{"as_of":"2026-08-23T23:21:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:90c466aadf8a48826f0c09d48cad09d24ffedc0d89550c709c62c044a6cc9dc3","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":55,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":55,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-23T06:30:58.430688+00:00","state":"measured"},{"denominator":55,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":55,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-16T11:05:54.141304Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-07-09T10:26:11.131634Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2310.03684","last_updated":"2024-06-11T19:02:52Z","snapshot_observed_at":"2026-08-17T15:25:03.596568Z","submitted_at":"2023-10-05T17:01:53Z","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","version":4},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-05-14T17:11:00.639293Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2310.03684"},"observation_digest":"sha256:2be6006a2719d044c90c86eebaa88c26509f1a6b45fbd6c3b41a6ac14cc3bf88","observation_id":"631bfaad-3fa2-4fae-ac76-5779a5c67dd1","resolution":{"observed_at":"2026-05-14T17:11:00.805894Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2404.01318","last_updated":"2024-10-31T22:26:40Z","snapshot_observed_at":"2026-08-11T16:28:21.917686Z","submitted_at":"2024-03-28T02:44:02Z","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","version":5},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-05-15T06:08:05.386345Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2404.01318"},"observation_digest":"sha256:d29e00aac9435cf7dc7c7831fc2fca1de3d9f9be275f12e9c240dea19661ed02","observation_id":"16e16c7d-57e5-4dd9-933b-72ca8b2c757f","resolution":{"observed_at":"2026-05-15T06:08:05.632731Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2407.04295","last_updated":"2024-08-30T11:57:47Z","snapshot_observed_at":"2026-08-12T17:45:10.384900Z","submitted_at":"2024-07-05T06:57:30Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-05-15T02:20:44.368219Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2407.04295"},"observation_digest":"sha256:940febd38b2a333ebf79d8bed3f6c1a00bba21bd8025b3f97e515c9b579d07a3","observation_id":"ed3bd17f-e334-4801-aab6-521ee2ee6ffa","resolution":{"observed_at":"2026-05-15T02:20:44.701189Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2409.10102","last_updated":"2026-05-16T07:15:07Z","snapshot_observed_at":"2026-08-19T16:52:43.098992Z","submitted_at":"2024-09-16T09:06:44Z","title":"Trustworthiness in Retrieval-Augmented Generation Systems: A Survey","version":2},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-05-23T21:08:11.787013Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2409.10102"},"observation_digest":"sha256:b8684ab02ba92ded4acc3932a535118297e3b0299f46f2f91210d8f74c03d565","observation_id":"30c23f4e-9525-4707-a82a-3fed24844c62","resolution":{"observed_at":"2026-05-23T21:08:25.977185Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-11T22:41:27.545838Z","title":"Certifying llm safety against adversarial prompting","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.03235","last_updated":"2025-03-25T12:49:43Z","snapshot_observed_at":"2026-08-20T13:36:07.746784Z","submitted_at":"2024-12-04T11:36:37Z","title":"Does Safety Training of LLMs Generalize to Semantically Related Natural Prompts?","version":2},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-11T22:41:27.545838Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2412.03235"},"observation_digest":"sha256:07de7859f5be8dee9308224f5a3aea2d40afa6104720953fc4d19b43d7209810","observation_id":"067b97c0-090d-4a19-94ae-c5e60c6c44d9","resolution":{"observed_at":"2026-08-11T22:41:27.545838Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-11T12:57:06.202073Z","title":"Certifying LLM safety against adversarial prompting","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2412.13705","last_updated":"2024-12-18T10:49:41Z","snapshot_observed_at":"2026-08-18T00:10:03.512528Z","submitted_at":"2024-12-18T10:49:41Z","title":"Mitigating Adversarial Attacks in LLMs through Defensive Suffix Generation","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-11T12:57:06.202073Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2412.13705"},"observation_digest":"sha256:135b1dce55249a9347e68419841fe94a1ac946e5cf63fb9819a1a9fa9d0fc157","observation_id":"b9687f5e-8ce3-42c1-9d87-e8cecd757124","resolution":{"observed_at":"2026-08-11T12:57:06.202073Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-11T05:19:34.409300Z","title":"1106–1114, 2012","venue":null,"work_id":null,"year":2012},"citing_paper":{"arxiv_id":"2412.17686","last_updated":"2024-12-23T16:11:27Z","snapshot_observed_at":"2026-08-13T21:57:18.514742Z","submitted_at":"2024-12-23T16:11:27Z","title":"Large Language