{"as_of":"2026-08-13T01:12:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:d7e3d1412e5c9c14ac204b45c179619ec1a3afef655e48e2889b54445fa8492f","coverage":[{"denominator":57,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":57,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-12T14:04:45.533578Z","state":"measured"},{"denominator":57,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":57,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-12T06:34:41.77262+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2411.15720/citation-record","integrity":"/paper/2411.15720/integrity","json":"/paper/2411.15720/citation-record.json","paper":"/paper/2411.15720"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-12T14:04:45.265930Z","title":"Gpt-4 technical report","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.265930Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:115833db066cf59e20a55accca46c12b42ec5eb3f709185c34ff0257958da08b","observation_id":"9465c12d-16e0-42fd-9df6-635c937d8f8d","resolution":{"observed_at":"2026-08-12T14:04:45.265930Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:45.271659Z","title":"Flamingo: a visual language model for few-shot learning","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.271659Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:7fc17b4bca57edba96a730b95c0264e5c67c51bc00a2ae35109876737ba78b50","observation_id":"278eacc9-6bb0-4c15-91c4-0d24191c39dc","resolution":{"observed_at":"2026-08-12T14:04:45.271659Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00236","last_updated":"2024-09-17T19:56:09Z","snapshot_observed_at":"2026-08-12T22:38:41.877359Z","submitted_at":"2023-09-01T03:53:40Z","title":"Image Hijacks: Adversarial Images can Control Generative Models at Runtime","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00236","snapshot_observed_at":"2026-08-12T14:04:45.276730Z","title":"Image hijacks: Adversarial images can control generative models at runtime","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.276730Z"},"links":{"cited_paper":"/paper/2309.00236","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:4567f0dc62ecd9c348336238073749ad7fac30c4732c2e18b7af0225c73ec6d6","observation_id":"724168eb-2f27-4764-901e-b5c6e2853967","resolution":{"observed_at":"2026-08-12T14:04:45.276730Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.505305Z","title":"One transformer fits all distributions in multi-modal diffu- sion at scale","venue":null,"work_id":"0b4e362c-5454-426b-a43a-e268b8193c97","year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.281986Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:e34b56e27226c3a9bcccbf798d3ab28402edf3d4b63febdaa49a93dc918c5b13","observation_id":"0f3c50c8-331c-400d-bcb1-1a28d6f2a09e","resolution":{"observed_at":"2026-08-12T14:04:46.510234Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2108.07258","last_updated":"2022-07-12T23:45:14Z","snapshot_observed_at":"2026-08-02T09:20:40.804790Z","submitted_at":"2021-08-16T17:50:08Z","title":"On the Opportunities and Risks of Foundation Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2108.07258","snapshot_observed_at":"2026-08-12T14:04:45.286960Z","title":"On the opportunities and risks of foundation models","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.286960Z"},"links":{"cited_paper":"/paper/2108.07258","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:0439382f6ec195513af2e75e4b70e92e78acd4f48f3b0cb9b5e74dc85e09d967","observation_id":"dca4f61e-f790-474d-bd4b-140f50cfccbc","resolution":{"observed_at":"2026-08-12T14:04:45.286960Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1902.06705","last_updated":"2019-02-20T17:38:32Z","snapshot_observed_at":"2026-08-12T14:46:48.605924Z","submitted_at":"2019-02-18T18:18:27Z","title":"On Evaluating Adversarial Robustness","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1902.06705","snapshot_observed_at":"2026-08-12T14:04:45.291956Z","title":"On evaluating adversarial robustness","venue":null,"work_id":null,"year":1902},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.291956Z"},"links":{"cited_paper":"/paper/1902.06705","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:72d550a7dfce3158cbd6462bc9ff1bd0db97656202e45afdb2b8e2709b7c1c49","observation_id":"2a3d54cd-5d13-4f8c-9179-1262e0056135","resolution":{"observed_at":"2026-08-12T14:04:45.291956Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.490065Z","title":"Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36, 