{"as_of":"2026-08-13T05:33:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:9aaa38e36d9e20f58836e1426e2345eb7f371b0851ce219f3b5744c43ff05cf6","coverage":[{"denominator":28,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":28,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-11T05:02:26.737170Z","state":"measured"},{"denominator":28,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":28,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-12T06:34:41.77262+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2412.18171/citation-record","integrity":"/paper/2412.18171/integrity","json":"/paper/2412.18171/citation-record.json","paper":"/paper/2412.18171"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:27.204826Z","title":"Jailbreak chat, 2023","venue":null,"work_id":"7b361b0a-e4d1-44ec-af94-740fb93de557","year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.602837Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:12c6662da7575037c81064a1267b227f6806e64c059ff2878701dfcb61c1104b","observation_id":"c677173e-3af0-4e00-9e18-99c5cee50232","resolution":{"observed_at":"2026-08-11T05:02:27.210335Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:27.187837Z","title":"Many-shot jailbreaking","venue":null,"work_id":"cb7e83ba-a06c-4cb1-81df-cc67d59d6921","year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.608044Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:e92b5e33fca0c16fb54f22047c6950b3e765c0b487f94c31c4db36c5c5936ba1","observation_id":"2bdcac9a-1dcc-40fa-a639-35a2edad71c8","resolution":{"observed_at":"2026-08-11T05:02:27.193034Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2112.00861","last_updated":"2021-12-09T21:40:22Z","snapshot_observed_at":"2026-08-10T12:03:10.373653Z","submitted_at":"2021-12-01T22:24:34Z","title":"A General Language Assistant as a Laboratory for Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2112.00861","snapshot_observed_at":"2026-08-11T05:02:26.612486Z","title":"Brown, Jack Clark, Sam McCandlish, Chris Olah, and Jared Kaplan","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.612486Z"},"links":{"cited_paper":"/paper/2112.00861","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:32a79c381d9631a6096411700be3f709660c1ee4bfaaaf5f4991225cfa015a4d","observation_id":"ed4625c8-4b10-4fcf-99c2-8e9cd67c9e9f","resolution":{"observed_at":"2026-08-11T05:02:26.612486Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-08-11T05:02:26.617889Z","title":"Brown, Jack Clark, Sam McCandlish, Chris Olah, Benjamin Mann, and Jared Kaplan","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.617889Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:2cf1bc5c51cf561ef29f2ef2d61bb2eef02f8087eaac29bc3f2f152acc6d8f8e","observation_id":"56408827-6197-47a7-9f04-0525fcbcc1d5","resolution":{"observed_at":"2026-08-11T05:02:26.617889Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-08-12T12:29:45.113982Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-11T05:02:26.622921Z","title":"Pappas, and Eric Wong","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.622921Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:96171491e8c0691c5ed71aed2a153e0d5b732bb05f1265e76705a54cb71890f9","observation_id":"ff102511-77bf-4ea2-baf5-28278e09193d","resolution":{"observed_at":"2026-08-11T05:02:26.622921Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:26.628462Z","title":"Zico Kolter","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.628462Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:fb20f521f700d35299b463720296bc04f60ee8fab56ebfc929674a4f58b163cb","observation_id":"e67b2e6f-940d-4cd7-b311-a9fea92fd7ea","resolution":{"observed_at":"2026-08-11T05:02:26.628462Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.00867","last_updated":"2024-11-07T15:41:38Z","snapshot_observed_at":"2026-08-13T04:05:55.236388Z","submitted_at":"2024-03-01T03:29:54Z","title":"Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapes","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.00867","snapshot_observed_at":"2026-08-11T05:02:26.636480Z","title":"Gradient cuff: Detecting jailbreak attacks on large language models by exploring refusal loss