Model Safety: A Holistic Survey","version":1},"reference_index":2012,"source":"pdf_text","source_observed_at":"2026-08-11T05:19:34.409300Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2412.17686"},"observation_digest":"sha256:44d7d70d5688d652b43834969b4f9fb8a1f420fc3b65b5db55612df2b50f4428","observation_id":"63f34c02-d67b-46db-a2b7-3cc9c6b7e774","resolution":{"observed_at":"2026-08-11T05:19:34.409300Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-11T05:02:26.657326Z","title":"Certifying LLM safety against adversarial prompting","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-18T22:47:52.318017Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.657326Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:b86b287c514b1beebd604e86d7c2827257736ac8336157955a594d3797feeadc","observation_id":"1c8e2bfd-f142-4877-9547-c03c44f799ff","resolution":{"observed_at":"2026-08-11T05:02:26.657326Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-10T23:40:18.863343Z","title":", author Agarwal, C","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.20087","last_updated":"2024-12-28T09:08:37Z","snapshot_observed_at":"2026-08-15T12:46:32.785416Z","submitted_at":"2024-12-28T09:08:37Z","title":"On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs","version":1},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-10T23:40:18.863343Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2412.20087"},"observation_digest":"sha256:7ca7b954d6dc09411e964d77f5cd0a41407043f9a3a517a8c886d43bae7dc8b7","observation_id":"b1d2ffc2-ae93-4667-bcc7-2d7e1f5abd91","resolution":{"observed_at":"2026-08-10T23:40:18.863343Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-10T22:12:00.047226Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-17T17:23:26.510328Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":70,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.047226Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:dd346cf0af84caf32df4759173bbfdc5e49bd456caaf77af7fd241d7f231a383","observation_id":"8dccb1ad-7a00-4758-8163-e94637e9e88d","resolution":{"observed_at":"2026-08-10T22:12:00.047226Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-10T20:34:36.508096Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.08246","last_updated":"2025-01-14T16:32:01Z","snapshot_observed_at":"2026-08-15T11:29:32.348529Z","submitted_at":"2025-01-14T16:32:01Z","title":"Text-Diffusion Red-Teaming of Large Language Models: Unveiling Harmful Behaviors with Proximity Constraints","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-10T20:34:36.508096Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2501.08246"},"observation_digest":"sha256:17453c6f9ad1d8504ee522aa5de2343beb5ee3ea1b4a42c51ef41adfa082ebf2","observation_id":"ba88c8c3-1e8b-4b93-8a26-bc931f53e8bf","resolution":{"observed_at":"2026-08-10T20:34:36.508096Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-10T12:52:40.928821Z","title":"Certifying LLM safety against adversarial prompting","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2501.16497","last_updated":"2025-01-27T20:57:26Z","snapshot_observed_at":"2026-08-17T20:21:25.789773Z","submitted_at":"2025-01-27T20:57:26Z","title":"Smoothed Embeddings for Robust Language Models","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-10T12:52:40.928821Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2501.16497"},"observation_digest":"sha256:61fbc8c0207ace481d938d2de0883a4c84a612ad4ede69061035a2a489c65be9","observation_id":"edc496c7-288c-4817-adef-d181b7edf0c2","resolution":{"observed_at":"2026-08-10T12:52:40.928821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-10T00:12:04.836347Z","title":"Certifying llm safety against adversarial prompting","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.18280","last_updated":"2025-05-17T04:37:43Z","snapshot_observed_at":"2026-08-17T12:29:11.666606Z","submitted_at":"2025-01-30T11:37:40Z","title":"Jailbreaking LLMs' Safeguard with Universal Magic Words for Text Embedding Models","version":3},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-10T00:12:04.836347Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2501.18280"},"observation_digest":"sha256:bb588318b95ecc4c9e91d90e58fd4f5810e0fa46dc1ddf570b1c4c2e2a807887","observation_id":"da3d688a-2342-46c6-ab35-c42f30f790ec","resolution":{"observed_at":"2026-08-10T00:12:04.836347Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-09T14:37:39.773175Z","title":"arXiv preprint arXiv:2309.02705 (2023)","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.01764","last_updated":"2025-02-03T19:09:05Z","snapshot_observed_at":"2026-08-18T01:30:59.494332Z","submitted_at":"2025-02-03T19:09:05Z","title":"Training Users Against Human and GPT-4 Generated Social Engineering