2024","venue":null,"work_id":"c864ee18-efab-43b9-bf31-d06d3a70d334","year":2024},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.297408Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:1a65b7194dea06b1ba7781578377c702e281573a985e75bd0b1d2ffe472b9676","observation_id":"ac2367b1-b2ed-4d99-a166-27d6df747aaf","resolution":{"observed_at":"2026-08-12T14:04:46.494925Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1712.02051","last_updated":"2018-05-22T01:56:51Z","snapshot_observed_at":"2026-07-06T06:13:00.334649Z","submitted_at":"2017-12-06T06:08:59Z","title":"Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1712.02051","snapshot_observed_at":"2026-08-12T14:04:45.302110Z","title":"Attacking visual language grounding with adversarial examples: A case study on neural image caption- ing","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.302110Z"},"links":{"cited_paper":"/paper/1712.02051","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:a15890b52797c1721b39f2086d47c2126d89eb70dd7b8d2d81c3519eef9dbbc1","observation_id":"def00373-d365-4270-8781-2a5121f04642","resolution":{"observed_at":"2026-08-12T14:04:45.302110Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.09105","last_updated":"2024-03-04T11:30:06Z","snapshot_observed_at":"2026-08-12T21:50:02.076863Z","submitted_at":"2023-03-16T06:37:16Z","title":"Rethinking Model Ensemble in Transfer-based Adversarial Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.09105","snapshot_observed_at":"2026-08-12T14:04:45.307991Z","title":"Rethinking model ensem- ble in transfer-based adversarial attacks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.307991Z"},"links":{"cited_paper":"/paper/2303.09105","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:b3786c688d3acf8ffb0797929712c5496926f3e0bb43789314454164b62d22b4","observation_id":"ef3077b2-2aa8-405b-a459-109a278f3a35","resolution":{"observed_at":"2026-08-12T14:04:45.307991Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.474928Z","title":"Visualgpt: Data-efficient adaptation of pretrained language models for image captioning","venue":null,"work_id":"e82b7ef5-432b-43bd-92a6-02fa6c8a26d1","year":2022},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.313248Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:d7e25697f75368ff62cc9e8cfbb58369d356fa74d4c27ac0de2b003cb38d8ace","observation_id":"d5b04198-9e4d-49f2-a807-185ac811989b","resolution":{"observed_at":"2026-08-12T14:04:46.479746Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1504.00325","last_updated":"2015-04-03T20:21:16Z","snapshot_observed_at":"2026-08-04T18:05:27.145522Z","submitted_at":"2015-04-01T18:13:43Z","title":"Microsoft COCO Captions: Data Collection and Evaluation Server","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1504.00325","snapshot_observed_at":"2026-08-12T14:04:45.317956Z","title":"Microsoft coco captions: Data collection and evaluation server","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.317956Z"},"links":{"cited_paper":"/paper/1504.00325","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:b56beb81b1d09d25159cf64e88eb900b770204c1c094ce2a40620723d77ca528","observation_id":"1a00a7c4-09f5-4230-afbd-962ed25caae8","resolution":{"observed_at":"2026-08-12T14:04:45.317956Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:45.322630Z","title":"Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.322630Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:d25954cabc6d3e04007881c2a47c63f33e35d113be32abd5887d479fcdf58f89","observation_id":"2c4dbad5-255b-498f-b98e-6f7ea2be4121","resolution":{"observed_at":"2026-08-12T14:04:45.322630Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.448888Z","title":"On the robustness of large multimodal mod- els against image adversarial attacks","venue":null,"work_id":"fc0e15e7-9b9b-45b3-8edd-290f061ce69a","year":2024},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.327198Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:7c1b4c9d8530d6bb7c64462b4fd80f7e175a942ea4b8d21989dc0646dda835d3","observation_id":"cb4aeab9-d8a7-4d16-8e41-98e7d221a17e","resolution":{"observed_at":"2026-08-12T14:04:46.453752Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.431846Z","title":"Imagenet: A large-scale hierarchical image