{"as_of":"2026-08-11T14:41:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:cb94b709fc815caf3d6872f8cd4d69b66bbe1bb0711d42e47db862ff36d2e50b","coverage":[{"denominator":84,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":84,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-10T22:12:00.198263Z","state":"measured"},{"denominator":85,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":85,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-11T06:34:44.6726+00:00","state":"measured"},{"denominator":1,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T18:05:35.316487Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-08-05T18:05:36.436186Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"cited_work":{"arxiv_id":"2501.02629","doi":null,"metadata_source":"pith","pith_arxiv_id":"2501.02629","snapshot_observed_at":"2026-08-05T18:05:36.436186Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","venue":"cs.CR","work_id":"76023ef1-c85b-42e3-b19b-b930c62cc936","year":2025},"citing_paper":{"arxiv_id":"2508.15182","last_updated":"2025-08-21T02:39:14Z","snapshot_observed_at":"2026-08-08T01:21:32.994965Z","submitted_at":"2025-08-21T02:39:14Z","title":"SafeLLM: Unlearning Harmful Outputs from Large Language Models against Jailbreak Attacks","version":1},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-05T18:05:35.316487Z"},"links":{"cited_paper":"/paper/2501.02629","citing_paper":"/paper/2508.15182"},"observation_digest":"sha256:d5c8c3ac146276a83bf4d133f9a67945671ab7fd2a53ce5119358ccf3f901f3c","observation_id":"f617707b-9fa4-4d6c-a559-f94ac80b69f1","resolution":{"observed_at":"2026-08-05T18:05:36.550269Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2501.02629/citation-record","integrity":"/paper/2501.02629/integrity","json":"/paper/2501.02629/citation-record.json","paper":"/paper/2501.02629"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-10T22:11:59.594541Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.594541Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:60fe975b2f3813ef2b665b93a74ea47922b8660893149dbb6609ada0edea749f","observation_id":"817d811a-bea9-4fe1-b273-ff1dcdfe163d","resolution":{"observed_at":"2026-08-10T22:11:59.594541Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.600755Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.600755Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:8aca26c362448b8d31e72d45732da26051350852e4bd04048af318a6bc0628e1","observation_id":"5a9e95b9-c2b2-4e17-8c3c-f595d9c0d4e4","resolution":{"observed_at":"2026-08-10T22:11:59.600755Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.14132","last_updated":"2023-11-07T03:30:15Z","snapshot_observed_at":"2026-07-06T16:10:54.723336Z","submitted_at":"2023-08-27T15:20:06Z","title":"Detecting Language Model Attacks with Perplexity","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.14132","snapshot_observed_at":"2026-08-10T22:11:59.604783Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.604783Z"},"links":{"cited_paper":"/paper/2308.14132","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:adff5fb3cf0e0187c2d709da2b7fef143b3d4e4bc270d52d08323a270dc1d574","observation_id":"356aceb4-71db-41d3-b880-1cd1814e0392","resolution":{"observed_at":"2026-08-10T22:11:59.604783Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-08-10T22:11:59.610569Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.610569Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:5de07f9824dab7cc240682a5708cf9a45acb6722e3e96e6ccfa7f31bf0d9d274","observation_id":"15828501-0fed-494c-9fa3-c892699c1fbd","resolution":{"observed_at":"2026-08-10T22:11:59.610569Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.634527Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.634527Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:e9d041c5530dccdd3c0ed24278fe436b5186885ecf477432cd41fd32c2db596d","observation_id":"5e16a1ca-33e8-44ff-a6bf-b369f1ca77b5","resolution":{"observed_at":"2026-08-10T22:11:59.634527Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2104.08164","last_updated":"2021-09-08T20:44:44Z","snapshot_observed_at":"2026-08-11T13:50:34.280135Z","submitted_at":"2021-04-16T15:24:42Z","title":"Editing Factual Knowledge in Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2104.08164","snapshot_observed_at":"2026-08-10T22:11:59.639096Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.639096Z"},"links":{"cited_paper":"/paper/2104.08164","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:5a4e9aa98709dec4c1fb20efe189ae68e6a7cd5e6b0f84f5063e110aa6ad4631","observation_id":"ef17cfbb-4df1-40e0-8152-4d379e61a309","resolution":{"observed_at":"2026-08-10T22:11:59.639096Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02181","last_updated":"2024-07-09T11:59:01Z","snapshot_observed_at":"2026-08-09T22:31:51.167662Z","submitted_at":"2024-03-04T16:23:58Z","title":"Not