Attacks","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-09T14:37:39.773175Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2502.01764"},"observation_digest":"sha256:2ed57af396e8e882e0b7a6af322c8793549a7c37bbb73d04acaeb47f315c2602","observation_id":"5a7368f9-3cd2-407b-a5fb-7a0e6b7d2f2e","resolution":{"observed_at":"2026-08-09T14:37:39.773175Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2502.05206","last_updated":"2026-04-14T16:10:41Z","snapshot_observed_at":"2026-08-20T09:36:18.005089Z","submitted_at":"2025-02-02T05:14:22Z","title":"Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety","version":6},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-05-23T04:39:04.591722Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2502.05206"},"observation_digest":"sha256:a9d89eed44bb77f1bc992c3a8883205033434c5652611ca91dfba8c1a40db2f1","observation_id":"9828062f-5849-40d1-9b97-d663117bbc92","resolution":{"observed_at":"2026-05-23T04:42:33.899921Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-08T10:23:06.144068Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.08142","last_updated":"2025-02-12T05:48:57Z","snapshot_observed_at":"2026-08-18T03:45:11.621403Z","submitted_at":"2025-02-12T05:48:57Z","title":"Bridging the Safety Gap: A Guardrail Pipeline for Trustworthy LLM Inferences","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-08T10:23:06.144068Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2502.08142"},"observation_digest":"sha256:1e02f27048751e4bf97ce1b4f9f6519499a8d1a66e1f47a7bd658ce6db1cce20","observation_id":"38238e41-52d7-45dd-abf9-04724b17db53","resolution":{"observed_at":"2026-08-08T10:23:06.144068Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-08T16:16:48.271400Z","title":"Certifying llm safety against adversarial prompting","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.10440","last_updated":"2025-05-23T15:35:10Z","snapshot_observed_at":"2026-08-14T12:03:32.873715Z","submitted_at":"2025-02-10T09:15:56Z","title":"Towards Copyright Protection for Knowledge Bases of Retrieval-augmented Language Models via Reasoning","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-08T16:16:48.271400Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2502.10440"},"observation_digest":"sha256:b09f876006784263594fd82ab7d91a5dcf375a663a578141b406e4547e66afa0","observation_id":"42fa7f62-9199-4a79-b8a9-dcac1e75db20","resolution":{"observed_at":"2026-08-08T16:16:48.271400Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-16T11:05:54.141304Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2504.16574","last_updated":"2025-04-23T09:53:01Z","snapshot_observed_at":"2026-08-16T13:56:23.152409Z","submitted_at":"2025-04-23T09:53:01Z","title":"PIS: Linking Importance Sampling and Attention Mechanisms for Efficient Prompt Compression","version":1},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-16T11:05:54.141304Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2504.16574"},"observation_digest":"sha256:9943a6f3c764b3b6c6dd88fb6116d8936da17952f6dfcae0199e98d9926ebcaa","observation_id":"fddb39bc-b53c-44c9-9040-4e0465eff828","resolution":{"observed_at":"2026-08-16T11:05:54.141304Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-15T22:26:17.933498Z","title":"Certifying LLM safety against adversarial prompting,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.08807","last_updated":"2025-05-12T02:04:57Z","snapshot_observed_at":"2026-08-15T22:20:56.452628Z","submitted_at":"2025-05-12T02:04:57Z","title":"Security of Internet of Agents: Attacks and Countermeasures","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-15T22:26:17.933498Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2505.08807"},"observation_digest":"sha256:382911600ab1a9799caffbadd0ca7904bf40031786d105c98abc109d7f5c7c44","observation_id":"5a7e5b90-202f-4a04-ab93-b32cd90ddba8","resolution":{"observed_at":"2026-08-15T22:26:17.933498Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-15T21:32:35.011638Z","title":"Certifying llm safety against adversarial prompting, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.09602","last_updated":"2025-05-14T17:52:10Z","snapshot_observed_at":"2026-08-17T22:49:04.456989Z","submitted_at":"2025-05-14T17:52:10Z","title":"Adversarial Suffix Filtering: a Defense Pipeline for LLMs","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-15T21:32:35.011638Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2505.09602"},"observation_digest":"sha256:cfccc7518957367d66e7cda861d45aeefc5bbcb922a0ba04cba8bd8e24a061b3","observation_id":"7d8eba85-300b-4352-9b4e-9cf80184c1d6","resolution":{"observed_at":"2026-08-15T21:32:35.011638Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-15T20:18:09.836301Z","title":"Certi fying llm safety against adversarial prompting,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13348","last_updated":"2025-05-19T16:51:12Z","snapshot_observed_at":"2026-08-19T00:00:35.958983Z","submitted_at":"2025-05-19T16:51:12Z","title":"Investigating