{"as_of":"2026-08-07T05:37:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:31b73e9c4a4ac6195026b72d153ab70dd97730469dfeb3a15f2e3636ae67eb62","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":30,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":30,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-06T06:34:29.942622+00:00","state":"measured"},{"denominator":30,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":30,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T00:15:01.464128Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-07-04T17:30:00.600665Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2410.09024","last_updated":"2025-04-18T14:30:31Z","snapshot_observed_at":"2026-08-02T12:38:54.249632Z","submitted_at":"2024-10-11T17:39:22Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","version":3},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-05-14T01:35:50.992477Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2410.09024"},"observation_digest":"sha256:30dc6d71ddc4b0ed737490896e1d23ff2ce479fac20ccfdaadf9e5bf7b34e823","observation_id":"00f3009b-b943-4e6c-a81e-c9876dd4efe8","resolution":{"observed_at":"2026-05-14T01:35:51.196729Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-07T00:15:01.464128Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2506.14922","last_updated":"2025-06-24T19:55:23Z","snapshot_observed_at":"2026-08-07T04:49:42.432527Z","submitted_at":"2025-06-17T19:08:02Z","title":"FORTRESS: Frontier Risk Evaluation for National Security and Public Safety","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T00:15:01.464128Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2506.14922"},"observation_digest":"sha256:75c2e9e29b217665b3ee3f3af7802c1f029e983db00afa3762f37060ef8b42fa","observation_id":"d5622b38-d1cb-47b7-9f96-0a23a7be94db","resolution":{"observed_at":"2026-08-07T00:15:01.464128Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-06T21:50:24.381051Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.02956","last_updated":"2025-06-29T23:28:55Z","snapshot_observed_at":"2026-08-06T21:40:50.164647Z","submitted_at":"2025-06-29T23:28:55Z","title":"A Representation Engineering Perspective on the Effectiveness of Multi-Turn Jailbreaks","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-06T21:50:24.381051Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2507.02956"},"observation_digest":"sha256:9790936006d005814c2837786dfb95157209fc21779518b945005677381097b1","observation_id":"c6e2f740-a3b4-4596-b545-b38fd8c10bda","resolution":{"observed_at":"2026-08-06T21:50:24.381051Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-05T15:53:52.389653Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.19461","last_updated":"2025-08-26T22:29:31Z","snapshot_observed_at":"2026-08-06T04:54:53.822239Z","submitted_at":"2025-08-26T22:29:31Z","title":"Reliable Weak-to-Strong Monitoring of LLM Agents","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-05T15:53:52.389653Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2508.19461"},"observation_digest":"sha256:feb5a081bdb7c32ab6cfd7ec1301e02ebcd352dec03e4003736e75bb66d01bf7","observation_id":"dc7aef9d-0703-43cf-9d52-107eb2ead49c","resolution":{"observed_at":"2026-08-05T15:53:52.389653Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-04T12:27:28.687570Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.03520","last_updated":"2026-06-10T17:21:57Z","snapshot_observed_at":"2026-08-04T12:27:27.081107Z","submitted_at":"2025-10-03T21:24:41Z","title":"Certifiable Safe RLHF: Semantic Grounding and Fixed Penalty Constraint Optimization for Safer LLM Alignment","version":2},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-04T12:27:28.687570Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2510.03520"},"observation_digest":"sha256:dd7db88f884a851e943d8c2c00d795ea3633928a9bcc6e596f1d80bf09c69020","observation_id":"0f2e6602-08ca-43d2-9b71-c8070ef34c97","resolution":{"observed_at":"2026-08-04T12:27:28.687570Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-04T09:40:45.154452Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.14207","last_updated":"2026-06-29T03:28:16Z","snapshot_observed_at":"2026-08-06T18:39:48.029758Z","submitted_at":"2025-10-16T01:27:44Z","title":"Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks","version":3},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-04T09:40:45.154452Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2510.14207"},"observation_digest":"sha256:35e388bb8aab12430db3dfedb977864ccfeae78f976ea867022f91a0f59e767a","observation_id":"309ec9ad-75ad-489f-8785-ee5c42109a05","resolution":{"observed_at":"2026-08-04T09:40:45.154452Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-04T09:25:46.079982Z","title":"LLM defenses are not robust to multi-turn human jailbreaks