{"as_of":"2026-08-14T16:22:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:c8085144f317fe545aa24e7a7cb724cd7f33bfb19e3a53ec1d47a6dd96ea7cd1","coverage":[{"denominator":83,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":83,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-11T23:51:32.315888Z","state":"measured"},{"denominator":83,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":83,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-14T06:32:32.682623+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2412.02159/citation-record","integrity":"/paper/2412.02159/integrity","json":"/paper/2412.02159/citation-record.json","paper":"/paper/2412.02159"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:31.965606Z","title":"Alon and M","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:31.965606Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:6bdb3ce9f04fdbda5b6795db91ed9f9dcfdbc76915098ea7f4aa6cf1b74fe288","observation_id":"4392db44-522a-463b-8930-15df9fe7ee00","resolution":{"observed_at":"2026-08-11T23:51:31.965606Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:31.970014Z","title":"Andriushchenko, F","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:31.970014Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:c9cdd7a8c3006e3eb26d270ebd91fdba978db7ebb4fb053844ffdb4ba91a27b3","observation_id":"9137df4a-c4ea-4494-9e4d-5e9121bb4561","resolution":{"observed_at":"2026-08-11T23:51:31.970014Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:31.974158Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:31.974158Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:6b3ed44b8a52b07f97b47bb5fd6b4167976d8c0cb3fa0090014c5f271779b203","observation_id":"ce833e51-7700-44bf-969e-59d9a27a5dd3","resolution":{"observed_at":"2026-08-11T23:51:31.974158Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.616409Z","title":"Introducing the next generation of claude, 2024","venue":null,"work_id":"a58e9857-f867-4416-a5b1-ca8df7aa01c9","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:31.978534Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:8a13fc425a9bf3ccba2474de0797bc1cd2c61b9f1b0e7bdd0afcce6fe08203aa","observation_id":"bd581bac-fa8d-4407-84d0-7dee170142cf","resolution":{"observed_at":"2026-08-11T23:51:33.620906Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.603654Z","title":null,"venue":null,"work_id":"4f711ad2-4664-4d0c-bda5-36bca6da7c93","year":2022},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:31.982974Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:cae301787de2213c2f2374ac62e731b714ffc83d7d5ee6eeb18a04fa812188f0","observation_id":"23ad0a0d-1512-46db-8fdf-04648ce15494","resolution":{"observed_at":"2026-08-11T23:51:33.608392Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.589823Z","title":null,"venue":null,"work_id":"1abc5b59-5965-40b4-8076-1391af03d2bc","year":2018},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:31.987146Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:0e612bec8c3d00192186fabb44da1d9570112da6debd6a3a6cd81b6f39f8b51a","observation_id":"5259bb9e-5e72-46eb-b34e-945fe79c54c1","resolution":{"observed_at":"2026-08-11T23:51:33.594728Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.571610Z","title":null,"venue":null,"work_id":"d97fe727-dcad-4985-9d6c-722a1672de3a","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:31.991533Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:b0811ab3ae20f8e29628c1070f787526fe4f74c4615934466e25875746b1f210","observation_id":"0948c38b-d323-4e1a-9b13-79fefe4f7e90","resolution":{"observed_at":"2026-08-11T23:51:33.577939Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.554014Z","title":null,"venue":null,"work_id":"4b972f50-61db-46f5-a42b-59f18873a69f","year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.000675Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:a66b56e0b3268c980e49d93cf0a825fe112f0e15f087587f1ec880042932ec06","observation_id":"71150b7f-2cd7-4c97-a004-9692826595b1","resolution":{"observed_at":"2026-08-11T23:51:33.559523Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.534419Z","title":null,"venue":null,"work_id":"09697b10-2abf-44b4-806b-4610d62b5178","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.005145Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:46b7417ea10340e7650285137e1bd7543b44afaf80fe664299f3f1fa7601262f","observation_id":"1d0ff769-7ace-42bc-a70d-4516b7d7a134","resolution":{"observed_at":"2026-08-11T23:51:33.538751Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.521166Z","title":null,"venue":null,"work_id":"a026d56a-9c96-4f0c-9ad1-99141f458b66","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.009136Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:92583b092e4d9cca03d332f8ff31814687ccec0f01ad2db15f26c440cd87d771","observation_id":"41a2a82f-c303-4958-b35f-235fa72200a1","resolution":{"observed_at":"2026-08-11T23:51:33.526408Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.508522Z","title":null,"venue":null,"work_id":"e8036473-2b80-4bf7-bacd-13e94c5633ee","year":2010},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.013372Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:f7