2023. [Large language models can be easily distracted by irrelevant context](https://md.research.elamur.ai/free/en/papers/shi-2023-large-language-models-easily-distracted/). In ICML, pages 31210–31227.
32. Theodore R. Sumers, Shunyu Yao, Karthik Narasimhan, and Thomas L. Griffiths. 2024. Cognitive architectures for language agents. arXiv:2309.02427. [find](https://scholar.google.com/scholar?q=Theodore+R%2E+Sumers%2C+Shunyu+Yao%2C+Karthik+Narasimhan%2C+and+Thomas+L%2E+Griffiths%2E+2024%2E+Cognitive+architectures+for+language+agents%2E+arXiv%3A2309%2E02427%2E)
33. Liyan Tang, Philippe Laban, and Greg Durrett. 2024a. [MiniCheck: Efficient fact-checking of LLMs on grounding documents](https://md.research.elamur.ai/free/en/papers/tang-2024-minicheck-efficient-fact-checking-llms/). In EMNLP.
34. Yi Tang and 1 others. 2024b. [MultiHop-RAG: Benchmarking retrieval-augmented generation for multi-hop queries](https://md.research.elamur.ai/free/en/papers/tang-2024-multihop-rag-benchmarking-retrieval-augmented/). arXiv:2401.15391.
35. Harsh Trivedi, Niranjan Balasubramanian, Tushar Khot, and Ashish Sabharwal. 2022. MuSiQue: Multi-hop questions via single hop question composition. TACL, 10:539–554. [find](https://scholar.google.com/scholar?q=Harsh+Trivedi%2C+Niranjan+Balasubramanian%2C+Tushar+Khot%2C+and+Ashish+Sabharwal%2E+2022%2E+MuSiQue%3A+Multi%2Dhop+questions+via+single+hop+question+composition%2E+TACL%2C+10%3A539%E2%80%93554%2E)
36. Van Truong and 1 others. 2025. A comprehensive taxonomy of negation for NLP and LLMs. arXiv:2507.22337. — [arXiv:2507.22337](https://arxiv.org/abs/2507.22337) [find](https://scholar.google.com/scholar?q=Van+Truong+and+1+others%2E+2025%2E+A+comprehensive+taxonomy+of+negation+for+NLP+and+LLMs%2E+arXiv%3A2507%2E22337%2E+%E2%80%94+%5BarXiv%3A2507%2E22337%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2507%2E22337%29)
37. Joshua Maynez, Shashi Narayan, Bernd Bohnet, and Ryan McDonald. 2020. [On faithfulness and factuality in abstractive summarization](https://md.research.elamur.ai/free/en/papers/maynez-2020-faithfulness-factuality-abstractive-summarization/). In ACL, pages 1906–1919.
38. Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. [Attention is all you need](https://md.research.elamur.ai/free/en/papers/vaswani-2017-attention-all-need/). In NeurIPS, pages 5998–6008.
39. Sewon Min, Kalpesh Krishna, Xinxi Lyu, Mike Lewis, Wen tau Yih, Pang Wei Koh, Mohit Iyyer, Luke Zettlemoyer, and Hannaneh Hajishirzi. 2023. [FActScore: Fine-grained atomic evaluation of factual precision in long form text generation](https://md.research.elamur.ai/free/en/papers/min-2023-factscore-fine-grained-atomic-evaluation/). In EMNLP, pages 12076–12100.
40. Jesse Vig, Sebastian Gehrmann, Yonatan Belinkov, Sharon Qian, Daniel Nishi, Jason Ahn, Daniel Jurafsky, and Bernd Bohnet. 2020. Investigating gender bias in language models using causal mediation analysis. In NeurIPS. [find](https://scholar.google.com/scholar?q=Jesse+Vig%2C+Sebastian+Gehrmann%2C+Yonatan+Belinkov%2C+Sharon+Qian%2C+Daniel+Nishi%2C+Jason+Ahn%2C+Daniel+Jurafsky%2C+and+Bernd+Bohnet%2E+2020%2E+Investigating+gender+bias+in+language+models+using+causal+mediation+anal)
41. Christoph Molnar. 2022. Interpretable Machine Learning: A Guide for Making Black Box Models Explainable, 2nd edition. [find](https://scholar.google.com/scholar?q=Christoph+Molnar%2E+2022%2E+Interpretable+Machine+Learning%3A+A+Guide+for+Making+Black+Box+Models+Explainable%2C+2nd+edition%2E)
42. Mohsan Nadeem and 1 others. 2024. Negation blindness in large language models: Unveiling the NO syndrome in image generation. arXiv:2409.00105. — [arXiv:2409.00105](https://arxiv.org/abs/2409.00105) [find](https://scholar.google.com/scholar?q=Mohsan+Nadeem+and+1+others%2E+2024%2E+Negation+blindness+in+large+language+models%3A+Unveiling+the+NO+syndrome+in+image+generation%2E+arXiv%3A2409%2E00105%2E+%E2%80%94+%5BarXiv%3A2409%2E00105%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2409%2E00105%29)
43. Sarah Wiegreffe and Yuval Pinter. 2019. [Attention is not not explanation](https://md.research.elamur.ai/free/en/papers/wiegreffe-2019-attention-is-not-not-explanation/). In EMNLP, pages 11–16.
44. Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William W. Cohen, Ruslan Salakhutdinov, and Christopher D. Manning. 2018. [HotpotQA: A dataset for diverse, explainable multi-hop question answering](https://md.research.elamur.ai/free/en/papers/yang-2018-hotpotqa-dataset-diverse-explainable-multi/). In EMNLP, pages 2369–2380.
45. Jingwei Yi, Yueqi Xie, Bin Zhu, Keegan Hines, Emre Kiciman, Guangzhong Sun, Xing Xie, and Fangzhao Wu. 2023. Benchmarking and defending against indirect prompt injection attacks on large language models. arXiv:2312.14197. — [arXiv:2312.14197](https://arxiv.org/abs/2312.14197) [find](https://scholar.google.com/scholar?q=Jingwei+Yi%2C+Yueqi+Xie%2C+Bin+Zhu%2C+Keegan+Hines%2C+Emre+Kiciman%2C+Guangzhong+Sun%2C+Xing+Xie%2C+and+Fangzhao+Wu%2E+2023%2E+Benchmarking+and+defending+against+indirect+prompt+injection+attacks+on+large+language+mode)
46. Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. [InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents](https://md.research.elamur.ai/free/en/papers/zhan-2024-injecagent-benchmarking-indirect-prompt-injections/). arXiv:2403.02691.

*Updated 1 November 2026*