Paper Citation Record · LEDGER

LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

As of 6 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 28 inbound Pith citation observations for arXiv:2408.15221.

A citation records a reference. It does not transfer a finding from one paper to another.

pith.paper-citation-record.v1
2408.15221 v2

Coverage vector

measured 0 of 0 reference resolution

Typed states for the displayed outbound observations.

Source: paper_references, paper_reference_links

measured 28 of 28 standing notices

One-hop event checks from named stored sources.

Source: scholarly_work_events, retraction_status_cache, observed 2026-08-06T06:34:29.942622+00:00

measured 28 of 28 inbound itemization

Pith citing papers itemized under the disclosed page cap.

Source: paper_references, paper_reference_links, observed 2026-08-06T00:32:00.935942Z

measured 0 of 1 external citation measurements

A source-named dated measurement, never combined with another source.

Source: arxiv_reference, observed 2026-07-04T17:30:00.600665Z

Reference resolution

0 of 0 outbound references displayed

verified exact0
verified fuzzy0
unresolved0
parse uncertain0
malformed identifier0
metadata mismatch0

External citation measurements

No source-named external measurement is stored.

Outbound references

No outbound reference observations are available for this paper version.

Pith citing papers

Observation 00f3009b-b943-4e6c-a81e-c9876dd4efe8 · inbound

AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents cites this paper.

AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 13

Resolution: verified exact; arxiv_id, observed 2026-05-14T01:35:51.196729Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation dc7aef9d-0703-43cf-9d52-107eb2ead49c · inbound

Reliable Weak-to-Strong Monitoring of LLM Agents cites this paper.

Reliable Weak-to-Strong Monitoring of LLM Agents LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 38

Resolution: unresolved; no resolver link, observed 2026-08-05T15:53:52.389653Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 0f2e6602-08ca-43d2-9b71-c8070ef34c97 · inbound

Certifiable Safe RLHF: Semantic Grounding and Fixed Penalty Constraint Optimization for Safer LLM Alignment cites this paper.

Certifiable Safe RLHF: Semantic Grounding and Fixed Penalty Constraint Optimization for Safer LLM Alignment LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 26

Resolution: unresolved; no resolver link, observed 2026-08-04T12:27:28.687570Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 309ec9ad-75ad-489f-8785-ee5c42109a05 · inbound

Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks cites this paper.

Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 19

Resolution: unresolved; no resolver link, observed 2026-08-04T09:40:45.154452Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 4b3e7a82-fdde-47cc-9155-3044d9651a7f · inbound

SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses cites this paper.

SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 102

Resolution: unresolved; no resolver link, observed 2026-08-04T09:25:46.079982Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 1a126705-4d3b-41e5-91f1-f56f557d7299 · inbound

ASTRA: An Automated Framework for Strategy Discovery, Retrieval, and Evolution for Jailbreaking LLMs cites this paper.

ASTRA: An Automated Framework for Strategy Discovery, Retrieval, and Evolution for Jailbreaking LLMs LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 25

Resolution: verified exact; arxiv_id, observed 2026-05-18T01:55:38.102301Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation 247a5f25-22ba-4dda-8c19-878517708f42 · inbound

TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense cites this paper.

TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 13

Resolution: verified exact; arxiv_id, observed 2026-05-11T00:35:50.926434Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation a0f878cb-8114-447b-940e-cd4f89f64fbb · inbound

Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion cites this paper.

Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 41

Resolution: verified exact; arxiv_id, observed 2026-05-11T10:46:04.298032Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation 7536afa1-8f93-42f7-aebb-3233d15663a0 · inbound

The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems cites this paper.

The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 17

Resolution: verified exact; arxiv_id, observed 2026-05-11T09:16:04.319458Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation b8f758b8-04bd-4c98-b15a-60c8b6524bd3 · inbound

MASCing: Configurable Mixture-of-Experts Behavior via Activation Steering Masks cites this paper.

MASCing: Configurable Mixture-of-Experts Behavior via Activation Steering Masks LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 29

Resolution: verified exact; arxiv_id, observed 2026-05-12T10:36:30.234082Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation 564491a8-4c05-4997-9103-3bee6e9e20a3 · inbound

MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety cites this paper.

MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 5

Resolution: metadata mismatch; arxiv_id, observed 2026-05-11T09:31:01.117969Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation dfc78e53-93fb-41db-bf6c-48a286a0781e · inbound

Evolving and Detecting Multi-Turn Deception using Geometric Signatures cites this paper.

Evolving and Detecting Multi-Turn Deception using Geometric Signatures LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 4

Resolution: verified exact; arxiv_id, observed 2026-06-29T15:23:32.700901Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation 9946a1cd-f8e2-4ad4-82e5-f7b21607fdff · inbound

Learning from Mistakes: Can LLM Self-Recover after Misalignment? cites this paper.