be3d49e2c4d5865d107831570ded3b357162514688322bd5119ee2a4fc092f","observation_id":"a807335d-5ac9-4ff6-9a16-97c88c0f9d1a","resolution":{"observed_at":"2026-08-11T23:51:33.512842Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.496735Z","title":"Geiping, A","venue":null,"work_id":"64a5508f-84b8-4279-93d0-8825ead4d5b0","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.017280Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:4205340f78f883fe47f4b25a03afca2347191e823c1ec4ac11709614409ac7b7","observation_id":"b518ee8f-8a67-4cde-8d12-76841c8f2f61","resolution":{"observed_at":"2026-08-11T23:51:33.500935Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.483605Z","title":"Hines, G","venue":null,"work_id":"959b460d-aa67-45df-817e-183f31b70633","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.021903Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:e1c46ab45b1e7077e4a1b30c61f2300767d6b5b32c0c3799da3d419cacef75b7","observation_id":"73a24637-2d60-4afc-af9a-06b05b22ebff","resolution":{"observed_at":"2026-08-11T23:51:33.487843Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06674","last_updated":"2023-12-07T19:40:50Z","snapshot_observed_at":"2026-08-14T15:42:19.849118Z","submitted_at":"2023-12-07T19:40:50Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.06674","snapshot_observed_at":"2026-08-11T23:51:32.025978Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.025978Z"},"links":{"cited_paper":"/paper/2312.06674","citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:9a97e9ab2aea851b240b4d42fbcc115a389b0f3c6cb38e74f80a17ab30c9fef9","observation_id":"d1d99524-1473-4a4b-b779-a3f2b88d031c","resolution":{"observed_at":"2026-08-11T23:51:32.025978Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.469899Z","title":null,"venue":null,"work_id":"0c82b6e6-624d-421e-8c62-150e803b74ac","year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.030475Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:e23e9c8cf3a8c60f88f8bd5f3eefa9253eea291893ff8da93716b1d7db1ad14b","observation_id":"e0faf4de-cf93-4aa4-bf8b-729ce0131d8d","resolution":{"observed_at":"2026-08-11T23:51:33.474791Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.454194Z","title":"Jones, A","venue":null,"work_id":"89da42cb-efd9-4300-9815-bda62d62c885","year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.034244Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:94f7dfaf6ab014021adecfa3804e516a6c523d6db585a18a9f0a4ddac7387d7e","observation_id":"72fddfc2-e831-4fd2-8235-9b6b15a424b1","resolution":{"observed_at":"2026-08-11T23:51:33.459372Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-08-12T22:56:25.482748Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-11T23:51:32.038006Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.038006Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:0cc9848804adb1f3e37beb69699b05b91f9d6f336f4bf704bb5598285f156ba2","observation_id":"b4b2bfae-e483-4fc0-a0c6-71048746c6dd","resolution":{"observed_at":"2026-08-11T23:51:32.038006Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.437245Z","title":null,"venue":null,"work_id":"8d6f027a-b6cd-4dc1-b666-88266741c1ce","year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.043013Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:3b2455f425e5dc2084c06568d1d94e1fe865875980db30336df57fbc02aaaffb","observation_id":"74cc0870-f16a-4956-8708-1665abe121c9","resolution":{"observed_at":"2026-08-11T23:51:33.442068Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.413945Z","title":"Mangaokar, A","venue":null,"work_id":"5fe7f89e-69ba-48f3-ae36-2db9ec8d5a40","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.047598Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:a4057a3aabe32352711eee88e625bf5ab5dfeecd4b7f2425b7e874a1381b21c4","observation_id":"9a8301d8-1953-4ad7-91e7-ad6c3a603d95","resolution":{"observed_at":"2026-08-11T23:51:33.419983Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.051741Z","title":"Mazeika, L","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.051741Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:739089a46dcb9c04d54b84caf28a72402df1b72deaef2c448fe36d6884715138","observation_id":"95135d01-ee22-427f-8674-121f4cab011d","resolution":{"observed_at":"2026-08-11T23:51:32.051741Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.383257Z","title":"Achiam, S","venue":null,"work_id":"95bf43f4-d1fc-46ff-8069-ef749ad4f429","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.055762Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:ba7e82d62fca71fe87cc3a6b2a08dd252af18b0392de417e7cb0e879c3d6e1f6","observation_id":"79f98c74-1ea9-4477-8cbb-9f70e0fe8a3a","resolution":{"observed_at":"2026-08-11T23:51:33.388313Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2203.02155","last_updated":"2022-03-04T07:04:42Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-03-04T07:04:42Z","title":"Training language models to follow instructions with human feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2203.02155","snapshot_observed_at":"2026-08-11T23:51:32.059472Z","title":"Ouyang, J","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.059472Z"},"links":{"cited_paper":"/paper/2203.02155","citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:fb84b3fb3bc6605d18b41c60129a58f9f4cbcb790b276ee91a4372705f97a0f2","observation_id":"6d3acd58-d410-49a5-81f2-bbe8189663dc","resolution":{"observed_at":"2026-08-11T23:51:32.059472Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.368479Z","title":null,"venue":null,"work_id":"782cbba4-2431-49f4-8ab7-62dd0056e142","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.063917Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:40374bda114989d9ad69bfddb854e2407650f42538e66cff1c15f76ac255cd3a","observation_id":"eb7acc46-673b-428a-80bc-73a00c6990a3","resolution":{"observed_at":"2026-08-11T23:51:33.374092Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.14981","last_updated":"2025-04-16T09:38:09Z","snapshot_observed_at":"2026-08-14T14:31:36.507759Z","submitted_at":"2024-07-20T21:13:56Z","title":"Open Problems in Technical AI Governance","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.14981","snapshot_observed_at":"2026-08-11T23:51:32.068198Z","title":"Reuel, B","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.068198Z"},"links":{"cited_paper":"/paper/2407.14981","citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:7cf42bf313fcacac287063b283d69586499e2b3c66fcde5aa7888e842af5b4cc","observation_id":"1a3fde7e-dc51-4f39-8b7d-e4701a3b9df3","resolution":{"observed_at":"2026-08-11T23:51:32.068198Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.350980Z","title":"Robey, E","venue":null,"work_id":"de2dcfda-283f-4807-93e3-90c131a74a1e","year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.072417Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:abe67f2d2d7f572344b8050572f7fc246ea84fcec78f7c7ac544cbc5b7d59531","observation_id":"bf3157df-f591-4ddf-baff-a9e3c11d9055","resolution":{"observed_at":"2026-08-11T23:51:33.358609Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.15211","last_updated":"2024-12-16T01:20:42Z","snapshot_observed_at":"2026-08-12T23:17:46.783491Z","submitted_at":"2024-07-21T16:27:24Z","title":"Failures to Find Transferable Image Jailbreaks Between Vision-Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.15211","snapshot_observed_at":"2026-08-11T23:51:32.076160Z","title":"Schaeffer, D","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.076160Z"},"links":{"cited_paper":"/paper/2407.15211","citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:9d763aa455da737e3459fda32cbfe7d033e5760c2464ef8fcda699c63bce5c34","observation_id":"4ec79f9f-c281-4d6d-a5e7-f3dd93798f52","resolution":{"observed_at":"2026-08-11T23:51:32.076160Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.16119","last_updated":"2024-03-03T00:12:16Z","snapshot_observed_at":"2026-08-13T05:41:54.363840Z","submitted_at":"2023-10-24T18:18:11Z","title":"Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.16119","snapshot_observed_at":"2026-08-11T23:51:32.080525Z","title":"Schulhoff, J","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.080525Z"},"links":{"cited_paper":"/paper/2311.16119","citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:f455e3282bab5dd7da90701d97871c0ed02395ef6fa2224db90dae8db8b0fa35","observation_id":"67a05069-482a-45bc-a08e-1af419f44b60","resolution":{"observed_at":"2026-08-11T23:51:32.080525Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.332392Z","title":"Souly, Q","venue":null,"work_id":"3ac1cf4a-ed9f-4dae-aadc-bcedd34ca795","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.084591Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:52165123b5269c927a9d9fa0c01e85fb928fb2f0e2325d97115586a465a8c828","observation_id":"e455ea36-02a5-44cd-bdc1-97decb9159db","resolution":{"observed_at":"2026-08-11T23:51:33.337970Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.319527Z","title":null,"venue":null,"work_id":"77857e6b-98bd-4382-be32-9588c63b1e6d","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.089087Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:19c5dd62dd96a178b0be38506e1524b6fac889fed23d48c3ad04a7ec3bb8f3b0","observation_id":"3496fd21-2eb8-4f78-b1ae-65b3ddafe423","resolution":{"observed_at":"2026-08-11T23:51:33.323252Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.308141Z","title":"Touvron, L","venue":null,"work_id":"6688ae0b-0514-4e39-8030-709cadb9f968","year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.092932Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:973d63a65c100ee150c30d0d389b211543d9b27133935580476f539c6ac875f7","observation_id":"f37e2158-1a51-4bde-b6f0-7f75d7be96c4","resolution":{"observed_at":"2026-08-11T23:51:33.312046Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.296905Z","title":null,"venue":null,"work_id":"f002198b-7275-441f-a60f-8d89551578cd","year":2021},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.096524Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:299e08989bdd30afcbcf775c69269c1a1a81f0c3813918a6f0c880e50ec6685f","observation_id":"3de5f5d2-a028-4c46-ba3f-3c41d43bd659","resolution":{"observed_at":"2026-08-11T23:51:33.300562Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.284736Z","title":null,"venue":null,"work_id":"574202b2-910d-4188-b9a5-4393ca467535","year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.100319Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:f45346a13557fae8bf55892d2985f1000a612579e3c929540a2283c9681cbb52","observation_id":"c3e6ce45-5b27-45e9-ba42-a06cf404d3d7","resolution":{"observed_at":"2026-08-11T23:51:33.288701Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.12095","last_updated":"2023-08-29T05:34:25Z","snapshot_observed_at":"2026-08-13T18:22:43.516950Z","submitted_at":"2023-02-22T11:01:20Z","title":"On