landscapes","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.636480Z"},"links":{"cited_paper":"/paper/2403.00867","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:f89a72d8580f699194bb00223c046428ddfed67a4d41cd8975db3c65203fcfbf","observation_id":"8650b5b1-c9da-4ab9-a493-c439f712182c","resolution":{"observed_at":"2026-08-11T05:02:26.636480Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-11T05:02:26.641984Z","title":"Baseline defenses for adversarial attacks against aligned language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.641984Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:c676e25e43c7e79ebd7cc1d85c650e0dcfea9c935e8a14c60bccb8030498b84f","observation_id":"645c60a9-f761-4276-8439-7c42712e7687","resolution":{"observed_at":"2026-08-11T05:02:26.641984Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16192","last_updated":"2024-02-28T23:11:33Z","snapshot_observed_at":"2026-08-13T04:10:30.076865Z","submitted_at":"2024-02-25T20:36:03Z","title":"Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16192","snapshot_observed_at":"2026-08-11T05:02:26.647309Z","title":"Pappas, Hamed Hassani, Yang Zhang, Eric Wong, and Shiyu Chang","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.647309Z"},"links":{"cited_paper":"/paper/2402.16192","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:8d7763b8802f8f85d31ae85ce7ee0a6652e4c800c8999219095a2f6213f0de32","observation_id":"3d791c1c-8193-4918-8d71-e8b36fb2084b","resolution":{"observed_at":"2026-08-11T05:02:26.647309Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.00731","last_updated":"2022-12-21T10:15:52Z","snapshot_observed_at":"2026-08-10T13:20:05.646419Z","submitted_at":"2022-09-01T21:16:47Z","title":"In conversation with Artificial Intelligence: aligning language models with human values","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.00731","snapshot_observed_at":"2026-08-11T05:02:26.652362Z","title":"In conversation with artificial intelligence: aligning language models with human values","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.652362Z"},"links":{"cited_paper":"/paper/2209.00731","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:b248fd93449db232a8b811c480c81b9b08a23298dbbabbf215b1ca86e4906423","observation_id":"97e0fba1-631f-4d0a-8258-a37b74dfb516","resolution":{"observed_at":"2026-08-11T05:02:26.652362Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-07-06T16:15:00.517258Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-11T05:02:26.657326Z","title":"Certifying LLM safety against adversarial prompting","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.657326Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:5629f0b82d6fa3aa34a2fc155dc30d1b7b4e0f953dc011c21c42f911648585cc","observation_id":"1c8e2bfd-f142-4877-9547-c03c44f799ff","resolution":{"observed_at":"2026-08-11T05:02:26.657326Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:26.662444Z","title":"Hashimoto","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.662444Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:b0244174d0ae364da73206857e618031399cd98b1c75980dd7f7d9369fa07402","observation_id":"7b140455-dd06-4910-b29d-8ab790cfb8e2","resolution":{"observed_at":"2026-08-11T05:02:26.662444Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-06T02:57:30.438059Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-11T05:02:26.666965Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.666965Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:ec5182dec760df82f3d8b2c345499216ac70338501d76f12cdd482518e5d6756","observation_id":"075521c8-5206-4dc9-8aef-627e16dff426","resolution":{"observed_at":"2026-08-11T05:02:26.666965Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.02119","last_updated":"2024-10-31T15:57:42Z","snapshot_observed_at":"2026-08-13T05:10:10.124014Z","submitted_at":"2023-12-04T18:49:23Z","title":"Tree of Attacks: Jailbreaking Black-Box LLMs Automatically","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.02119","snapshot_observed_at":"2026-08-11T05:02:26.671653Z","title":"Tree of attacks: Jailbreaking black-box llms automatically","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.671653Z"},"links":{"cited_paper":"/paper/2312.02119","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:f06da91c088bbea0abcfc9081d28b8f47c819af32f35810c30c37b113641562d","observation_id":"a911f54d-ba12-4e5b-8d85-e511243ac224","resolution":{"observed_at":"2026-08-11T05:02:26.671653Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-11T05:02:26.676403Z","title":"GPT-4 