FORMAT AND CONTENT CHECK — 2026-10-08

Official EMNLP 2026 / ARR initial long-paper limit: 8 pages of main content. The 9-page allowance applies to final accepted papers, not initial submission. Limitations, optional ethics, references and appendices are outside the main-content limit. Appendices remain two-column.

Implemented: official unmodified ACL review template; anonymous title block and PDF author metadata; standard page geometry and font sizes; dedicated Limitations after conclusion; ethical considerations; assistance disclosure; author-year citations; complete seed reporting; post hoc case selection disclosed; source and model hashes; explicit historical training/export qualification.

The new case and outcome analysis is descriptive, after confirmation. Its 6,000 pairs reuse 1,000 questions and are not treated as independent samples. Scientific claims remain bounded by train/export consistency, unequal supervision/evidence, model/task scope and non-adaptive attacks.

The source ZIP is an author editing package and contains the optional named-preprint branch. Do not submit that ZIP as anonymized supplementary material. The separate review supplement excludes names and named PDFs. The anonymous PDF does not link to the author's project site or repository.

Before actual submission the author must verify the manuscript, authorship, all citations and claims, artifact access and licenses, and complete the current Responsible NLP Checklist and OpenReview requirements. Do not mark these as already completed. The AI-assistance statement reflects coding, analysis, ideation/framing and drafting, not proofreading alone. The author-review and responsibility sentence was supplied by the user for this revision. It is an author statement, not an independently verified review or completion of the submission checklist.

The present files are a formatting and substantive revision, not a conference submission. No paper was submitted, no OpenReview form was filled, and no GPU job was launched.

Official sources:
https://2026.emnlp.org/calls/main_conference_papers/
https://aclrollingreview.org/cfp
https://github.com/acl-org/acl-style-files

LITERATURE AND NARRATIVE REVISION — 2026-10-08
Rewrote abstract, title, introduction and related work around useful task completion under retrieval instruction attacks. References: 46 scholarly papers plus one software citation; every entry is cited. Primary metadata and abstracts were verified, with claim roles and inspection scope in literature-audit.json. This is not a claim of full-paper reading. Three trace cases and all numerical results are retained. Compiled versions: 8 main pages, 14 total pages, no LaTeX warnings, unresolved citations, or overfull boxes. Official style unchanged.

ABSTRACT / REPRODUCIBILITY REVISION — 2026-10-08
Abstract: 182 words, problem/design/results/interpretation. Appendix: expanded from 2 to 11 pages; exact prompts and full protocol detail, per-run cost/supervision tables, context controls, all17 transfer conditions,8 attack candidate texts,3 exact case panels and source excerpts. PDFs:8 main pages,23 total. Clarified same-template attacked repetitions, shared evaluation boundaries, paired-prefix loss masking, primary benign length matching, and exposure-flag semantics. All original measurements and limitations retained. No new GPU or inference work.

LAYOUT / AUTHOR REVISION — 2026-10-08
Named author block: Yiwen Lu, University of Notre Dame, ylu37@nd.edu. Anonymous version remains anonymous. Removed forced bibliography-to-appendix page break; redesigned seed figure and spaced primary/transition tables; prevented inline code boxes from splitting across columns. No results or reference entries changed. Checked page totals are recorded in validation.json.

SEED LABELS / EXPLORATORY DIAGNOSTICS — 2026-10-08
Main figure uses Seed 1–3, mapped to stored integers in Appendix A. Added Appendix I and a main discussion pointer: all-zero-group CE counts, recovery/placebo controls, query/state extraction, and completed simple-action case study. Local phenomena are distinguished from mechanism claims. Re-scored 36 existing simple-action states and matched their complete aggregate; no new inference. Both PDFs retain 8 main pages and now have 25 total. Primary scores and reference entries unchanged.

BORDERLESS EXHIBITS — 2026-10-08
Removed the presentation-model explanation and its sole bibliography entry; 45 papers plus one software reference remain. Prompt and code displays use whitespace, indentation and monospace without frames. Exact prompt contents and all experimental records remain unchanged.

NARRATIVE REVISION — 2026-10-08
Adopted the user-approved title: Attack Resistance Is Only Half the Answer: Evaluating Search-Agent Reliability. Rewrote the 184-word abstract, case-led introduction, result transitions, case framing and conclusion; condensed repetitive qualifications while retaining material limits. All original quantitative records and 46 reference entries remain unchanged. This is a self-review and revision, not independent peer review.

ASSISTANCE STATEMENT REVISION — 2026-10-08
Condensed the acknowledgement to two sentences. Retained recorded research ideation, literature discovery, planning/analysis and drafting alongside language editing, LaTeX, coding and debugging. The review/responsibility sentence is author-supplied wording; it does not establish an independent audit or resolve the historical experimental limitations.