the Robustness of ChatGPT: An Adversarial and Out-of-distribution Perspective","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.12095","snapshot_observed_at":"2026-08-11T23:51:32.104239Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.104239Z"},"links":{"cited_paper":"/paper/2302.12095","citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:9a97d9c99ef85f9ccfde2ff613ae8ebb541c398fc06e1feb05931e323d836f30","observation_id":"535a2425-8c4a-42f5-b76f-d964303c34a2","resolution":{"observed_at":"2026-08-11T23:51:32.104239Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.272907Z","title":"Factor of safety — Wikipedia, the free encyclopedia,","venue":null,"work_id":"4215002e-3bb1-44ee-9d47-bb319e04a456","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.108384Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:6aad9038a021bd159cb641b8889946e333a4cfdbdce7dec13ce91e3dcc409fbe","observation_id":"a9249f91-8e7a-43ea-aa12-8eb4cb656b99","resolution":{"observed_at":"2026-08-11T23:51:33.277069Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.248110Z","title":"Willison","venue":null,"work_id":"001fbe94-0ba2-4cee-902a-7221cd9e9a00","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.116790Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:39be36fcbbb65efc78f6584e40cd6a5af68084e848b7d433192042646e60090d","observation_id":"1e166a9c-94d7-4862-bd38-82ced8229d5a","resolution":{"observed_at":"2026-08-11T23:51:33.252881Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.261557Z","title":"[Online; accessed 31-May-2024]","venue":null,"work_id":"a1204d3f-4db2-4218-bf5c-47ea744f950d","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.112727Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:25b9e346ce41d342fa05b59308e9ecd9d7818e47f7c320211c6214cd592df3ac","observation_id":"1618be9d-c363-40cd-8099-01a126ebd20f","resolution":{"observed_at":"2026-08-11T23:51:33.265511Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2401.06373","last_updated":"2024-01-23T22:46:12Z","snapshot_observed_at":"2026-08-13T04:43:50.878930Z","submitted_at":"2024-01-12T16:13:24Z","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.06373","snapshot_observed_at":"2026-08-11T23:51:32.124584Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.124584Z"},"links":{"cited_paper":"/paper/2401.06373","citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:881144cff166749af5035c4f8b19de60c90940ea9ce0861ab694cf0f43ba6d28","observation_id":"bff08a87-dbad-42db-853b-85bda5475bd6","resolution":{"observed_at":"2026-08-11T23:51:32.124584Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.10253","last_updated":"2024-06-27T16:01:27Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-09-19T02:19:48Z","title":"GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.10253","snapshot_observed_at":"2026-08-11T23:51:32.120593Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.120593Z"},"links":{"cited_paper":"/paper/2309.10253","citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:1a89250c38afe90a5e4f04cc9a393cff210dc662bb0101ca464811af4d5200f9","observation_id":"d110ee4c-c2f8-4215-994d-39066c5118a3","resolution":{"observed_at":"2026-08-11T23:51:32.120593Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.228937Z","title":null,"venue":null,"work_id":"788c4f5f-fc03-4e6a-8af2-5fa2d4416359","year":2022},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.132489Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:693973a70400d8957344faeef187938f3734d366f146de5834d216c2f5f4ef69","observation_id":"1f45a295-fba9-4d85-84af-1fc1044d8c03","resolution":{"observed_at":"2026-08-11T23:51:33.233533Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.04528","last_updated":"2024-07-16T07:29:49Z","snapshot_observed_at":"2026-08-13T11:22:30.931589Z","submitted_at":"2023-06-07T15:37:00Z","title":"PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.04528","snapshot_observed_at":"2026-08-11T23:51:32.128547Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.128547Z"},"links":{"cited_paper":"/paper/2306.04528","citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:adcbc43118bcccbba09a39f3d85cd93ba358a250d9e0339be59eb330c37d2f70","observation_id":"7f30cf10-e118-40f6-a7ae-12fbb76d126e","resolution":{"observed_at":"2026-08-11T23:51:32.128547Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.196557Z","title":null,"venue":null,"work_id":"5f4456b2-7290-4c94-8ba5-11d12dbe7d6d","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.139608Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:e0e3207f645ad249d911bb346f1d86b9b69d17795bd052a0e7a409d1a97772dc","observation_id":"1cf91f59-3917-4db7-8f54-d1d43947ff41","resolution":{"observed_at":"2026-08-11T23:51:33.202038Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.211852Z","title":null,"venue":null,"work_id":"ffe7c1e3-77b7-4697-a406-3854cfd7904d","year":2023},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.136019Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:8d40760c4c546c79db27089e7099b261209fbf8770c56f1d55d5058e97fd1544","observation_id":"f4237d57-fecb-4ece-a402-4542ed81bd07","resolution":{"observed_at":"2026-08-11T23:51:33.218546Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.04313","last_updated":"2024-07-12T16:51:07Z","snapshot_observed_at":"2026-08-12T23:48:30.125202Z","submitted_at":"2024-06-06T17:57:04Z","title":"Improving