database","venue":null,"work_id":"38ba960e-1539-409d-809b-2143b3d96919","year":2009},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.331657Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:db709d90213632ecfed70c0441f330ac36fbde1346723f7a6a1becde2e9de968","observation_id":"b4684860-9ea8-47c9-85af-bd2b360debb7","resolution":{"observed_at":"2026-08-12T14:04:46.437420Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.416618Z","title":"Boosting adversarial at- tacks with momentum","venue":null,"work_id":"f3be1d5e-c7ef-42d3-9c8b-d4d6632b28d9","year":2018},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.336219Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:6da62ca43e8708ef6e291595c7ceedead11701580b34663aa0f49f9a2a374cd8","observation_id":"5722d0ba-873b-4a86-9fed-4a897f2f0db7","resolution":{"observed_at":"2026-08-12T14:04:46.421440Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.400610Z","title":"Query-efficient black-box adversarial attacks guided by a transfer-based prior","venue":null,"work_id":"ce2efef5-fd17-42ab-bdc9-d3c72ba511ae","year":null},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.340730Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:d703a8d24aeeb1bc3064363e9df45caabf796499588527e54aeb7e3b40297810","observation_id":"eff8c265-d324-4f9f-888e-83c2eb789aab","resolution":{"observed_at":"2026-08-12T14:04:46.406233Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.11751","last_updated":"2023-10-14T12:56:13Z","snapshot_observed_at":"2026-08-10T05:12:13.391312Z","submitted_at":"2023-09-21T03:24:30Z","title":"How Robust is Google's Bard to Adversarial Image Attacks?","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.11751","snapshot_observed_at":"2026-08-12T14:04:45.345445Z","title":"How robust is google’s bard to adversarial image at- tacks? arXiv preprint arXiv:2309.11751, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.345445Z"},"links":{"cited_paper":"/paper/2309.11751","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:6396c3e8f0c964e8f20ddc67bb286eb05c8bfa0766dc165685fb586e7c017bc9","observation_id":"b305d782-bd03-4cc6-9574-69ebd0f8cdd0","resolution":{"observed_at":"2026-08-12T14:04:45.345445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2010.11929","last_updated":"2021-06-03T13:08:56Z","snapshot_observed_at":"2026-08-10T01:12:16.468283Z","submitted_at":"2020-10-22T17:55:59Z","title":"An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2010.11929","snapshot_observed_at":"2026-08-12T14:04:45.350159Z","title":"An image is worth 16x16 words: Transformers for image recognition at scale","venue":null,"work_id":null,"year":2010},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.350159Z"},"links":{"cited_paper":"/paper/2010.11929","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:31475d3fef95a32ea7607e18fbbda88850638bd6640d57bff64018ad0fef4f27","observation_id":"2527124c-5dab-42b9-ba28-354b1739f51a","resolution":{"observed_at":"2026-08-12T14:04:45.350159Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.384896Z","title":"Transferable decoding with visual entities for zero-shot image captioning","venue":null,"work_id":"c82b147b-fced-4f63-ab06-2f6f50a8c757","year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.354889Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:49ff8190db72ea52550735ca68577731b971ef78f6d39e82e5848afcd66d7c9c","observation_id":"0dc6c3e0-3019-4a23-9054-092bfa50da79","resolution":{"observed_at":"2026-08-12T14:04:46.389920Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03185","last_updated":"2023-10-04T22:10:01Z","snapshot_observed_at":"2026-08-10T21:58:21.136877Z","submitted_at":"2023-10-04T22:10:01Z","title":"Misusing Tools in Large Language Models With Visual Adversarial Examples","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03185","snapshot_observed_at":"2026-08-12T14:04:45.359652Z","title":"Misusing tools in large language mod- els with visual adversarial examples","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.359652Z"},"links":{"cited_paper":"/paper/2310.03185","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:72098cf4de1a106f1bf1b1d1153d7c7418d5e278df0997a4f2b69f2f751848b3","observation_id":"d99fc87f-5a8e-416b-bb9a-3951d919900d","resolution":{"observed_at":"2026-08-12T14:04:45.359652Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05608","last_updated":"2025-01-19T16:23:38Z","snapshot_observed_at":"2026-08-12T23:35:24.639756Z","submitted_at":"2023-11-09T18:59:11Z","title":"FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05608","snapshot_observed_at":"2026-08-12T14:04:45.364618Z","title":"Figstep: Jailbreaking large vision-language models via typo- graphic visual prompts","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.364618Z"},"links":{"cited_paper":"/paper/2311.05608","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:3e095f5b20a3722d61e489c69e1377b4b10f40fb0237d46460a00c25d0ac698a","observation_id":"455e54ab-a27b-4814-8c6b-0ccdb3868698","resolution":{"observed_at":"2026-08-12T14:04:45.364618Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1412.6572","last_updated":"2015-03-20T20:19:16Z","snapshot_observed_at":"2026-08-12T17:13:46.394331Z","submitted_at":"2014-12-20T01:17:12Z","title":"Explaining and Harnessing Adversarial Examples","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1412.6572","snapshot_observed_at":"2026-08-12T14:04:45.369843Z","title":"Explaining and harnessing adversarial ex- amples","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.369843Z"},"links":{"cited_paper":"/paper/1412.6572","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:ba5e99726e793839c6f6320134605d24582fa100ea22b523dfec5b8034adfa36","observation_id":"eb0c1066-5b28-4eb1-98e9-a7599193977c","resolution":{"observed_at":"2026-08-12T14:04:45.369843Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.368969Z","title":"Simple black-box adversar- ial attacks","venue":null,"work_id":"18930f62-9e37-4b9d-ad40-6f7d2d8e779c","year":2019},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.374370Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:2933b8ec583c8f3be680bd187ac50fa753a45eeeb7a213b0ba4c5e9a6025217b","observation_id":"23b15a9f-03a8-420a-9193-10ce65785e56","resolution":{"observed_at":"2026-08-12T14:04:46.373846Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:45.378882Z","title":"Deep residual learning for image recognition","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.378882Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:82eb7fd4737c5ebbde7f4c9b8f804467ac08724944129fcc46a8a3212db1cdec","observation_id":"d9f44e4a-fcfb-46a5-837f-3629ed15c53c","resolution":{"observed_at":"2026-08-12T14:04:45.378882Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.342762Z","title":"Enhancing adversarial example transferability with an intermediate level attack","venue":null,"work_id":"accb6f78-157b-4332-a986-1df2f5340d52","year":2019},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.383684Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:3d510c9f30743b1b9484d4ed9d8fd392c840b82bff10d07f1b31db657f981ee3","observation_id":"260eec44-4f03-47d9-829d-eff3209d306b","resolution":{"observed_at":"2026-08-12T14:04:46.347680Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.326907Z","title":"Black-box adversarial attacks with limited queries and information","venue":null,"work_id":"feb77d3b-3783-41ee-9007-184770a854f1","year":2018},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.388510Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:7af28c174a18000d422bec7f335a62be94790b72440febee9b80d3f982b8cc73","observation_id":"0e744330-1374-4afe-b196-5bcdd9791f62","resolution":{"observed_at":"2026-08-12T14:04:46.331922Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:45.394023Z","title":"Jailbreakzoo: Survey, landscapes, and horizons in jailbreaking large language and vision-language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.394023Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:44d4f0973304a61807acfc848c4adf11d32487d89ee26f692478e01123392609","observation_id":"57ac0a62-e22f-4c7b-ae8f-71f2b98b55be","resolution":{"observed_at":"2026-08-12T14:04:45.394023Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:45.399083Z","title":"Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.399083Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:51ec6f50b8b4b307ddf34efda353c97cd81e64da00a404372f5e27d5d2e45312","observation_id":"6eb0efc9-d3b0-458d-b9e8-be1d4452e1ff","resolution":{"observed_at":"2026-08-12T14:04:45.399083Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.301524Z","title":"Improved baselines with visual instruction