Learning from Mistakes: Can LLM Self-Recover after Misalignment? LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 28

Resolution: unresolved; no resolver link, observed 2026-07-13T18:51:10.298187Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 284104f1-8e15-4221-b954-329445444012 · inbound

SentGuard: Sentence-Level Streaming Guardrails for Large Language Models cites this paper.

SentGuard: Sentence-Level Streaming Guardrails for Large Language Models LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 19

Resolution: metadata mismatch; arxiv_id, observed 2026-07-01T22:56:20.699869Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation 3049dbee-2d34-46df-a22d-a70daf20d4b8 · inbound

Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents cites this paper.

Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 12

Resolution: verified exact; arxiv_id, observed 2026-07-02T04:16:36.009627Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation a3a43767-df8f-4547-8278-1b7e140699c0 · inbound

Where Instruction Hierarchy Breaks: Diagnosing and Repairing Failures in Reasoning Language Models cites this paper.

Where Instruction Hierarchy Breaks: Diagnosing and Repairing Failures in Reasoning Language Models LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 9

Resolution: verified exact; arxiv_id, observed 2026-07-02T17:47:18.134705Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation 61326c0e-fcbf-4c6e-9818-5e9ed641c4ea · inbound

From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails cites this paper.

From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 30

Resolution: verified exact; arxiv_id, observed 2026-07-03T16:58:43.534360Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation 69b52be5-acb9-44ee-891c-ecefc9fbcba6 · inbound

NRT-Bench: Benchmarking Multi-Turn Red-Teaming of LLM Operator Agents in Safety-Critical Control Rooms cites this paper.

NRT-Bench: Benchmarking Multi-Turn Red-Teaming of LLM Operator Agents in Safety-Critical Control Rooms LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 14

Resolution: verified exact; arxiv_id, observed 2026-07-04T04:09:34.476904Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation 621dde8d-66f7-41e2-8abd-fef7d8c646a7 · inbound

PHANTOM: A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Models cites this paper.

PHANTOM: A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Models LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 14

Resolution: verified exact; arxiv_id, observed 2026-07-04T17:09:59.528094Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation 61d50880-a3b8-44fd-8e0d-baf2b1480e20 · inbound

Do Thinking Tokens Help with Safety? cites this paper.

Do Thinking Tokens Help with Safety? LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 73

Resolution: metadata mismatch; arxiv_id, observed 2026-07-04T17:30:00.602650Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation c78087e5-adb2-4f36-8087-e8dc34bc18db · inbound

Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety cites this paper.

Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 10

Resolution: verified exact; arxiv_id, observed 2026-07-03T20:38:54.925819Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.

Observation 368139f9-4c32-473b-8a35-3f186dd78d3a · inbound

AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation cites this paper.

AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 15

Resolution: unresolved; no resolver link, observed 2026-07-14T06:40:17.865408Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 52be3610-9d22-4093-b472-d455bb546b5d · inbound

Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security cites this paper.

Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 1939

Resolution: unresolved; no resolver link, observed 2026-08-01T16:19:08.626130Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 2b05152e-9391-4fb2-8bf2-2754d6943dd3 · inbound

The safety failures we are not instrumenting: a perspective on hidden safety-critical challenges in modern AI systems cites this paper.

The safety failures we are not instrumenting: a perspective on hidden safety-critical challenges in modern AI systems LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 39

Resolution: unresolved; no resolver link, observed 2026-08-01T12:54:34.458741Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 517c58ae-e33a-4b57-a802-dda793e6ad6d · inbound

Chain-of-Models: Cross-Model Auditing for Bias-Robust LLM Judges cites this paper.

Chain-of-Models: Cross-Model Auditing for Bias-Robust LLM Judges LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 55

Resolution: unresolved; no resolver link, observed 2026-08-03T00:55:24.309791Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 0067c403-d465-4008-9400-5843a1aea210 · inbound

Alignment Is Local: A Paired Diagnostic for GUI Agents under User-Side Persuasion cites this paper.

Alignment Is Local: A Paired Diagnostic for GUI Agents under User-Side Persuasion LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 16

Resolution: unresolved; no resolver link, observed 2026-08-03T11:50:47.128838Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation 51f6832f-3f61-4b2a-8830-0224e9affcb8 · inbound

SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks cites this paper.

SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 52

Resolution: unresolved; no resolver link, observed 2026-08-06T00:32:00.935942Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.

Observation fb46f4d2-7cbb-4a41-ab8f-5d17ec9f892c · inbound

Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulation cites this paper.

Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulation LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet

Reference 2

Resolution: unresolved; no resolver link, observed 2026-08-04T05:44:22.263222Z

Source-reported events for the cited work

Unavailable: canonical work link unavailable.