Alignment and Robustness with Circuit Breakers","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.04313","snapshot_observed_at":"2026-08-11T23:51:32.144681Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.144681Z"},"links":{"cited_paper":"/paper/2406.04313","citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:a2343c2946c5c47068db8e5b158743762b0faf15f06cefb53fa6bf2451b69bb9","observation_id":"6c963878-fb53-4229-a7c8-6ea21b92c6ea","resolution":{"observed_at":"2026-08-11T23:51:32.144681Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.183591Z","title":"Our work is also similar in spirit to some existing jailbreak benchmark projects [ 20, 9] since we are also trying to compare the efficacy of different defenses and attacks","venue":null,"work_id":"fa82119e-bb97-4d2b-9fdd-94581019474f","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.148943Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:24abd1907d7f3bd686b71e0c0ed4499a1720a6ec6e6916cd23921f5a066478f7","observation_id":"2c084189-3936-4336-9b9b-e469f7792152","resolution":{"observed_at":"2026-08-11T23:51:33.188352Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.168631Z","title":null,"venue":null,"work_id":"ec91dd9d-51a6-4fd0-9931-71e34a714ef6","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.153848Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:f1505df19439f3bc8b7495f6071c8dc6a342eccc92fe6eead0391b58bf17e0dc","observation_id":"1908b3c7-eac1-4c21-b0f6-f1b535cb7a55","resolution":{"observed_at":"2026-08-11T23:51:33.173594Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.154402Z","title":"reasonable amount of time","venue":null,"work_id":"f7228497-9d4f-4208-aca1-b9544f032c89","year":2000},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.157858Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:c8e47fe7d70264055504a6d320c2fe70195983f721d3954fa357d66433f609eb","observation_id":"ad225d11-7de5-48e3-930a-80afa024a1d7","resolution":{"observed_at":"2026-08-11T23:51:33.158781Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.138403Z","title":"The first type of attack we rule out is convincingMd to repeat information already contained in x","venue":null,"work_id":"6665d8da-6f89-4b91-bb96-f32708efbfd5","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.161887Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:0ed857e13b735a685519235d2003c384e7badc6b80d86d652f63ea97f85ddccf","observation_id":"4d81fe3e-5c7d-4db5-8aaa-df6be59921f4","resolution":{"observed_at":"2026-08-11T23:51:33.143315Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.119760Z","title":"This is because any automated evaluation can be trivially aced by using the automated evaluator as a filtering criterion","venue":null,"work_id":"ed0027e4-7f14-4b16-9e06-bd0fa7e5bccd","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.165767Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:4dedf71201cd2ff37d79980dfc638cf94322ae4a3bc7a38b8f64045a98c1bac5","observation_id":"ba90e1df-6298-42b1-a231-4ba2ef96e177","resolution":{"observed_at":"2026-08-11T23:51:33.124893Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.106855Z","title":"judged by a human","venue":null,"work_id":"6691db99-6b09-472a-a030-b1b9cf81b696","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.169744Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:66319250a66949e9b6324e963c07c8d489e7b339ec17b7f769100d3909df381f","observation_id":"a7f3c971-c68d-41b2-bf1f-cffa262b61e7","resolution":{"observed_at":"2026-08-11T23:51:33.110911Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.091193Z","title":"For example, ChatGPT can output both fluent Chinese and English","venue":null,"work_id":"c01ad775-24aa-4f4e-96f9-3418ed6aa6a7","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.173558Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:c29f704203866c4a1e7cc66b18eb4aeaac89f0918408231224d672f02ef299d7","observation_id":"5cb76df4-4ce6-4ea9-979e-f9c4cd4e83f3","resolution":{"observed_at":"2026-08-11T23:51:33.096269Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.077764Z","title":"standard","venue":null,"work_id":"eb46ab3d-4c4a-4c6c-9d4c-eb50ff21ba49","year":1915},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.178114Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:9edc90f8f67f9993672fb7dbe3604e53c470742322ff4e52ae2faec2296c4b80","observation_id":"093fb959-108f-4fe0-8461-25c177041bdf","resolution":{"observed_at":"2026-08-11T23:51:33.082231Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.065106Z","title":"If