tuning","venue":null,"work_id":"0ba749f0-a9c9-46e5-95a0-f9846c8aea0d","year":2024},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.403338Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:033111f0bbef66ec68f1b4a06ab6908f4cb0a083558e911a086e7c19b85a5b5d","observation_id":"8809e5a4-2b83-48e4-81de-90f8229468ee","resolution":{"observed_at":"2026-08-12T14:04:46.306412Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.286008Z","title":"Visual instruction tuning","venue":null,"work_id":"89fa3851-09bb-49c6-94c8-02da34917bfc","year":2024},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.407508Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:e3027b2fa079964a94bad3c452a0dd2f0210d0d064da115f6bab8dce53aff634","observation_id":"ae9cf933-1803-4760-a0d3-924c70bc902d","resolution":{"observed_at":"2026-08-12T14:04:46.291322Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1611.02770","last_updated":"2017-02-07T14:24:44Z","snapshot_observed_at":"2026-07-06T05:17:56.287788Z","submitted_at":"2016-11-08T23:25:00Z","title":"Delving into Transferable Adversarial Examples and Black-box Attacks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1611.02770","snapshot_observed_at":"2026-08-12T14:04:45.412014Z","title":"Delving into transferable adversarial examples and black- box attacks","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.412014Z"},"links":{"cited_paper":"/paper/1611.02770","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:cdd61f49a7e40e0179a847cd37ed209d4360caa3b73b80af7a5c8211e22eb9ea","observation_id":"f529ce5c-d849-4d9c-8f6b-8ede1a60fba4","resolution":{"observed_at":"2026-08-12T14:04:45.412014Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.270274Z","title":"Delving into transferable adversarial examples and black- box attacks","venue":null,"work_id":"e0f5cb1c-5435-49e8-bbf0-9375d2bef212","year":2017},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.416609Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:203405425fc20605cd2cd6718d80c5b9a845476f6cd86b79c6f703397ebb322d","observation_id":"11626c42-057c-481f-8623-7e7c4cb46010","resolution":{"observed_at":"2026-08-12T14:04:46.275318Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1706.06083","last_updated":"2019-09-04T18:53:10Z","snapshot_observed_at":"2026-08-07T14:27:46.872660Z","submitted_at":"2017-06-19T17:53:11Z","title":"Towards Deep Learning Models Resistant to Adversarial Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1706.06083","snapshot_observed_at":"2026-08-12T14:04:45.421221Z","title":"Towards deep learning models resis- tant to adversarial attacks","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.421221Z"},"links":{"cited_paper":"/paper/1706.06083","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:12f2c224c2d04f88a44059cbf940cb51735bdf4ae165656a9b562b2887d09bef","observation_id":"c9a7b32e-17ad-4556-a584-f33a14cf35f0","resolution":{"observed_at":"2026-08-12T14:04:45.421221Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2111.09734","last_updated":"2021-11-18T14:49:15Z","snapshot_observed_at":"2026-08-11T17:44:55.630525Z","submitted_at":"2021-11-18T14:49:15Z","title":"ClipCap: CLIP Prefix for Image Captioning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2111.09734","snapshot_observed_at":"2026-08-12T14:04:45.425894Z","title":"Clip- cap: Clip prefix for image captioning","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.425894Z"},"links":{"cited_paper":"/paper/2111.09734","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:13f50f5d4033fbd9cc9e35c2951a187e9372429bd0cc5c6cfb1c98a980feed74","observation_id":"db831ca2-61dd-425b-977f-52846b6be8fe","resolution":{"observed_at":"2026-08-12T14:04:45.425894Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:45.430441Z","title":"Deep neural networks are easily fooled: High confidence predictions for unrecognizable images","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.430441Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:05cd6671f9fbd644727cc0c50a099aca452e64cb3a17d687a549606a626dcf87","observation_id":"3a583908-46da-47a4-8df0-be3535eab082","resolution":{"observed_at":"2026-08-12T14:04:45.430441Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.244886Z","title":"Practi- cal black-box attacks against machine learning","venue":null,"work_id":"33f67f96-f3d5-4038-9780-d5a236e615ba","year":2017},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.434999Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:86f310da40c855867523565e9e03ff1d95a603c5916f7f8d4c0221bf306425b5","observation_id":"aabf837b-6f64-4191-ae19-f3ce9c8c758c","resolution":{"observed_at":"2026-08-12T14:04:46.249927Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2202.03286","last_updated":"2022-02-07T15:22:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-02-07T15:22:17Z","title":"Red