All Layers of LLMs Are Necessary During Inference","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.02181","snapshot_observed_at":"2026-08-10T22:11:59.658968Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.658968Z"},"links":{"cited_paper":"/paper/2403.02181","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:d195e570211a3e400e57dbe9f904827c941abf5774b23448f314b094853923c9","observation_id":"12a3ef82-b907-4768-929f-d1a0b43aae87","resolution":{"observed_at":"2026-08-10T22:11:59.658968Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2203.14680","last_updated":"2022-10-12T18:01:23Z","snapshot_observed_at":"2026-08-03T05:22:23.916601Z","submitted_at":"2022-03-28T12:26:00Z","title":"Transformer Feed-Forward Layers Build Predictions by Promoting Concepts in the Vocabulary Space","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2203.14680","snapshot_observed_at":"2026-08-10T22:11:59.667865Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.667865Z"},"links":{"cited_paper":"/paper/2203.14680","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:bd603b7cc27f38684f34484f0f2332a1a6e1d0365e782944831f453af8e16102","observation_id":"35c6f668-1b55-442d-9112-f632d59b0cc9","resolution":{"observed_at":"2026-08-10T22:11:59.667865Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2012.14913","last_updated":"2021-09-05T17:32:27Z","snapshot_observed_at":"2026-08-07T23:50:29.977330Z","submitted_at":"2020-12-29T19:12:05Z","title":"Transformer Feed-Forward Layers Are Key-Value Memories","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2012.14913","snapshot_observed_at":"2026-08-10T22:11:59.674481Z","title":null,"venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.674481Z"},"links":{"cited_paper":"/paper/2012.14913","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:95899ebc7bb4056430750e26794ffc743949e15177636ca120874a3bc4f3ec7b","observation_id":"ebd03847-c403-4c5c-9031-fa97a68b597e","resolution":{"observed_at":"2026-08-10T22:11:59.674481Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.14375","last_updated":"2022-09-28T19:04:43Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-09-28T19:04:43Z","title":"Improving alignment of dialogue agents via targeted human judgements","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.14375","snapshot_observed_at":"2026-08-10T22:11:59.681514Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.681514Z"},"links":{"cited_paper":"/paper/2209.14375","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:c68c32d2bc6395fa4ecbf1d3d60d85a9df55299e849bcc9da714bc12d1bbb383","observation_id":"1d2263ee-0315-4b3f-bce9-9cbb2f6ab265","resolution":{"observed_at":"2026-08-10T22:11:59.681514Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.17887","last_updated":"2025-03-03T17:02:05Z","snapshot_observed_at":"2026-08-11T02:47:04.813368Z","submitted_at":"2024-03-26T17:20:04Z","title":"The Unreasonable Ineffectiveness of the Deeper Layers","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.17887","snapshot_observed_at":"2026-08-10T22:11:59.686596Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.686596Z"},"links":{"cited_paper":"/paper/2403.17887","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:bb67079bd89b4ad393f114f0c84b39f12c36751590ce24021ecf555593fa0779","observation_id":"22194cb1-e6ea-4170-a41c-3769b162b14e","resolution":{"observed_at":"2026-08-10T22:11:59.686596Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.12329","last_updated":"2024-12-07T23:09:49Z","snapshot_observed_at":"2026-08-11T03:10:02.344730Z","submitted_at":"2024-02-19T18:01:36Z","title":"Query-Based Adversarial Prompt Generation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.12329","snapshot_observed_at":"2026-08-10T22:11:59.692798Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.692798Z"},"links":{"cited_paper":"/paper/2402.12329","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:b0ef9e8a219eb105c6de6aafec49a2072063c702e1119a3fa2921d3e6434f597","observation_id":"0553aeac-d3a9-4cf6-9bee-1c1c41c8048d","resolution":{"observed_at":"2026-08-10T22:11:59.692798Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2106.09685","last_updated":"2021-10-16T18:40:34Z","snapshot_observed_at":"2026-08-11T08:20:29.798517Z","submitted_at":"2021-06-17T17:37:18Z","title":"LoRA: Low-Rank Adaptation of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2106.09685","snapshot_observed_at":"2026-08-10T22:11:59.718374Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.718374Z"},"links":{"cited_paper":"/paper/2106.09685","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:076a25103f465f725ade3fe3587c81503eb94fbb2d592a36f24b4c28a2eaba24","observation_id":"bd15270f-8537-4644-bf2f-f99df611725c","resolution":{"observed_at":"2026-08-10T22:11:59.718374Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.730055Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.730055Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:cc58d39ec3fd29900fcfb66373308e4c12a3fd544c9bf242b3f98c5e7ea42736","observation_id":"5cd34feb-c71b-4dc9-b5c1-ef275e0aebde","resolution":{"observed_at":"2026-08-10T22:11:59.730055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-10T22:11:59.768157Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.768157Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:943c7b14d32538402490c1404223e81674a937885af23bedd07a95cc0ed6dc8e","observation_id":"99c66fc9-e32c-46df-b5cc-8929810e5d1d","resolution":{"observed_at":"2026-08-10T22:11:59.768157Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.12785","last_updated":"2022-04-27T09:11:16Z","snapshot_observed_at":"2026-07-06T13:04:13.261577Z","submitted_at":"2022-04-27T09:11:16Z","title":"Plug-and-Play Adaptation for Continuously-updated QA","version":1},"cited_work":{"arxiv_id":"2204.12785","doi":null,"metadata_source":"pith","pith_arxiv_id":"2204.12785","snapshot_observed_at":"2026-08-10T22:12:01.202223Z","title":"Plug-and-Play Adaptation for Continuously-updated QA","venue":"cs.CL","work_id":"59d1fe16-64ec-4f0b-88b2-121b3ff22ff6","year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.773806Z"},"links":{"cited_paper":"/paper/2204.12785","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:f7eb790c61c06074dcfb4f4f945874ce6b38f36ea043ddf469e3b90278eec26b","observation_id":"0779ee9c-1b6a-46dc-b905-f7ac00642a34","resolution":{"observed_at":"2026-08-10T22:12:01.234923Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.01552","last_updated":"2023-12-04T00:46:11Z","snapshot_observed_at":"2026-08-07T00:42:49.627314Z","submitted_at":"2023-12-04T00:46:11Z","title":"The Unlocking Spell on Base LLMs: Rethinking Alignment via In-Context Learning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.01552","snapshot_observed_at":"2026-08-10T22:11:59.790507Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.790507Z"},"links":{"cited_paper":"/paper/2312.01552","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:f2c5519f80c1c734ed19315effa0433ceb1beb694cad3032c37618404da01bf0","observation_id":"ceef9326-51bc-4f94-bee1-53e504c68cf3","resolution":{"observed_at":"2026-08-10T22:11:59.790507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.798454Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.798454Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:30a2b3e7c2247bd6a4258de2fba870a913bc0af8a7300484ce2f85d30f409fb3","observation_id":"d7cb2709-dc9f-46f6-bee9-565192c4fad0","resolution":{"observed_at":"2026-08-10T22:11:59.798454Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.05827","last_updated":"2024-10-25T13:24:58Z","snapshot_observed_at":"2026-08-01T09:06:01.068131Z","submitted_at":"2024-02-08T17:06:45Z","title":"On the Robustness of Editing Large Language Models","version":2},"cited_work":{"arxiv_id":"2402.05827","doi":null,"metadata_source":"pith","pith_arxiv_id":"2402.05827","snapshot_observed_at":"2026-08-10T22:12:01.039916Z","title":"On the Robustness of Editing Large Language Models","venue":"cs.CL","work_id":"50214ad0-a5b8-4d84-ad3a-b212df4a21a3","year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.815814Z"},"links":{"cited_paper":"/paper/2402.05827","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:ee03f5c6b2d61f04fcea9a626c5f1b3787fee343ab92bc0d94445737a0a4538f","observation_id":"0ca0d8b5-c1e1-4d0b-a2a5-6d13fe1f7823","resolution":{"observed_at":"2026-08-10T22:12:01.048813Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.03853","last_updated":"2024-10-11T09:43:32Z","snapshot_observed_at":"2026-08-03T01:48:18.654934Z","submitted_at":"2024-03-06T17:04:18Z","title":"ShortGPT: Layers in Large Language Models are More Redundant Than You