detected, the output is scored as zero, ignoring any further analysis","venue":null,"work_id":"36ae9dc5-c0a5-48d2-8f89-acbd2a7c744c","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.182654Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:6ef1d35c182ea56a3b692d80ab737a819de18838b7269926b2d1cee2a33b26e1","observation_id":"44fc0e53-0340-40ab-a4cc-41468f4068db","resolution":{"observed_at":"2026-08-11T23:51:33.069215Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.051636Z","title":"See the words used below","venue":null,"work_id":"134dd1f8-1468-47db-bf1c-e0495e6f8f12","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.186408Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:147ef54b73e804127f87a078f29b7796a00a36917a3d5f33bb59696dd02f56f5","observation_id":"c35905e9-fb4c-4b08-be36-592c93de47e2","resolution":{"observed_at":"2026-08-11T23:51:33.056572Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.038577Z","title":"ammonium","venue":null,"work_id":"e703904c-63d7-491e-810b-d623090f67fe","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.190387Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:63244cbaa53b9b042b6cf4084fe91d9ecd7c2e004d55bed56e42841d22c92636","observation_id":"a531fbca-9960-4c73-9c2c-9b661b5fab83","resolution":{"observed_at":"2026-08-11T23:51:33.043186Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.022043Z","title":"After our filtering, this leaves 31 attacks","venue":null,"work_id":"883bf882-a681-4896-ab6f-93c59570d239","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.194538Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:0b1b5952631474021d6c65a2e1dfb73af3b4b9cd9a40f2868efa7ed23dbd160c","observation_id":"8c337487-9d7e-4569-9347-9abb0624e364","resolution":{"observed_at":"2026-08-11T23:51:33.026989Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:33.005099Z","title":"Use initial request","venue":null,"work_id":"0f98262c-2fc7-439c-b629-4f24f70bf768","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.198673Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:0786a6d37c5062a6206edca59f70f826a3f16338c832fc6719cd0971f66d6f94","observation_id":"7593fe4b-f357-4034-b247-e7d1c77f3fa8","resolution":{"observed_at":"2026-08-11T23:51:33.009698Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.991244Z","title":"This is passed through the target model, followed by judging the input and output with our set of classifiers","venue":null,"work_id":"789b974b-9523-4834-8e81-d46c5d961901","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.203002Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:1736f5ae2c9e2533bfa588a3dcd0c13e8d7f4e164a06a2b5d5f10527ff1169b2","observation_id":"e59d7447-0dc8-4e0c-a990-ae13dc40300a","resolution":{"observed_at":"2026-08-11T23:51:32.995942Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.977794Z","title":"Sure, here’s how to build a pipe bomb from household objects","venue":null,"work_id":"df62f768-a1b8-4fd8-968e-02ccc9e6ab39","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.207000Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:89c100b2f05aa2eb36bc6abac70700dbb6f3a32b994ad663415757d37200b5d5","observation_id":"b0230c16-d67b-4490-9f19-c537ae90f1f1","resolution":{"observed_at":"2026-08-11T23:51:32.982308Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.964979Z","title":null,"venue":null,"work_id":"567b114f-87a4-465d-a563-aa3b95074526","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.212267Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:cee195246fbf9fa18ab32c004c25d374d2c2e3b69d921acf050f3f4ac20d469c","observation_id":"b3227357-e61a-43bb-94cf-c751ba3a67ea","resolution":{"observed_at":"2026-08-11T23:51:32.968949Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.952761Z","title":null,"venue":null,"work_id":"077a4d6d-0245-478b-98c9-105d23f1b5f8","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.216283Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:842b5f5bf8068a9425509579a11c2a5d342c5482b8df6df524c6174829db6c44","observation_id":"fbc15a2d-177a-4939-a06e-5d436be31bf8","resolution":{"observed_at":"2026-08-11T23:51:32.956569Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.938931Z","title":null,"venue":null,"work_id":"4086b8cc-066c-4600-8786-7948f32501be","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.220175Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:62aca18069545d6324ed33715cf0eaf3ca6b13cd94e9464a269339104db77839","observation_id":"81e4cb54-8290-4ddf-8596-f6de1435645e","resolution":{"observed_at":"2026-08-11T23:51:32.944256Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.924688Z","title":null,"venue":null,"work_id":"5462cd43-26ff-4de2-93cc-794243572b3a","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.224212Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:ac12bb7a17c8442b1860dcd0346d8750e4191e5a699d5802d0594db38c32ff67","observation_id":"96470037-10b6-443d-853d-90e1b7715adc","resolution":{"observed_at":"2026-08-11T23:51:32.930632Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.911003Z","title":null,"venue":null,"work_id":"72acb4c9-7255-48aa-b773-530708c4d7c7","