Teaming Language Models with Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.03286","snapshot_observed_at":"2026-08-12T14:04:45.439661Z","title":"Red teaming language models with language models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.439661Z"},"links":{"cited_paper":"/paper/2202.03286","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:01332f6eaf862656ffed5640f8620eef6281c4a3527f5cfb56919663504b5ff9","observation_id":"68c7a997-5a37-4ed7-a343-df167c9bab1b","resolution":{"observed_at":"2026-08-12T14:04:45.439661Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.13213","last_updated":"2023-08-16T22:38:55Z","snapshot_observed_at":"2026-08-09T21:14:39.812982Z","submitted_at":"2023-06-22T22:13:03Z","title":"Visual Adversarial Examples Jailbreak Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.13213","snapshot_observed_at":"2026-08-12T14:04:45.445238Z","title":"Visual adversarial exam- ples jailbreak large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.445238Z"},"links":{"cited_paper":"/paper/2306.13213","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:8984b33f741a371fadc6450dba66634b28578b44a1431820fb05296781637ac1","observation_id":"131bc890-ff1a-4462-9df5-d54cb3533721","resolution":{"observed_at":"2026-08-12T14:04:45.445238Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.229364Z","title":"Boosting the transferability of ad- versarial attacks with reverse adversarial perturbation","venue":null,"work_id":"1170440e-fac3-4d2d-a644-301b025f8c11","year":2022},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.450171Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:97b63e6d31df2e588451485f92c238f1e55458973da3eb9239a8aabc892ce8df","observation_id":"0dffcf7f-c20d-452f-b7cc-3a0407f56fdb","resolution":{"observed_at":"2026-08-12T14:04:46.234182Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:45.454674Z","title":"Language models are unsu- pervised multitask learners","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.454674Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:6bacc86ecdd5bf16017ebf1a3a49dc7a79372a2d33403cbc97b5e2e892a1065e","observation_id":"ee143442-8368-488e-ab7b-81699295b20b","resolution":{"observed_at":"2026-08-12T14:04:45.454674Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.203107Z","title":"Learning transferable visual models from natural language supervi- sion","venue":null,"work_id":"67cc39bc-65dc-403e-9def-25ef9adc5565","year":2021},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.459263Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:10a971babee118577c4e19a9afaa3a87d6fc15f49fb7ff89774f261068ec198c","observation_id":"f4571ce6-ad84-41da-8b59-415926b0dbf1","resolution":{"observed_at":"2026-08-12T14:04:46.208805Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.186061Z","title":"Smallcap: lightweight image captioning prompted with retrieval augmentation","venue":null,"work_id":"2a1a214c-0e4d-416e-9cd3-117ec19995cd","year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.463657Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:ac5f73c32f517252bd549859068c10539acdfef8ea0b0113c504aa0e9b9d72da","observation_id":"32d7222d-9524-403b-897f-02f3b6ae6d1e","resolution":{"observed_at":"2026-08-12T14:04:46.191362Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2210.04610","last_updated":"2022-11-10T10:07:37Z","snapshot_observed_at":"2026-08-09T06:08:06.497420Z","submitted_at":"2022-10-03T14:04:46Z","title":"Red-Teaming the Stable Diffusion Safety Filter","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2210.04610","snapshot_observed_at":"2026-08-12T14:04:45.468299Z","title":"Red-teaming the stable diffusion safety filter","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.468299Z"},"links":{"cited_paper":"/paper/2210.04610","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:766a92defea4b2355a35a18cd3ebf1f4f5ea0f581a68ddfaf3ff90d5047ad1ef","observation_id":"e6be4645-f99b-4a08-a473-f920a359b44b","resolution":{"observed_at":"2026-08-12T14:04:45.468299Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.170153Z","title":"High-resolution image synthesis with latent diffusion