Expect","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.03853","snapshot_observed_at":"2026-08-10T22:11:59.820103Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.820103Z"},"links":{"cited_paper":"/paper/2403.03853","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:7e79a2af6650b3060f19213e03579bc90fa127931810d555471088133230e37f","observation_id":"3102223b-5883-4723-ad9e-2fd0e0253ba4","resolution":{"observed_at":"2026-08-10T22:11:59.820103Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.824423Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.824423Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:bcd4575582f8834b8ab0880be5cab3f054ffc3afab1a5b0ea6e8fd952cdb9fe1","observation_id":"6fbb7cd6-774e-4785-814e-42b2d7aca953","resolution":{"observed_at":"2026-08-10T22:11:59.824423Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.829094Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.829094Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:349d6c9531a64237d01e5886c80ea6e1aa3840f48234a1f19616210f47a81e13","observation_id":"7b821143-cf40-4637-91ef-88067a9c947d","resolution":{"observed_at":"2026-08-10T22:11:59.829094Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.985610Z","title":null,"venue":null,"work_id":"08ac8cd4-dc56-4dbc-a34c-c6635a06a454","year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.833215Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:6acbc0e0029faf8c47edf8015097b1aaadc522dfeb7df775c3f4944f56ba656d","observation_id":"30461f3c-299c-4b7b-b36e-83593699ea0f","resolution":{"observed_at":"2026-08-10T22:12:02.003560Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.964871Z","title":null,"venue":null,"work_id":"638e13a6-f1ae-4e75-87de-a16525d4c3b5","year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.842194Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:004d6416ed8b72a67bc92dd8e77f8f0629f7d9689aa9ec1d13a1c2b606c62abc","observation_id":"1c2d77eb-34e2-4113-8980-e7dd83afa6f6","resolution":{"observed_at":"2026-08-10T22:12:01.976778Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.08011","last_updated":"2024-02-16T15:49:42Z","snapshot_observed_at":"2026-08-08T15:42:57.199847Z","submitted_at":"2023-11-14T09:12:40Z","title":"Forgetting before Learning: Utilizing Parametric Arithmetic for Knowledge Updating in Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.08011","snapshot_observed_at":"2026-08-10T22:11:59.846476Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.846476Z"},"links":{"cited_paper":"/paper/2311.08011","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:e3f430d2386b3c3b9210025012aabc1043635cf8b44e766b2bfd747f06b2ba34","observation_id":"7b8e90e0-e7b7-4591-b5b1-5fc99e542ced","resolution":{"observed_at":"2026-08-10T22:11:59.846476Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.951153Z","title":null,"venue":null,"work_id":"4daa44f8-8f08-4f3b-b0b1-cfa9b58edc17","year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.850710Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:8d6c3df383defa883b4c6d4f6b7b224c09a25063bdf8d246244e060b5eadb37d","observation_id":"95e064bc-f242-40fe-8c41-b18b89942d3a","resolution":{"observed_at":"2026-08-10T22:12:01.956566Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.854924Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.854924Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:ecdacc58e0c7cde14aa84196337b882995f78c84ae09d3b0e4562ed3aa3cc492","observation_id":"d6cd602b-3a5b-4c6a-8e75-18a887a53159","resolution":{"observed_at":"2026-08-10T22:11:59.854924Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.04897","last_updated":"2023-11-08T18:56:35Z","snapshot_observed_at":"2026-08-06T05:52:56.931849Z","submitted_at":"2023-11-08T18:56:35Z","title":"Future Lens: Anticipating Subsequent Tokens from a Single Hidden State","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.04897","snapshot_observed_at":"2026-08-10T22:11:59.863949Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.863949Z"},"links":{"cited_paper":"/paper/2311.04897","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:b63bdba209fba83f71d8b9682c38178a11fe0102a65d9de8a68b0dc00b01938b","observation_id":"b6974c78-c451-4c89-9606-34c198f39c7d","resolution":{"observed_at":"2026-08-10T22:11:59.863949Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.17410","last_updated":"2023-09-29T17:12:43Z","snapshot_observed_at":"2026-07-06T16:25:38.571377Z","submitted_at":"2023-09-29T17:12:43Z","title":"Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.17410","snapshot_observed_at":"2026-08-10T22:11:59.868902Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.868902Z"},"links":{"cited_paper":"/paper/2309.17410","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:869208f7ca3b01b5d2c1ba7f72acf59c46e10158ba924cf484d2d5dfd07d8fb0","observation_id":"f60ed1c7-daaa-4e24-9582-259364f8a016","resolution":{"observed_at":"2026-08-10T22:11:59.868902Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.873605Z","title":null,"venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.873605Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:dc84c5d7a4ddce611e7aee521dd0fea33eeaf71611ca1d9ead0e047c2e865445","observation_id":"ca6c4054-59cc-4e16-932c-5f4eb776b32d","resolution":{"observed_at":"2026-08-10T22:11:59.873605Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2202.03286","last_updated":"2022-02-07T15:22:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-02-07T15:22:17Z","title":"Red