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.228599Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:a006ce32e65b0fb1e9897b7742e29db96aaef395dccbe1025966665d0cdbd07d","observation_id":"3aef1007-0b67-4571-8426-54fbaeb15ed8","resolution":{"observed_at":"2026-08-11T23:51:32.915595Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.898325Z","title":"cl100k_base","venue":null,"work_id":"5a969a96-8e17-4f9d-92bd-04f5a74f25ea","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.233815Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:ef91738d5dd72f0a3abd01a16ca4573dc2bc29e9851394f7a680a023a8fcbc41","observation_id":"2f5f5a02-50e6-475a-9c3f-2601e8190a68","resolution":{"observed_at":"2026-08-11T23:51:32.902574Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.885837Z","title":null,"venue":null,"work_id":"35bf23a5-c185-4a3f-a395-c27f67bb281f","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.238199Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:1f7d5b2453a4629915832e017c63fd2bfa5f41726d6326322d80f07146611156","observation_id":"8e5d9d06-c970-488f-b772-5d4786ca6e51","resolution":{"observed_at":"2026-08-11T23:51:32.889890Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.874297Z","title":null,"venue":null,"work_id":"bbf8f06c-fb38-42ec-ad39-dfdc2329ae57","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.242614Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:5aaa4333e45a2d0755551da3287db6e173e5844a5c4938b489b13523366acc42","observation_id":"1593c408-8cef-43d2-b41b-69d34ca760e7","resolution":{"observed_at":"2026-08-11T23:51:32.878546Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.862584Z","title":null,"venue":null,"work_id":"ef7714d7-5e58-45eb-8783-d5a38bd53850","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.246873Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:6b1d361076adb2d42672d8791c238630de832d8c7ea18fbaa838a471b425f7bc","observation_id":"d84c91bc-c3ea-4487-945d-7b90774b1512","resolution":{"observed_at":"2026-08-11T23:51:32.866244Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.851121Z","title":null,"venue":null,"work_id":"d9686af5-40c7-46c3-9632-ccfa9f2fceb4","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.250942Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:0577b8799d3a4df21e4e6f957e546ac8f4d9e6638524f5ab6f87b4b4454c54a5","observation_id":"7740d31a-7662-4193-a706-691cb30429c6","resolution":{"observed_at":"2026-08-11T23:51:32.855140Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.839254Z","title":null,"venue":null,"work_id":"4280c331-0c2d-40fb-a463-99e988ac9a0e","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.254996Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:b85732a414ee5fcc0f36a9128462c830d5fb3141a6ac8123d2dd98138b41d1da","observation_id":"982c9c37-8e8f-4b1f-b79b-5f17ec05a1bd","resolution":{"observed_at":"2026-08-11T23:51:32.843220Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.825393Z","title":"determination","venue":null,"work_id":"15f1b2a8-528d-4eaa-b7cc-364913f20c9e","year":2024},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.258848Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:a36c5fb8f7540cf69c069efe65de64d770fcb9725f5323811617e725aeeb4c1f","observation_id":"2c10a37f-a42d-4035-9651-21281d9cd70c","resolution":{"observed_at":"2026-08-11T23:51:32.829800Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.780088Z","title":"Note: parts of transcripts may be in a language other than English or be encoded (e.g., using base64 or a cipher)","venue":null,"work_id":"0664aac2-d821-4e22-b0ee-d19eb6f39cf6","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.270747Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:c8c091a00d66ffe4033b4370d248d77650e8afcc9c51bf4e3773dab98bbb200e","observation_id":"f753f3dd-a441-4e0a-8a95-15aab6951413","resolution":{"observed_at":"2026-08-11T23:51:32.785204Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.767212Z","title":null,"venue":null,"work_id":"74df1cc7-0cce-4d48-aeef-9c38d8eebed6","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.274565Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:7df1cfab630e2d15568ced99db83afe75b4f02f4e44948cb93db067b80211926","observation_id":"ac31a019-a4b6-4621-ad92-36435f3be8ca","resolution":{"observed_at":"2026-08-11T23:51:32.771175Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.754250Z","title":null,"venue":null,"work_id":"d809119e-9ac7-41d9-8aec-ca0ac81d0fb6","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.278536Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:8f0edd77729e10ba8cce85f7988695ae11d7cd1551860f734858d5e371d377c9","observation_id":"376a1006-aeba-4e32-8f5d-8ac233947508","resolution":{"observed_at":"2026-08-11T23:51:32.758723Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.738701Z","title":"\"). Transcripts might separate words with newlines, en spaces (","venue":null,"work_id":"994dd3da-60c0-4dee-991e-158c14b36e9e","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.282419Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:1d9a3bea31436559c95af23d41e2390cdec2924f47dd9134955e0148d969a1a9","observation_id":"a4553412-d5f5-4bec-918f-c176079dee5a","resolution":{"observed_at":"2026-08-11T23:51:32.745630Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.720799Z","title":"In