technical report","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.676403Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:02c15dde1604435b6afbf9d3924c5c342b1b1d2555f82b4876e235cc947b72ee","observation_id":"9ad325b4-1779-4699-9b1e-c7a1caff0cd2","resolution":{"observed_at":"2026-08-11T05:02:26.676403Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:26.680836Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.680836Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:3923be649f444d8f226d71ed2067cfd16ed10b857d2002146c69b287873958b9","observation_id":"ee63dac9-75b2-40a1-a3c9-fc2b32be6e06","resolution":{"observed_at":"2026-08-11T05:02:26.680836Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03684","last_updated":"2024-06-11T19:02:52Z","snapshot_observed_at":"2026-07-06T16:28:22.350574Z","submitted_at":"2023-10-05T17:01:53Z","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03684","snapshot_observed_at":"2026-08-11T05:02:26.685499Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.685499Z"},"links":{"cited_paper":"/paper/2310.03684","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:8df6ecba5bcdb68f9ad1e83e9afc572fcc422259f13c5a28cc9e2020f17f9ad0","observation_id":"6a547d90-4968-4506-bec3-884520f865a9","resolution":{"observed_at":"2026-08-11T05:02:26.685499Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:27.138791Z","title":"Meta llama guard 2","venue":null,"work_id":"e252de84-f693-4b64-9147-59166d184591","year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.690411Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:f9b4012bcde99537545589df9f5162f5659faeadde3aefa9a8b312d32a789452","observation_id":"f71874a8-ebff-49e2-9cef-d38c56c5993a","resolution":{"observed_at":"2026-08-11T05:02:27.143996Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-11T05:02:26.694550Z","title":"Llama 2: Open foundation and fine-tuned chat models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.694550Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:cedea960bc07738c38e7a7227248adc10586bc0bd967cf7acfbcfb9225893017","observation_id":"f3ed272b-8902-4467-8ba7-cbc6f834e443","resolution":{"observed_at":"2026-08-11T05:02:26.694550Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:27.120308Z","title":"On adaptive attacks to adversarial example defenses","venue":null,"work_id":"f9254189-f9f4-45bb-9406-a631c2925d6f","year":2020},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.699213Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:1016b5087c7347de8a40463a00fffd1b6933e08b4145c658414946cd37dfaa03","observation_id":"24f12a02-e1fd-413c-b2b6-125962a7e667","resolution":{"observed_at":"2026-08-11T05:02:27.127315Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2401.00287","last_updated":"2023-12-30T17:37:06Z","snapshot_observed_at":"2026-08-13T04:51:02.346192Z","submitted_at":"2023-12-30T17:37:06Z","title":"The Art of Defending: A Systematic Evaluation and Analysis of LLM Defense Strategies on Safety and Over-Defensiveness","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.00287","snapshot_observed_at":"2026-08-11T05:02:26.704127Z","title":"The art of defending: A systematic evaluation and analysis of LLM defense strategies on safety and over-defensiveness","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.704127Z"},"links":{"cited_paper":"/paper/2401.00287","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:6ccaf336d9a2ede4ac6b5a51078480f2f60ac6f7345b3b524c6fdf13e6a9c71c","observation_id":"c05bef07-2c6a-456a-982d-140b59fd6193","resolution":{"observed_at":"2026-08-11T05:02:26.704127Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-08-08T18:11:45.725753Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-08-11T05:02:26.708733Z","title":"Jailbroken: How does LLM safety training fail? CoRR, abs/2307.02483, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.708733Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:84b6b18c34ad83fdada18e409b25a8548507646cd82248db389a511e471baa3c","observation_id":"d013308c-9204-477e-baa9-9634be07d53f","resolution":{"observed_at":"2026-08-11T05:02:26.708733Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06387","last_updated":"2024-05-25T07:01:15Z","snapshot_observed_at":"2026-08-06T13:25:52.403871Z","submitted_at":"2023-10-10T07:50:29Z","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06387","snapshot_observed_at":"2026-08-11T05:02:26.713244Z","title":"Jailbreak