paper: final pre-arXiv audit — fix 3 stale numbers

Pre-submission audit caught three places where numbers hadn't been
updated to the post-AgentDojo / 5-LLM corpus:

  line 151 (intro Empirical headlines):  "660 tool calls"  -> 675
                                          also added the AgentDojo
                                          attribution that was already
                                          in the body but missing here
  line 525 (OpenAPI reframing in §3):    "0--6%" MCP-family  -> 0--1%
                                          (matches the AgentDojo
                                          measurement)
  line 839 (§6.1 limitations):           "two LLMs"  ->  "five LLMs
                                          across four vendors using
                                          AgentDojo's attack templates"

All other instances were already consistent (verified with grep).
Headline numbers and vendor lists now match across abstract, intro,
§3 prose, figure caption, conclusion, and §6.1. Re-verified abstract
remains under arXiv's 1920-char metadata limit (1866 chars).

Compile check: clean, 15 pages, 498 KB. arXiv tarball rebuilt.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: WaylandYang

docs/paper/dcp-arxiv-v0.3.1.tar.gz

@@ -148,10 +148,12 @@ \section{Introduction}
 designed from the start for LLM callers.
 
 \paragraph{Empirical headlines.} Two findings up front, both measured
-(\S\ref{sec:safety}, \S\ref{sec:impl}): (i) across 660 tool calls
+(\S\ref{sec:safety}, \S\ref{sec:impl}): (i) across 675 tool calls
 produced by five LLMs across four vendors (DeepSeek\,V3; Alibaba Qwen
 2.5-72B and Qwen 3.5-35B-A3B; Zhipu GLM-4-32B; MiniMax M2.5) in
-response to six categories of adversarial prompts, DCP rejects
+response to six categories of adversarial prompts --- with the
+prompt-injection category instantiated from AgentDojo's~\cite{agentdojo}
+attack templates --- DCP rejects
 100\,\% of capability escalation attempts and 78\,\% of prompt
 injection attempts (the latter category instantiated from the seven
 attack templates in AgentDojo~\cite{agentdojo}, adapted to the
@@ -519,7 +521,7 @@ \subsection{Safety model}\label{sec:safety}
 a well-written OpenAPI service, in a runtime three orders of magnitude
 smaller, on hardware OpenAPI cannot reach. The protocols that
 \emph{can} reach this hardware --- Raw MCP and IoT-MCP --- sit at
-0--6\,\% across the columns that matter (capability, prompt
+0--1\,\% across the columns that matter (capability, prompt
 injection), and that is the gap the paper actually closes.
 
 \begin{figure}[h]
@@ -836,7 +838,8 @@ \subsection{What this paper does not prove}
 We have validated the reference implementation on one MCU (ESP32-WROOM-32)
 over one transport (UART), reported its compiled footprint, measured
 its end-to-end latency, and run an empirical adversarial-prompt study
-against two LLMs (Section~\ref{sec:safety}, Figure~\ref{fig:halluc}).
+against five LLMs across four vendors using AgentDojo's attack templates
+(Section~\ref{sec:safety}, Figure~\ref{fig:halluc}).
 We have \emph{not} established:
 
 \begin{itemize}[leftmargin=*,nosep]