the Vulnerability of LLM-as-a-Judge Architectures to Prompt-Injection Attacks","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-15T20:18:09.836301Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2505.13348"},"observation_digest":"sha256:8b708a2671e10908dfd160e11f5f77e199911ea3ff7a3fc188c451418db1fe29","observation_id":"f750fb9a-4f20-4a8f-b8de-afa25a802156","resolution":{"observed_at":"2026-08-15T20:18:09.836301Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2505.16120","last_updated":"2026-05-04T12:54:07Z","snapshot_observed_at":"2026-08-15T05:11:46.464906Z","submitted_at":"2025-05-22T01:52:15Z","title":"LLM-Powered AI Agent Systems and Their Applications in Industry","version":2},"reference_index":117,"source":"pdf_text","source_observed_at":"2026-05-22T14:05:54.535411Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2505.16120"},"observation_digest":"sha256:45c8a70e7ec224a043a472548da0b1dc843d7280a048bd0b8538c9b597aa7205","observation_id":"dffa9100-9c3a-4ca8-84fa-6049a977eb8f","resolution":{"observed_at":"2026-05-22T14:06:37.893296Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-07T14:42:37.234824Z","title":"Certifying llm safety against adversarial prompting","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.17861","last_updated":"2025-05-23T13:13:44Z","snapshot_observed_at":"2026-08-16T08:07:02.839270Z","submitted_at":"2025-05-23T13:13:44Z","title":"Superplatforms Have to Attack AI Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T14:42:37.234824Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2505.17861"},"observation_digest":"sha256:8c9338f95b4ea99535e2726a0876bfc84f26b9c3d9829ff77fc08a26264da3cc","observation_id":"f3a082e9-bc92-40ec-abb7-0c054b0d020d","resolution":{"observed_at":"2026-08-07T14:42:37.234824Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-07T13:17:21.099918Z","title":"Certifying llm safety against adversarial prompting.arXiv preprint arXiv:2309.02705, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.22271","last_updated":"2025-05-28T11:57:46Z","snapshot_observed_at":"2026-08-16T10:34:43.436922Z","submitted_at":"2025-05-28T11:57:46Z","title":"Test-Time Immunization: A Universal Defense Framework Against Jailbreaks for (Multimodal) Large Language Models","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T13:17:21.099918Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2505.22271"},"observation_digest":"sha256:972cf65b9d63f2294630adcee779fd9b2f93b51ebb9e1f785df088dde4c0b306","observation_id":"d3eb8416-463e-4425-b4f4-9836979c048e","resolution":{"observed_at":"2026-08-07T13:17:21.099918Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-07T12:37:21.159164Z","title":"Certifying llm safety against adversarial prompting.arXiv preprint arXiv:2309.02705,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.24208","last_updated":"2025-05-30T04:40:08Z","snapshot_observed_at":"2026-08-11T12:00:55.225954Z","submitted_at":"2025-05-30T04:40:08Z","title":"Bootstrapping LLM Robustness for VLM Safety via Reducing the Pretraining Modality Gap","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T12:37:21.159164Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2505.24208"},"observation_digest":"sha256:e9809783a6db818291afdd2ee703b214c6f10e900a4f483768f20c5b881b7cfe","observation_id":"05916946-9f08-4808-8aed-d87770cbb58d","resolution":{"observed_at":"2026-08-07T12:37:21.159164Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-06T21:50:27.924372Z","title":"Certifying llm safety against adversarial prompting","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2506.23346","last_updated":"2025-06-29T17:41:37Z","snapshot_observed_at":"2026-08-16T13:56:24.785537Z","submitted_at":"2025-06-29T17:41:37Z","title":"Safe and Performant Deployment of Autonomous Systems via Model Predictive Control and Hamilton-Jacobi Reachability Analysis","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-06T21:50:27.924372Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2506.23346"},"observation_digest":"sha256:bae3a62b912b1a99113a783a3898daffbac4f61345ceb5809ff591806875b307","observation_id":"96294aca-ada6-4830-a85d-48d6c525f494","resolution":{"observed_at":"2026-08-06T21:50:27.924372Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-06T16:24:30.518383Z","title":"Certifying llm safety against adversarial prompting,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.13629","last_updated":"2025-07-18T03:41:18Z","snapshot_observed_at":"2026-08-15T07:04:53.353114Z","submitted_at":"2025-07-18T03:41:18Z","title":"Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniques","version":1},"reference_index":187,"source":"pdf_text","source_observed_at":"2026-08-06T16:24:30.518383Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2507.13629"},"observation_digest":"sha256:5865145c4151c0e8c7d913339afed936ac74b3306ffccfbd01b622d0e99d87e4","observation_id":"0ee86101-436a-4575-adaa-a245aed87060","resolution":{"observed_at":"2026-08-06T16:24:30.518383Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-06T12:05:44.541606Z","title":"Certifying