and guard aligned language models with only few in-context demonstrations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.713244Z"},"links":{"cited_paper":"/paper/2310.06387","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:e91e2cf631c9e765e9026a4223658883a049db93a4540f9883ed4353305ba8e6","observation_id":"4cfd5c5e-551a-4de1-8066-5a1b12d2d127","resolution":{"observed_at":"2026-08-11T05:02:26.713244Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-11T05:02:26.717626Z","title":"Defending chatgpt against jailbreak attack via self-reminders","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.717626Z"},"links":{"citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:a4135991dac9bbdc5cbab58d098d91c063539e290df08a9cde02c820f6b1e2ca","observation_id":"ca6d1489-5ced-474a-8e7d-577eed24b3d7","resolution":{"observed_at":"2026-08-11T05:02:26.717626Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.06561","last_updated":"2024-12-16T08:43:24Z","snapshot_observed_at":"2026-08-13T04:43:58.394752Z","submitted_at":"2024-01-12T13:15:05Z","title":"Intention Analysis Makes LLMs A Good Jailbreak Defender","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.06561","snapshot_observed_at":"2026-08-11T05:02:26.721836Z","title":"Intention analysis prompting makes large language models A good jailbreak defender","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.721836Z"},"links":{"cited_paper":"/paper/2401.06561","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:7a2dd5b21984053eaa2e2abfb7dcafdf610f382e7e5787063fa716a23fc17d34","observation_id":"96517cfd-8eb1-44e3-9180-34792e08cc7a","resolution":{"observed_at":"2026-08-11T05:02:26.721836Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.17256","last_updated":"2025-07-23T18:43:18Z","snapshot_observed_at":"2026-08-13T04:30:52.071366Z","submitted_at":"2024-01-30T18:48:37Z","title":"Weak-to-Strong Jailbreaking on Large Language Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.17256","snapshot_observed_at":"2026-08-11T05:02:26.726743Z","title":"Weak-to-strong jailbreaking on large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.726743Z"},"links":{"cited_paper":"/paper/2401.17256","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:36e15689bd0d183272fbb28508d249f7275c2b8b5f63f4bd4f743c42310557e5","observation_id":"aa3158fe-f488-43ef-95d9-92f6ee752848","resolution":{"observed_at":"2026-08-11T05:02:26.726743Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05685","last_updated":"2023-12-24T02:01:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-06-09T05:55:52Z","title":"Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05685","snapshot_observed_at":"2026-08-11T05:02:26.731586Z","title":"Xing, Hao Zhang, Joseph E","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.731586Z"},"links":{"cited_paper":"/paper/2306.05685","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:328420fba863e2880c093af6c4c1b7e7164b2910262b63ddeeeac911c5e07103","observation_id":"da5016f6-9b03-45a2-9b57-6e64ba5be173","resolution":{"observed_at":"2026-08-11T05:02:26.731586Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-11T05:02:26.737170Z","title":"I´m sorry","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-11T05:02:26.737170Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2412.18171"},"observation_digest":"sha256:629d493d6a0373bfb0bbeb9855a4f22107ecf331ab6bfeae33f3d57113648acb","observation_id":"5c61f57e-1e38-46d9-a149-a2537f73272a","resolution":{"observed_at":"2026-08-11T05:02:26.737170Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2412.18171","last_updated":"2024-12-25T02:15:50Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-12T09:07:10.978568Z","submitted_at":"2024-12-24T05:10:02Z","title":"Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models"},"reference_resolution":{"displayed":28,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":24,"verified_exact":0,"verified_fuzzy":4},"total_outbound_references":28},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"thesis":"As of 13 August 2026, this Paper Citation Record lists 28 of 28 outbound references and 0 inbound Pith citation observations for arXiv:2412.18171."}