yet.CoRR, abs/2408.15221, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-06T02:45:04.316908Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":102,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:46.079982Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:6a95cb1b8d860d4a9427152e32d1ae13e0e523d1cd50af9dfd198e1312b72062","observation_id":"4b3e7a82-fdde-47cc-9155-3044d9651a7f","resolution":{"observed_at":"2026-08-04T09:25:46.079982Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2511.02356","last_updated":"2026-04-20T12:25:45Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-11-04T08:24:22Z","title":"ASTRA: An Automated Framework for Strategy Discovery, Retrieval, and Evolution for Jailbreaking LLMs","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-18T01:54:22.995178Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2511.02356"},"observation_digest":"sha256:c568499904709c2cf642bcfc47b29de28257fd00d74f529ab20aee706e577730","observation_id":"1a126705-4d3b-41e5-91f1-f56f557d7299","resolution":{"observed_at":"2026-05-18T01:55:38.102301Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2604.07727","last_updated":"2026-04-09T02:22:44Z","snapshot_observed_at":"2026-07-06T22:57:00.904627Z","submitted_at":"2026-04-09T02:22:44Z","title":"TrajGuard: Streaming Hidden-state Trajectory Detection for Decoding-time Jailbreak Defense","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-05-10T18:26:19.922383Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2604.07727"},"observation_digest":"sha256:501fe29c7374ffa1ea8c421a9b6368cf8fb6bd396b8494d7b473a2110d63b05d","observation_id":"247a5f25-22ba-4dda-8c19-878517708f42","resolution":{"observed_at":"2026-05-11T00:35:50.926434Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2604.10326","last_updated":"2026-04-11T19:19:05Z","snapshot_observed_at":"2026-07-06T22:59:01.129724Z","submitted_at":"2026-04-11T19:19:05Z","title":"Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-05-10T15:19:46.920899Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2604.10326"},"observation_digest":"sha256:ab4b8416f08249d6de24c9da62a5efb686e7c95a814a7506831c70f9757fd264","observation_id":"a0f878cb-8114-447b-940e-cd4f89f64fbb","resolution":{"observed_at":"2026-05-11T10:46:04.298032Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2604.11309","last_updated":"2026-04-13T11:12:30Z","snapshot_observed_at":"2026-07-30T17:13:57.164751Z","submitted_at":"2026-04-13T11:12:30Z","title":"The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-10T16:07:31.602378Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2604.11309"},"observation_digest":"sha256:770071576cda3e7cd3babe98b715ea02a56641ceb387562c7a7a3c2ec9b37523","observation_id":"7536afa1-8f93-42f7-aebb-3233d15663a0","resolution":{"observed_at":"2026-05-11T09:16:04.319458Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2604.27818","last_updated":"2026-04-30T12:58:57Z","snapshot_observed_at":"2026-08-02T17:42:15.364009Z","submitted_at":"2026-04-30T12:58:57Z","title":"MASCing: Configurable Mixture-of-Experts Behavior via Activation Steering Masks","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-07T05:31:47.682478Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2604.27818"},"observation_digest":"sha256:989a588fd137e430ad4c2a892c90859b16bd76db466a67979a6aabe6ae4d7669","observation_id":"b8f758b8-04bd-4c98-b15a-60c8b6524bd3","resolution":{"observed_at":"2026-05-12T10:36:30.234082Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2605.01687","last_updated":"2026-05-03T02:55:30Z","snapshot_observed_at":"2026-07-06T23:14:52.417213Z","submitted_at":"2026-05-03T02:55:30Z","title":"MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-05-10T16:00:32.413225Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2605.01687"},"observation_digest":"sha256:050cc99d142021ea85dc7c942eed295652506d25fb105a7cf07dcd1543d3f073","observation_id":"564491a8-4c05-4997-9103-3bee6e9e20a3","resolution":{"observed_at":"2026-05-11T09:31:01.117969Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2605.27671","last_updated":"2026-05-26T20:48:33Z","snapshot_observed_at":"2026-08-04T03:57:33.093718Z","submitted_at":"2026-05-26T20:48:33Z","title":"Evolving and Detecting Multi-Turn Deception using Geometric Signatures","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-06-29T15:17:58.804973Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2605.27671"},"observation_digest":"sha256:54b87237ab71f304cb2143def8240dbc9f0b89d5cf84b51f83fa8560f6e9429d","observation_id":"dfc78e53-93fb-41db-bf6c-48a286a0781e","resolution":{"observed_at":"2026-06-29T15:23:32.700901Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-13T18:51:10.298187Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2606.00003","last_updated":"2026-03-25T15:36:15Z","snapshot_observed_at":"2026-07-13T18:51:10.077827Z","submitted_at":"2026-03-25T15:36:15Z","title":"Learning from Mistakes: Can LLM Self-Recover after Misalignment?","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-07-13T18:51:10.298187Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.00003"},"observation_digest":"sha256:0e0e4ee76389d9f6c88587bcaf4efae344a9ca35436ecbea5de41d639692adb2","observation_id":"9946a1cd-f8e2-4ad4-82e5-f7b21607fdff","resolution":{"observed_at":"2026-07-13T18:51:10.298187Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.02041","last_updated":"2026-06-01T10:30:08Z","snapshot_observed_at":"2026-08-06T02:57:08.156185Z","submitted_at":"2026-06-01T10:30:08Z","title":"SentGuard: Sentence-Level Streaming Guardrails for Large Language Models","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-06-28T14:51:17.667213Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.02041"},"observation_digest":"sha256:9e07e95bcb59827e2e24f117746100d9038d1e21ebe126c71794e3672ec7c122","observation_id":"284104f1-8e15-4221-b954-329445444012","resolution":{"observed_at":"2026-07-01T22:56:20.699869Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.04141","last_updated":"2026-06-02T18:53:17Z","snapshot_observed_at":"2026-08-02T13:02:03.082813Z","submitted_at":"2026-06-02T18:53:17Z","title":"Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-28T09:15:57.044886Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.04141"},"observation_digest":"sha256:7c9e0c6448f0a46a61ca4ca78669e03e6eba7b672c17a9891bce681ab7731774","observation_id":"3049dbee-2d34-46df-a22d-a70daf20d4b8","resolution":{"observed_at":"2026-07-02T04:16:36.009627Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.07808","last_updated":"2026-06-05T19:36:48Z","snapshot_observed_at":"2026-07-06T23:47:24.424525Z","submitted_at":"2026-06-05T19:36:48Z","title":"Where Instruction Hierarchy Breaks: Diagnosing and Repairing Failures in Reasoning Language Models","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-27T21:51:34.829877Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.07808"},"observation_digest":"sha256:a838d5c2e15578cc715c605c2a6f61f2153a2b36c916e054dc2a3aed99c9ed5b","observation_id":"a3a43767-df8f-4547-8278-1b7e140699c0","resolution":{"observed_at":"2026-07-02T17:47:18.134705Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.14517","last_updated":"2026-06-16T09:28:39Z","snapshot_observed_at":"2026-07-06T23:52:28.557859Z","submitted_at":"2026-06-12T14:49:00Z","title":"From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-06-27T04:42:05.886984Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.14517"},"observation_digest":"sha256:a6bb6ed9b192db3f55a220418c388c89f9430d2e71a4b5b40d3723d1c8f3bae8","observation_id":"61326c0e-fcbf-4c6e-9818-5e9ed641c4ea","resolution":{"observed_at":"2026-07-03T16:58:43.534360Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.20408","last_updated":"2026-06-19T01:38:27Z","snapshot_observed_at":"2026-08-03T15:44:02.265910Z","submitted_at":"2026-06-18T15:57:53Z","title":"NRT-Bench: Benchmarking Multi-Turn Red-Teaming of LLM Operator Agents in Safety-Critical Control Rooms","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-26T17:13:26.201462Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.20408"},"observation_digest":"sha256:70b64b903b7f5f898629136fb211df0beacb18d2eeeaaf6107e9aa5a893ceeae","observation_id":"69b52be5-acb9-44ee-891c-ecefc9fbcba6","resolution":{"observed_at":"2026-07-04T04:09:34.476904Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.24388","last_updated":"2026-06-23T10:20:40Z","snapshot_observed_at":"2026-07-06T23:58:58.854077Z","submitted_at":"2026-06-23T10:20:40Z","title":"PHANTOM: A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Models","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-06-25T23:52:02.327522Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.24388"},"observation_digest":"sha256:fd65978ddad36a32404120a524acb5cfae76ae877277e795801b2619d321708a","observation_id":"621dde8d-66f7-41e2-8abd-fef7d8c646a7","resolution":{"observed_at":"2026-07-04T17:09:59.528094Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2606.25013","last_updated":"2026-06-23T17:59:01Z","snapshot_observed_at":"2026-08-03T16:39:59.297765Z","submitted_at":"2026-06-23T17:59:01Z","title":"Do Thinking Tokens Help with Safety?","version":1},"reference_index":73,"source":"arxiv_source","source_observed_at":"2026-06-25T23:37:49.412578Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2606.25013"},"observation_digest":"sha256:fede6a1e8fb66a987f45f34cf4a018e36159810977c4d5f0aa6dca3334052b08","observation_id":"61d50880-a3b8-44fd-8e0d-baf2b1480e20","resolution":{"observed_at":"2026-07-04T17:30:00.602650Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":"2408.15221","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-04T17:30:00.600665Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":"9c0488b9-9f5f-4f7a-ba2b-55e43143aae7","year":2024},"citing_paper":{"arxiv_id":"2607.01277","last_updated":"2026-07-01T06:36:29Z","snapshot_observed_at":"2026-08-05T18:03:53.977353Z","submitted_at":"2026-07-01T06:36:29Z","title":"Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-03T20:38:16.610310Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.01277"},"observation_digest":"sha256:e95188fccb78f969578b16980b26003395430a2434742accca28285bd63d1958","observation_id":"c78087e5-adb2-4f36-8087-e8dc34bc18db","resolution":{"observed_at":"2026-07-03T20:38:54.925819Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-07-14T06:40:17.865408Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.11151","last_updated":"2026-07-13T06:46:56Z","snapshot_observed_at":"2026-07-16T23:19:13.693221Z","submitted_at":"2026-07-13T06:46:56Z","title":"AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-14T06:40:17.865408Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.11151"},"observation_digest":"sha256:2e2915db67e766cac9edb893f44767449f9ce4a2cfc6508c4104db957ba6ea40","observation_id":"368139f9-4c32-473b-8a35-3f186dd78d3a","resolution":{"observed_at":"2026-07-14T06:40:17.865408Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-01T16:19:08.626130Z","title":"LLM