llm safety against adversarial prompting","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2507.22160","last_updated":"2025-07-29T18:46:56Z","snapshot_observed_at":"2026-08-18T22:51:54.414234Z","submitted_at":"2025-07-29T18:46:56Z","title":"Strategic Deflection: Defending LLMs from Logit Manipulation","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-06T12:05:44.541606Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2507.22160"},"observation_digest":"sha256:6822d3b126e2453d1960e65d9bce9f1fcf9fbacaf22fec7f49323869ca9c35ea","observation_id":"15f793b9-b949-4dce-9e30-e3e82aa31e24","resolution":{"observed_at":"2026-08-06T12:05:44.541606Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-05T23:12:59.802317Z","title":"arXiv preprint arXiv:2309.02705 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2508.05775","last_updated":"2026-07-27T20:50:40Z","snapshot_observed_at":"2026-08-23T20:50:48.930812Z","submitted_at":"2025-08-07T18:42:16Z","title":"Guardians and Offenders: A Survey on Harmful Content Generation and Safety Mitigation of LLM","version":3},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-05T23:12:59.802317Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2508.05775"},"observation_digest":"sha256:cc8111a9406d04e7c8a0ebb7d099318b42c4418eca87a7e6313d21064422a0a1","observation_id":"df7a80e7-73ef-4c35-b707-6f4833e9d6b6","resolution":{"observed_at":"2026-08-05T23:12:59.802317Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-05T22:24:23.403420Z","title":"Certifying llm safety against adversarial prompting","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2508.07139","last_updated":"2025-08-10T01:59:07Z","snapshot_observed_at":"2026-08-10T21:58:51.152330Z","submitted_at":"2025-08-10T01:59:07Z","title":"A Real-Time, Self-Tuning Moderator Framework for Adversarial Prompt Detection","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-05T22:24:23.403420Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2508.07139"},"observation_digest":"sha256:3f7944b391f2ce9160540881b4938e06ea68b77e003f9004d86212c1238ac8ac","observation_id":"c02eec3d-2f04-4f2e-9a7c-0af33298520a","resolution":{"observed_at":"2026-08-05T22:24:23.403420Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-15T17:18:24.068355Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.14128","last_updated":"2025-08-19T04:17:21Z","snapshot_observed_at":"2026-08-20T17:12:48.328495Z","submitted_at":"2025-08-19T04:17:21Z","title":"CCFC: Core & Core-Full-Core Dual-Track Defense for LLM Jailbreak Protection","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-15T17:18:24.068355Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2508.14128"},"observation_digest":"sha256:d3a7ee3f6f7a5f37a0166531a285a2d93e9e2a8c9d29302a075355c697fedcbe","observation_id":"b89c6b03-55ef-4ed4-9aa2-6f69f0c2266d","resolution":{"observed_at":"2026-08-15T17:18:24.068355Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-05T10:44:10.487753Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.03787","last_updated":"2025-09-04T00:45:58Z","snapshot_observed_at":"2026-08-22T09:09:46.965070Z","submitted_at":"2025-09-04T00:45:58Z","title":"Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domain","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-05T10:44:10.487753Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2509.03787"},"observation_digest":"sha256:6c502a51321080e3ec5285433c0e819fe4badabccd721b8224d7ccc3cadb15b2","observation_id":"72fec629-b593-4885-80d1-c63beb3e8e61","resolution":{"observed_at":"2026-08-05T10:44:10.487753Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-04T23:09:41.473339Z","title":"Certifying llm safety against adversarial prompting,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.06807","last_updated":"2025-09-08T15:39:17Z","snapshot_observed_at":"2026-08-16T17:43:04.020971Z","submitted_at":"2025-09-08T15:39:17Z","title":"MoGU V2: Toward a Higher Pareto Frontier Between Model Usability and Security","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-04T23:09:41.473339Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2509.06807"},"observation_digest":"sha256:23ddf4171720ca0bd92631dfda14d11bf585b70f6d9c870c1f8a1db33586dfad","observation_id":"1eebe795-ea34-4255-a580-d7a0b4b0d66b","resolution":{"observed_at":"2026-08-04T23:09:41.473339Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-04T21:44:12.318888Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.07764","last_updated":"2025-09-09T13:59:00Z","snapshot_observed_at":"2026-08-16T08:20:46.909525Z","submitted_at":"2025-09-09T13:59:00Z","title":"AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-04T21:44:12.318888Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2509.07764"},"observation_digest":"sha256:bc4c80286891c915a1307ab3c37d71108c08fad3159182c6161843b74aea7a1d","observation_id":"758bf927-a815-4e7b-a2c5-a5e6843da869","resolution":{"observed_at":"2026-08-04T21:44:12.318888Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2510.09689","last_updated":"2026-04-17T02:42:09Z","snapshot_observed_at":"2026-08-14T16:47:16.555613Z","submitted_at":"2025-10-09T09:44:14Z","title":"When