models","venue":null,"work_id":"113abf47-29c4-43f1-904f-8ad83d24122c","year":2022},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.472955Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:006f737fb619063951867439a19c0c97200f3a0543c715aa1f3dde5f08f5dac2","observation_id":"04091d0e-6ac4-47c8-a029-93a8bad3915a","resolution":{"observed_at":"2026-08-12T14:04:46.175234Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.13971","last_updated":"2023-02-27T17:11:15Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-02-27T17:11:15Z","title":"LLaMA: Open and Efficient Foundation Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.13971","snapshot_observed_at":"2026-08-12T14:04:45.477320Z","title":"Llama: Open and efficient foundation language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.477320Z"},"links":{"cited_paper":"/paper/2302.13971","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:a4560c23734841550931cf7c23ae4bbe32d4eaf695ecc3879cb5bcb6a34ec49e","observation_id":"e7ef2b3d-079c-4fc7-afe2-6f4c17489b54","resolution":{"observed_at":"2026-08-12T14:04:45.477320Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-12T14:04:45.482107Z","title":"Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:2307.09288, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.482107Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:5bda28b0c4a5adec373a91dcb42650f062e220cbdcd3c20b031f82e393c5781b","observation_id":"819d6954-93ba-49d1-a469-f2e347f8677b","resolution":{"observed_at":"2026-08-12T14:04:45.482107Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.154462Z","title":"How many unicorns are in this image a safety evaluation benchmark for vision llms","venue":null,"work_id":"a052cbf5-d7ff-4d01-bf04-1f3874d83105","year":2024},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.486582Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:20cefac9115878e1a92ce7c9d8e2797746ca367c277b40415dc700c405d4ef49","observation_id":"fac32d46-9ac9-47b8-86bf-1126fdaf3be9","resolution":{"observed_at":"2026-08-12T14:04:46.159394Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.138289Z","title":"Decodingtrust: A com- prehensive assessment of trustworthiness in gpt models","venue":null,"work_id":"15cf9d98-f273-4595-bc49-aa5f0d94d716","year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.490762Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:02fedb399bc3b06a894a9d0155e88cceac96bde92de1b5c37d43efa61d92c39b","observation_id":"87f9dc7d-f8f0-4b69-aecc-f2dd709e3b53","resolution":{"observed_at":"2026-08-12T14:04:46.143484Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.122300Z","title":"Exact adversarial attack to image captioning via structured output learning with la- tent variables","venue":null,"work_id":"02b12460-4d52-42d2-add0-c315af58cb00","year":2019},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.495218Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:3926e598204370aeeae0ed942c0cdfd5a8d0274ab1d775fcf155df63caf920fa","observation_id":"73c3d2fd-7404-4b75-aaf8-ce54a53d3172","resolution":{"observed_at":"2026-08-12T14:04:46.127179Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.23687","last_updated":"2025-05-17T03:16:08Z","snapshot_observed_at":"2026-08-12T22:11:06.351764Z","submitted_at":"2024-10-31T07:22:51Z","title":"Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey","version":2},"cited_work":{"arxiv_id":"2410.23687","doi":null,"metadata_source":"pith","pith_arxiv_id":"2410.23687","snapshot_observed_at":"2026-08-12T14:04:45.632058Z","title":"Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey","venue":"cs.CV","work_id":"67554233-9a31-4e4b-a41b-668094d945d8","year":2024},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.499682Z"},"links":{"cited_paper":"/paper/2410.23687","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:496dc16dc4777c0732aa1d466f1ad524d2ee9ff11fdcca95331b35e844f423ca","observation_id":"9fc0d42a-727c-4fea-b7c7-6fcd83068a03","resolution":{"observed_at":"2026-08-12T14:04:45.637508Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:45.504498Z","title":"The unreasonable effectiveness of deep features as a perceptual metric","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.504498Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:257c73da7203029be4a902aa1ad27000a1a1a99a76e050f02875106a238f35d3","observation_id":"e242e9b5-987b-4cbf-9a31-9a194fc82351","resolution":{"observed_at":"2026-08-12T14:04:45.504498Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.07673","last_updated":"2023-08-15T09:43:10Z","snapshot_observed_at":"2026-07-06T16:06:22.526631Z","submitted_at":"2023-08-15T09:43:10Z","title":"A