defenses are not robust to multi-turn human jailbreaks yet.arXiv preprint arXiv:2408.15221,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18063","last_updated":"2026-07-20T15:30:38Z","snapshot_observed_at":"2026-08-01T16:19:07.520649Z","submitted_at":"2026-07-20T15:30:38Z","title":"Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security","version":1},"reference_index":1939,"source":"pdf_text","source_observed_at":"2026-08-01T16:19:08.626130Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.18063"},"observation_digest":"sha256:cf3d2e77c7d2fdfe64e95f4aa9d8f92fb4e74b72cbccceecd29960d2a7acf652","observation_id":"52be3610-9d22-4093-b472-d455bb546b5d","resolution":{"observed_at":"2026-08-01T16:19:08.626130Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-01T12:54:34.458741Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.19292","last_updated":"2026-07-21T17:02:37Z","snapshot_observed_at":"2026-08-03T15:34:37.424189Z","submitted_at":"2026-07-21T17:02:37Z","title":"The safety failures we are not instrumenting: a perspective on hidden safety-critical challenges in modern AI systems","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-01T12:54:34.458741Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.19292"},"observation_digest":"sha256:b61980a760e023bd9e3349c1c851bee9fd29e41405bf5e79f1d328eaa1879dd7","observation_id":"2b05152e-9391-4fb2-8bf2-2754d6943dd3","resolution":{"observed_at":"2026-08-01T12:54:34.458741Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-03T00:55:24.309791Z","title":"arXiv preprint arXiv:2408.15221 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.28636","last_updated":"2026-05-19T13:56:13Z","snapshot_observed_at":"2026-08-06T00:38:04.006327Z","submitted_at":"2026-05-19T13:56:13Z","title":"Chain-of-Models: Cross-Model Auditing for Bias-Robust LLM Judges","version":1},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-03T00:55:24.309791Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.28636"},"observation_digest":"sha256:4441a3d3c70c9d2f93245644517af2e90330d93b309cd074fa1b871a65683c99","observation_id":"517c58ae-e33a-4b57-a802-dda793e6ad6d","resolution":{"observed_at":"2026-08-03T00:55:24.309791Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-03T11:50:47.128838Z","title":"Primack, Riley Goodside, Hugh Zhang, Zifan Wang, Cristina Menghini, and Summer Yue","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.29199","last_updated":"2026-07-31T09:18:55Z","snapshot_observed_at":"2026-08-06T16:41:38.516023Z","submitted_at":"2026-07-31T09:18:55Z","title":"Alignment Is Local: A Paired Diagnostic for GUI Agents under User-Side Persuasion","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-03T11:50:47.128838Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2607.29199"},"observation_digest":"sha256:8194edea7d818473aa45f365f4c099da859a4fe1295b23d2a3fea1b7b82797fc","observation_id":"0067c403-d465-4008-9400-5843a1aea210","resolution":{"observed_at":"2026-08-03T11:50:47.128838Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-06T00:32:00.935942Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:00.935942Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:5f053eded338bbab6266c20cb0ab6c2acb04a125b4c515c398287d461600ade1","observation_id":"51f6832f-3f61-4b2a-8830-0224e9affcb8","resolution":{"observed_at":"2026-08-06T00:32:00.935942Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-04T05:44:22.263222Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.02518","last_updated":"2026-08-03T17:15:55Z","snapshot_observed_at":"2026-08-06T23:39:04.784535Z","submitted_at":"2026-08-03T17:15:55Z","title":"Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulation","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-04T05:44:22.263222Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2608.02518"},"observation_digest":"sha256:65820630765a962f62f40ff6df5c159196b0d0641450855d28338841f3acf2d6","observation_id":"fb46f4d2-7cbb-4a41-ab8f-5d17ec9f892c","resolution":{"observed_at":"2026-08-04T05:44:22.263222Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2408.15221/citation-record","integrity":"/paper/2408.15221/integrity","json":"/paper/2408.15221/citation-record.json","paper":"/paper/2408.15221"},"outbound":[],"paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","latest_version":2,"primary_category":"cs.LG","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"thesis":"As of 7 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 30 inbound Pith citation observations for arXiv:2408.15221."}