Search Goes Wrong: Red-Teaming Web-Augmented Large Language Models","version":3},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-18T09:29:14.842228Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2510.09689"},"observation_digest":"sha256:65f0d8df029b4c1acc7a306b682794ed8a64a4a4933c206c5f7bc1e5e491ae60","observation_id":"039e0742-22f3-4a98-9c64-534d84230ae3","resolution":{"observed_at":"2026-05-18T09:31:11.646688Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-04T09:25:45.397309Z","title":"Certifying LLM safety against adversarial prompting.CoRR, abs/2309.02705, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:45.397309Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:04dbee18ff22e95febc23e377e82d05f1a8013cbdc476d5ee78cef1641fa6b4d","observation_id":"510fa07b-1d80-43a3-9c68-e3914854dc9c","resolution":{"observed_at":"2026-08-04T09:25:45.397309Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2512.05439","last_updated":"2026-05-07T21:46:58Z","snapshot_observed_at":"2026-08-15T07:07:55.413881Z","submitted_at":"2025-12-05T05:34:06Z","title":"BEAVER: An Efficient Deterministic LLM Verifier","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-17T01:58:44.719715Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2512.05439"},"observation_digest":"sha256:3b8a94ef28e7697f84b3a0146e2d6f2ab986c488d59f44e106e795c9e0b144ec","observation_id":"7068a9da-7e48-4fb7-af66-9367cc3fce90","resolution":{"observed_at":"2026-05-17T01:58:51.336475Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2604.03976","last_updated":"2026-05-04T20:58:24Z","snapshot_observed_at":"2026-07-06T22:53:01.835843Z","submitted_at":"2026-04-05T05:42:20Z","title":"Quantifying Trust: Financial Risk Management for Trustworthy AI Agents","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-13T17:16:17.464937Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2604.03976"},"observation_digest":"sha256:aae787a679d175314c3cce01a04d03d8c4064909155796bc6e9d292d4227c497","observation_id":"742d023c-c22e-41d8-9422-6fb186a319dc","resolution":{"observed_at":"2026-05-13T17:16:32.546647Z","resolver_source":"orphan_title_repair","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2604.09747","last_updated":"2026-04-10T07:22:11Z","snapshot_observed_at":"2026-08-12T18:04:41.858776Z","submitted_at":"2026-04-10T07:22:11Z","title":"ADAM: A Systematic Data Extraction Attack on Agent Memory via Adaptive Querying","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-10T17:57:59.918483Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2604.09747"},"observation_digest":"sha256:e7c0b2a7b8bec8cbb3671798738a3f0d285b5de22b5f3aa974fdf52a671961f8","observation_id":"67eb77b1-719c-4bfc-958c-616813410f69","resolution":{"observed_at":"2026-05-11T05:45:57.667592Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2604.18756","last_updated":"2026-04-20T19:00:09Z","snapshot_observed_at":"2026-08-14T07:51:40.546112Z","submitted_at":"2026-04-20T19:00:09Z","title":"Towards Understanding the Robustness of Sparse Autoencoders","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-10T05:44:24.532548Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2604.18756"},"observation_digest":"sha256:420c5d44a6252597fe64fabf5f904d461689985f6ce69a0ac4f5c650027e8013","observation_id":"f77ade4b-66b0-431f-b006-0d2153c9f251","resolution":{"observed_at":"2026-05-10T05:46:10.241956Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2604.22089","last_updated":"2026-04-23T21:41:09Z","snapshot_observed_at":"2026-08-16T04:00:03.960304Z","submitted_at":"2026-04-23T21:41:09Z","title":"Ethics Testing: Proactive Identification of Generative AI System Harms","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-05-09T20:49:22.147548Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2604.22089"},"observation_digest":"sha256:c4f76b6385264aeff2908c603d7803c9d54b97e6bb86aa5c9e4f70e00937fa95","observation_id":"f4f54fa7-3020-4fb1-9dbb-b50c0d9f1373","resolution":{"observed_at":"2026-05-11T14:56:08.057350Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2604.24162","last_updated":"2026-04-27T08:18:30Z","snapshot_observed_at":"2026-08-12T23:07:46.836882Z","submitted_at":"2026-04-27T08:18:30Z","title":"Defusing the Trigger: Plug-and-Play Defense for Backdoored