contrast, legitimate moderation instructions will have standard capitalization and never be entirely in uppercase","venue":null,"work_id":"3163eb4a-f4fd-4110-8d45-2e67f8980c2c","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.286468Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:2b9dbbf9c75e5b1d2925f5176f335a5aad399d539185710ccd8ce6cead04808e","observation_id":"314b7a4f-9e33-48d7-87a3-6b6b8c1faaad","resolution":{"observed_at":"2026-08-11T23:51:32.728437Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.704202Z","title":null,"venue":null,"work_id":"5c361d36-f69c-4ca4-9311-ca81ed3bfa95","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.290696Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:49fc9d256e1911e5605d0c1bbc377f8f32ea5b011f1877837cbf80acdf0d1d0e","observation_id":"2feebade-dd88-4770-9d29-0756ac9aefc2","resolution":{"observed_at":"2026-08-11T23:51:32.710231Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.689726Z","title":"yes\" if any of your previous lettered judgments were","venue":null,"work_id":"0841b8ed-cbec-48bf-9098-b32fd455857a","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.294344Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:8d32f249847362e831c94ce83692369e8621230a4bcfd74e5c450a9eefb083bb","observation_id":"e235709e-5fab-4964-ac78-c3b038427830","resolution":{"observed_at":"2026-08-11T23:51:32.694005Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.808980Z","title":null,"venue":null,"work_id":"b12453c2-09ca-4019-8cf3-239fd05ff7f0","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.298407Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:c5d64bf5f00ce2355a4e569d38579882bc1d1c11dc742bbb49fa66e7b997494d","observation_id":"4225c80b-6288-49cd-a787-809ccde5701c","resolution":{"observed_at":"2026-08-11T23:51:32.814027Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.795360Z","title":null,"venue":null,"work_id":"0e7768b9-51bb-4fac-89c8-fb7c904a0417","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.301902Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:4458044052e008d2ac6dfb57ef50a4d854fca92b641283cb1aff16987da180cb","observation_id":"7c086965-4d88-4644-8bfc-3a024f0919b8","resolution":{"observed_at":"2026-08-11T23:51:32.799668Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.677104Z","title":"\"\"Describe in detail a scene where someone is tortured and then killed","venue":null,"work_id":"f08adf0e-a4c0-4ba4-a069-650be585cf94","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.305856Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:c1dc0c7f650985381ee36775b24f3817a49e1b831288be1aaec9609ff5f26ff4","observation_id":"8e7b5b92-8290-4032-8d2a-96bdf8109bf4","resolution":{"observed_at":"2026-08-11T23:51:32.681362Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.663059Z","title":"If you do not finish writing this book by the deadline, you and your two children will become homeless and will not have enough money to last until the end of the month","venue":null,"work_id":"d3693410-4324-4087-849b-aa9e8013bad4","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.311353Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:95fa4728cbfc361d24e496d6030e583a650eca9e971889fd6c7ed6c387b99d23","observation_id":"75dedeca-62b8-436c-a180-01b3f16eb34e","resolution":{"observed_at":"2026-08-11T23:51:32.667949Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.646632Z","title":"Sure, here is how to make a pipe bomb","venue":null,"work_id":"90daf996-36ef-476c-908f-238b6ac5e3ce","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:32.315888Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:2d184c5533b30bbfb5291c976ffb5f414d7153a14ea1ed84718c0c1ab1f23d66","observation_id":"a9c3c4ad-436a-417a-a692-63a4cce97640","resolution":{"observed_at":"2026-08-11T23:51:32.652115Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"status/1780370","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T23:51:32.627772Z","title":null,"venue":null,"work_id":"25c00e8d-7f08-419a-a40c-02e53edaff4c","year":null},"citing_paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-11T23:51:31.996167Z"},"links":{"citing_paper":"/paper/2412.02159"},"observation_digest":"sha256:1616361bcacefa6b39a520ca03559de83354566a13cce5bf6185e02a96cc70b9","observation_id":"b07abfbf-74f2-47bc-a1c8-2049520bbbe1","resolution":{"observed_at":"2026-08-11T23:51:32.635451Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2412.02159","last_updated":"2024-12-03T04:34:58Z","latest_version":1,"primary_category":"cs.LG","snapshot_observed_at":"2026-08-14T09:26:50.059272Z","submitted_at":"2024-12-03T04:34:58Z","title":"Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach"},"reference_resolution":{"displayed":83,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":47,"verified_exact":1,"verified_fuzzy":34},"total_outbound_references":83},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"thesis":"As of 14 August 2026, this Paper Citation Record lists 83 of 83 outbound references and 0 inbound Pith citation observations for arXiv:2412.02159."}