Review of Adversarial Attacks in Computer Vision","version":1},"cited_work":{"arxiv_id":"2308.07673","doi":null,"metadata_source":"pith","pith_arxiv_id":"2308.07673","snapshot_observed_at":"2026-08-12T14:04:45.607470Z","title":"A Review of Adversarial Attacks in Computer Vision","venue":"cs.CV","work_id":"370c3a5f-79f4-4b6e-b2d3-7974e17805de","year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.509333Z"},"links":{"cited_paper":"/paper/2308.07673","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:69533d6fdd14b6e982652d615f4dcb303b4f06ac50ed93ca9a7bd9d572be5ede","observation_id":"5bd67aec-a927-4b0a-b458-4f204a7d0253","resolution":{"observed_at":"2026-08-12T14:04:45.614774Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.10137","last_updated":"2023-10-15T10:04:38Z","snapshot_observed_at":"2026-07-06T15:05:00.197020Z","submitted_at":"2023-03-17T17:25:10Z","title":"A Recipe for Watermarking Diffusion Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.10137","snapshot_observed_at":"2026-08-12T14:04:45.513954Z","title":"A recipe for watermarking dif- fusion models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.513954Z"},"links":{"cited_paper":"/paper/2303.10137","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:7c30ab66f94582602d9a97f2b6bd87eb171e2da0f57c2679750456f252993a3c","observation_id":"f62fb484-f36f-4296-a72d-05ee7d4f33ed","resolution":{"observed_at":"2026-08-12T14:04:45.513954Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.096260Z","title":"On evaluating adversarial robustness of large vision-language models","venue":null,"work_id":"cc323c93-88d5-428c-9c79-48552994db8f","year":2024},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.519480Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:04af0d9e257bdaa2634ff151dd4870cfc7887f0adaa14d5912d7e25e96f0e2f8","observation_id":"44e1525b-a63d-4526-afd9-50c78ff60cc9","resolution":{"observed_at":"2026-08-12T14:04:46.101716Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.079910Z","title":"Transferable ad- versarial perturbations","venue":null,"work_id":"58c07361-357f-411b-9857-7fa917b401a0","year":2018},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.524051Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:9d67288ca12e6933fd571d9538e3f4377f20310a0fd4e0d6be36ce548f9d3db6","observation_id":"8447102d-4c56-4706-9e50-36519ca91265","resolution":{"observed_at":"2026-08-12T14:04:46.084878Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2304.10592","last_updated":"2023-10-02T16:38:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-04-20T18:25:35Z","title":"MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.10592","snapshot_observed_at":"2026-08-12T14:04:45.528550Z","title":"Minigpt-4: Enhancing vision-language understanding with advanced large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.528550Z"},"links":{"cited_paper":"/paper/2304.10592","citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:71c97284381abbcb8f79a1a218b4c80325d1d9793d7603f8922370bdc542ff4a","observation_id":"cf23132f-9ad5-4d51-9356-af7bce5250f5","resolution":{"observed_at":"2026-08-12T14:04:45.528550Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T14:04:46.063598Z","title":"How do you think of this image?","venue":null,"work_id":"cfd23ce9-3714-4d04-be1f-d2ff8b2858fd","year":null},"citing_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-12T14:04:45.533578Z"},"links":{"citing_paper":"/paper/2411.15720"},"observation_digest":"sha256:4721907967cc70fa973cc6bb8d1c211e928d68560c8ecdc538d94048c53088b6","observation_id":"deaa29fd-bdcf-41e4-bd4a-0cbfb48337c2","resolution":{"observed_at":"2026-08-12T14:04:46.068676Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","latest_version":1,"primary_category":"cs.CV","snapshot_observed_at":"2026-08-12T21:50:03.029809Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks"},"reference_resolution":{"displayed":57,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":30,"verified_exact":2,"verified_fuzzy":25},"total_outbound_references":57},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"thesis":"As of 13 August 2026, this Paper Citation Record lists 57 of 57 outbound references and 0 inbound Pith citation observations for arXiv:2411.15720."}