LLMs via Tail-Risk Intrinsic Geometric Smoothing","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-08T03:09:43.879809Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2604.24162"},"observation_digest":"sha256:a4a96373ce39968d45318f9452542278c63a6d1a710927d167d5ac10e17946a1","observation_id":"8e02b80d-2e64-4ee1-a04f-f5a2a82b6032","resolution":{"observed_at":"2026-05-11T22:16:25.686124Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2604.24700","last_updated":"2026-04-27T17:04:17Z","snapshot_observed_at":"2026-08-11T03:23:03.664761Z","submitted_at":"2026-04-27T17:04:17Z","title":"Green Shielding: A User-Centric Approach Towards Trustworthy AI","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-08T03:43:54.896449Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2604.24700"},"observation_digest":"sha256:cf9b9673775fc374d35a9853339ebd0c77e9fa3ffdf5f58005329439b1a17af8","observation_id":"a1572414-af7d-48a5-8cd2-ba636ab52bfa","resolution":{"observed_at":"2026-05-11T21:56:23.340402Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2605.00236","last_updated":"2026-04-30T21:15:38Z","snapshot_observed_at":"2026-08-11T08:40:01.863341Z","submitted_at":"2026-04-30T21:15:38Z","title":"Attention Is Where You Attack","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-09T19:54:41.445447Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2605.00236"},"observation_digest":"sha256:9652698701a9b82b7c7c8a1d4e7ee7b479fecc3b40cc5eec8fe313318ba1058c","observation_id":"a48b12bb-7580-43b9-b7f4-649c91f08507","resolution":{"observed_at":"2026-05-11T15:31:05.235919Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2605.06605","last_updated":"2026-07-21T14:46:47Z","snapshot_observed_at":"2026-08-04T20:44:52.139668Z","submitted_at":"2026-05-07T17:25:15Z","title":"How Many Iterations to Jailbreak? Dynamic Budget Allocation for Multi-Turn LLM Evaluation","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-08T12:13:16.896486Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2605.06605"},"observation_digest":"sha256:3d9e94c8e7e18cc928621831d26ad86218fdce481f382cf8beb89d559f2a0461","observation_id":"476d33b0-1915-4757-8903-a0c31063cdda","resolution":{"observed_at":"2026-05-11T19:21:07.800202Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-02T14:49:14.882245Z","title":"Certifying llm safety against adversarial prompting.arXiv preprint arXiv:2309.02705, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2605.06605","last_updated":"2026-07-21T14:46:47Z","snapshot_observed_at":"2026-08-04T20:44:52.139668Z","submitted_at":"2026-05-07T17:25:15Z","title":"How Many Iterations to Jailbreak? Dynamic Budget Allocation for Multi-Turn LLM Evaluation","version":5},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-02T14:49:14.882245Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2605.06605"},"observation_digest":"sha256:a745d33eb31b443c8c477d8ecfe21763e4a77c77f7de6f9752e7e23952e6be17","observation_id":"4508b4c4-07f6-454d-b379-b70604ee8b4d","resolution":{"observed_at":"2026-08-02T14:49:14.882245Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2605.10516","last_updated":"2026-05-11T13:06:24Z","snapshot_observed_at":"2026-08-21T21:40:38.341165Z","submitted_at":"2026-05-11T13:06:24Z","title":"Consistency as a Testable Property: Statistical Methods to Evaluate AI Agent Reliability","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-12T04:41:15.286881Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2605.10516"},"observation_digest":"sha256:d41f55c36126b6940b772702e0392a5ee7bcc485d8aaec0e04026a13c9893e8d","observation_id":"ed216ea4-a6eb-4ff1-8647-fc9c1db40474","resolution":{"observed_at":"2026-05-12T04:41:21.790576Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2605.10611","last_updated":"2026-05-11T14:09:31Z","snapshot_observed_at":"2026-08-02T15:29:13.025199Z","submitted_at":"2026-05-11T14:09:31Z","title":"Re-Triggering Safeguards within LLMs for Jailbreak Detection","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-12T04:37:29.075413Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2605.10611"},"observation_digest":"sha256:d6573af90044bd3b8808d75c40080e85342cf27456eb89f11745b1faa7958a92","observation_id":"64ca20fe-1ed2-4694-9d5e-249a255c72dc","resolution":{"observed_at":"2026-05-12T06:06:25.074198Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2605.19485","last_updated":"2026-05-19T07:36:52Z","snapshot_observed_at":"2026-08-13T12:11:03.985807Z","submitted_at":"2026-05-19T07:36:52Z","title":"Attention-Guided Reward for Reinforcement Learning-based Jailbreak against Large Reasoning Models","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-20T06:33:30.647965Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2605.19485"},"observation_digest":"sha256:313ed16ff120020fd76f2463a07f126ca1202f3d62369d86e2ae7068aa654b3a","observation_id":"13365dc7-0a85-4bc8-9853-39a7b5d1634b","resolution":{"observed_at":"2026-05-20T06:38:05.831828Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2605.21674","last_updated":"2026-05-20T19:31:07Z","snapshot_observed_at":"2026-08-17T12:06:53.791751Z","submitted_at":"2026-05-20T19:31:07Z","title":"Adversarial Reframing: A Framework for Targeted Generation in Language Models","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-22T09:35:51.862736Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2605.21674"},"observation_digest":"sha256:f0c1257697583d0b77d4daaa6fe23024dbda4d4512d6eac0a20e83349eff8dcf","observation_id":"57000007-7040-4aba-8176-8cb457f56708","resolution":{"observed_at":"2026-05-22T09:36:21.028156Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2606.04141","last_updated":"2026-06-02T18:53:17Z","snapshot_observed_at":"2026-08-02T13:02:03.082813Z","submitted_at":"2026-06-02T18:53:17Z","title":"Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-06-28T09:15:57.044886Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2606.04141"},"observation_digest":"sha256:e4ceba65234c5419ecd501da5872940e55b43b9adef8f5f5c00d3a73402225aa","observation_id":"bc19f71c-d222-44f1-8b1b-e02761f36024","resolution":{"observed_at":"2026-07-02T04:16:36.016810Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2606.05609","last_updated":"2026-06-04T02:31:29Z","snapshot_observed_at":"2026-08-05T14:48:48.513078Z","submitted_at":"2026-06-04T02:31:29Z","title":"SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-06-28T01:16:07.252429Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2606.05609"},"observation_digest":"sha256:4072171b360ab53376518adecbca995024867adb6cd3b57178573924eaa4bbb4","observation_id":"feb1401b-66ba-44d2-8ea8-a30a62a14e04","resolution":{"observed_at":"2026-07-02T13:26:59.323331Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":"2309.02705","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-07-09T10:26:11.131634Z","title":"Certifying llm safety against adversar- ial prompting","venue":"cs.CL","work_id":"d19a91a9-d209-412c-b9b6-c7600e55ccf9","year":2023},"citing_paper":{"arxiv_id":"2607.07461","last_updated":"2026-07-08T14:29:23Z","snapshot_observed_at":"2026-08-15T01:33:12.143322Z","submitted_at":"2026-07-08T14:29:23Z","title":"Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-07-09T10:22:23.782469Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2607.07461"},"observation_digest":"sha256:29edfaec2946aa65c49b4b8079ab954a41b4f74698d67e05a886d78e2726e5a8","observation_id":"7fcce9d9-0859-4eb1-94ae-65d4e74112df","resolution":{"observed_at":"2026-07-09T10:26:11.133047Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-23T06:30:58.430688+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-02T01:34:11.280395Z","title":"Certifying llm safety against adversarial prompting.arXiv preprint arXiv:2309.02705, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.14651","last_updated":"2026-07-16T07:19:33Z","snapshot_observed_at":"2026-08-20T22:03:24.592631Z","submitted_at":"2026-07-16T07:19:33Z","title":"MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-02T01:34:11.280395Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2607.14651"},"observation_digest":"sha256:bd334406252af4da0429ce74e323ba7e8f97f4037ef14a62c09d8800db00179e","observation_id":"6ca8f49f-5d36-498f-aaf9-9beb9e4c8a40","resolution":{"observed_at":"2026-08-02T01:34:11.280395Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-04T01:16:13.014747Z","title":"Certifying llm safety against adversarial prompting,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.00134","last_updated":"2026-07-31T14:04:49Z","snapshot_observed_at":"2026-08-14T22:54:09.591958Z","submitted_at":"2026-07-31T14:04:49Z","title":"Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Turn Attacks","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-04T01:16:13.014747Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2608.00134"},"observation_digest":"sha256:58c23c7b16fbc0448351246b2ad71390877fd71e9f01275db4c6b872fbfd7921","observation_id":"771bd9f5-e888-44a8-a10d-77ae5df37a46","resolution":{"observed_at":"2026-08-04T01:16:13.014747Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2309.02705/citation-record","integrity":"/paper/2309.02705/integrity","json":"/paper/2309.02705/citation-record.json","paper":"/paper/2309.02705"},"outbound":[],"paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","latest_version":4,"primary_category":"cs.CL","snapshot_observed_at":"2026-08-19T18:59:35.297879Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-23T06:30:58.430688+00:00","source":"crossref"},{"observed_at":"2026-08-23T06:30:53.778098+00:00","source":"retraction_watch"}],"thesis":"As of 23 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 55 inbound Pith citation observations for arXiv:2309.02705."}