Teaming Language Models with Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.03286","snapshot_observed_at":"2026-08-10T22:11:59.877974Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.877974Z"},"links":{"cited_paper":"/paper/2202.03286","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:1c4ee8c12bc72b87250d7ac9b10d9015eefdcf854b56c599a861c8538bc74aab","observation_id":"04c69872-25fc-44d8-8909-b931c82a464d","resolution":{"observed_at":"2026-08-10T22:11:59.877974Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03684","last_updated":"2024-06-11T19:02:52Z","snapshot_observed_at":"2026-07-06T16:28:22.350574Z","submitted_at":"2023-10-05T17:01:53Z","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03684","snapshot_observed_at":"2026-08-10T22:11:59.882281Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.882281Z"},"links":{"cited_paper":"/paper/2310.03684","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:1a9299a42e992e7a209e07b0a2ef533fa9b2d1e15437dac7687ede33ca9d908f","observation_id":"a6d1322f-e659-4553-bdd2-4a6727c9e481","resolution":{"observed_at":"2026-08-10T22:11:59.882281Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.12966","last_updated":"2023-07-24T17:44:58Z","snapshot_observed_at":"2026-07-06T15:57:57.167169Z","submitted_at":"2023-07-24T17:44:58Z","title":"Aligning Large Language Models with Human: A Survey","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.12966","snapshot_observed_at":"2026-08-10T22:11:59.904662Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.904662Z"},"links":{"cited_paper":"/paper/2307.12966","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:cc63b7e5bd6723427edebce590be14f0ee69a626b7556cd4bb88229bbe759aa6","observation_id":"8fb260a5-b4ad-42fe-acb9-685cd9b14112","resolution":{"observed_at":"2026-08-10T22:11:59.904662Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06387","last_updated":"2024-05-25T07:01:15Z","snapshot_observed_at":"2026-08-06T13:25:52.403871Z","submitted_at":"2023-10-10T07:50:29Z","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06387","snapshot_observed_at":"2026-08-10T22:11:59.912758Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.912758Z"},"links":{"cited_paper":"/paper/2310.06387","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:38c06ad2855ac5ab9cf19a0ff87078298f589022ec0419bf6df2f821c019a591","observation_id":"6d605eed-3151-4592-a9e4-07be3a451d65","resolution":{"observed_at":"2026-08-10T22:11:59.912758Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.20138","last_updated":"2023-12-05T16:14:24Z","snapshot_observed_at":"2026-07-06T16:40:55.334347Z","submitted_at":"2023-10-31T03:09:36Z","title":"DEPN: Detecting and Editing Privacy Neurons in Pretrained Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.20138","snapshot_observed_at":"2026-08-10T22:11:59.917002Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.917002Z"},"links":{"cited_paper":"/paper/2310.20138","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:fca62d1ec0e50c3558f5b603bc124f38a8920ffc9d3f19202c61a7e06315a59d","observation_id":"12d0d064-c725-415b-9838-b80a30507259","resolution":{"observed_at":"2026-08-10T22:11:59.917002Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.873621Z","title":null,"venue":null,"work_id":"09af27cd-10ca-49e3-8d52-8e0cc6b0cf2f","year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.921213Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:8beac65b1a35ef0f89e372f6767c81a9f928f5925f18c3c866f49ccd08eeafde","observation_id":"ddc528ee-c740-47d2-be32-3db6854f155d","resolution":{"observed_at":"2026-08-10T22:12:01.884760Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.10253","last_updated":"2024-06-27T16:01:27Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-09-19T02:19:48Z","title":"GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.10253","snapshot_observed_at":"2026-08-10T22:11:59.934274Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.934274Z"},"links":{"cited_paper":"/paper/2309.10253","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:3343a91b9b9f9e0358857ff8335b671311df568a7d4bcec60d4c1fa2ab41dd6b","observation_id":"e6614dbe-caeb-41e4-a2db-b7e2b8dc2927","resolution":{"observed_at":"2026-08-10T22:11:59.934274Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.06373","last_updated":"2024-01-23T22:46:12Z","snapshot_observed_at":"2026-08-10T11:13:59.778209Z","submitted_at":"2024-01-12T16:13:24Z","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.06373","snapshot_observed_at":"2026-08-10T22:11:59.939507Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":50,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.939507Z"},"links":{"cited_paper":"/paper/2401.06373","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:a1379d926a2eca5456cf0f4bcf1ad77afefb0b34611d6176591f418ce0211397","observation_id":"c396f214-5a25-4f17-8294-9a7f92d9d9d3","resolution":{"observed_at":"2026-08-10T22:11:59.939507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.07876","last_updated":"2023-12-13T03:35:43Z","snapshot_observed_at":"2026-07-06T17:00:53.532910Z","submitted_at":"2023-12-13T03:35:43Z","title":"Causality Analysis for Evaluating the Security of Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.07876","snapshot_observed_at":"2026-08-10T22:11:59.943595Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.943595Z"},"links":{"cited_paper":"/paper/2312.07876","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:ab0d15446eb7fd1e5230813982abb271b74aca5ca7a8c1461bf91b3356aca3bf","observation_id":"8a48cb0e-d279-4f54-b9c8-6f606ad9b48d","resolution":{"observed_at":"2026-08-10T22:11:59.943595Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.948432Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.948432Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:3b6c1004699b0aaee23fa45754aaabd9f089cf3f9937f351f1bd49210be2bd73","observation_id":"f493bcbd-bf32-4a15-88ab-665e9dff68bc","resolution":{"observed_at":"2026-08-10T22:11:59.948432Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.954757Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":53,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.954757Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:b28c2616b067aa223aad6261a60b23e22efaa92cfe42c6f5f705416763013dcc","observation_id":"429e7db1-9b7e-417f-8894-4e69f54a42f4","resolution":{"observed_at":"2026-08-10T22:11:59.954757Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2012.00363","last_updated":"2020-12-01T09:39:13Z","snapshot_observed_at":"2026-08-10T15:59:10.397359Z","submitted_at":"2020-12-01T09:39:13Z","title":"Modifying Memories in Transformer Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2012.00363","snapshot_observed_at":"2026-08-10T22:11:59.965609Z","title":null,"venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.965609Z"},"links":{"cited_paper":"/paper/2012.00363","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:50ff6789ddbd43a6780b95e321d22b464c84f26bc83bf0b0a5546498c50c6df0","observation_id":"f22a627c-6552-4140-b8b4-1d66b26cc76e","resolution":{"observed_at":"2026-08-10T22:11:59.965609Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.14857","last_updated":"2024-06-18T19:22:19Z","snapshot_observed_at":"2026-08-06T10:55:38.873690Z","submitted_at":"2024-02-20T17:39:40Z","title":"Is the System Message Really Important to Jailbreaks in Large Language Models?","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.14857","snapshot_observed_at":"2026-08-10T22:11:59.976519Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.976519Z"},"links":{"cited_paper":"/paper/2402.14857","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:ba4bfd24f3cb670cc2de2061d4a0667320595a3e2e73c14443385f81f4b2051f","observation_id":"ccd6187b-74d8-4d14-8759-126059ee0d5e","resolution":{"observed_at":"2026-08-10T22:11:59.976519Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.981056Z","title":"online\" 'onlinestring :=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.981056Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:c19f3789865715176950a7b78cea138a13550dbda20c1b15aab04dbc85715b3d","observation_id":"58340c30-63fc-4b84-85a7-fc8062765266","resolution":{"observed_at":"2026-08-10T22:11:59.981056Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.986312Z","title":"write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.986312Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:84ea31775f1f39817d67d9df56c3a9431e653980f29f0145d63ab10bc192fd13","observation_id":"821e50fa-ce4a-4d15-95d3-6f876f92fde8","resolution":{"observed_at":"2026-08-10T22:11:59.986312Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.14348","last_updated":"2024-06-12T00:27:06Z","snapshot_observed_at":"2026-07-06T16:23:26.584450Z","submitted_at":"2023-09-18T02:07:22Z","title":"Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.14348","snapshot_observed_at":"2026-08-10T22:11:59.990893Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":60,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.990893Z"},"links":{"cited_paper":"/paper/2309.14348","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:981551d36ba15649d64fc51f2f232bd30821788455f93407c91f34ecae42008a","observation_id":"405640b3-808d-4b6a-8593-04648e624cc7","resolution":{"observed_at":"2026-08-10T22:11:59.990893Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:11:59.994933Z","title":null,"venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":61,"source":"arxiv_source","source_observed_at":"2026-08-10T22:11:59.994933Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:46e5cca1a58622e471a48f48ccef2314426c6508ac6e29539c557c2b81523dc7","observation_id":"609cf4a7-5b35-4199-b635-f8175ca136eb","resolution":{"observed_at":"2026-08-10T22:11:59.994933Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-10T22:12:00.001874Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":62,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.001874Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:b8ab88d6f612c06c807a46d0f3671e22348c5e50f91bff840a7ac6c01d135851","observation_id":"eeb30ab9-e8a8-46d3-ba0a-5864db3ddf45","resolution":{"observed_at":"2026-08-10T22:12:00.001874Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.08715","last_updated":"2023-10-25T07:30:51Z","snapshot_observed_at":"2026-08-11T04:58:43.785083Z","submitted_at":"2023-07-16T01:07:15Z","title":"MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.08715","snapshot_observed_at":"2026-08-10T22:12:00.008280Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":63,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.008280Z"},"links":{"cited_paper":"/paper/2307.08715","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:3eea53893fa2a05c6b3c2f3303f8e6ab54ebc887fd674d150620bfd786b3720a","observation_id":"4907ea61-c84c-4ea3-8014-89b12d0fb983","resolution":{"observed_at":"2026-08-10T22:12:00.008280Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.07308","last_updated":"2024-05-02T14:28:39Z","snapshot_observed_at":"2026-08-10T17:53:09.843403Z","submitted_at":"2023-08-14T17:54:10Z","title":"LLM Self Defense: By Self Examination, LLMs Know They Are Being Tricked","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.07308","snapshot_observed_at":"2026-08-10T22:12:00.012228Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":64,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.012228Z"},"links":{"cited_paper":"/paper/2308.07308","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:2232119eaf698cb48039bd906ecea7a0c25c6ee007ef2aa3a591c30d1c73f23f","observation_id":"8f58f70f-7983-4a1b-a01a-d5f1a40e772f","resolution":{"observed_at":"2026-08-10T22:12:00.012228Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.018197Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.018197Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:89aa6a001bf103411091ee13eaed378a5cd5eef5073573c3df5c7af2579fe45f","observation_id":"87820e7a-a0e3-4bd8-87c6-ad7f1086e605","resolution":{"observed_at":"2026-08-10T22:12:00.018197Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06987","last_updated":"2023-10-10T20:15:54Z","snapshot_observed_at":"2026-07-06T16:30:46.321160Z","submitted_at":"2023-10-10T20:15:54Z","title":"Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06987","snapshot_observed_at":"2026-08-10T22:12:00.022595Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":66,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.022595Z"},"links":{"cited_paper":"/paper/2310.06987","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:af74d026c22d76f575f86ddcc9a0072639eab8b59d7780bd90b795543bbc8020","observation_id":"7cbd6292-f52e-4d9e-8ea0-906c150e645a","resolution":{"observed_at":"2026-08-10T22:12:00.022595Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.727267Z","title":null,"venue":null,"work_id":"66be6191-0ed7-4c51-ae05-2a98f20280d7","year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.029572Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:f2083d9687fb63793c459c05ee1908d391f58bc17f464abf0237ca1208e7729c","observation_id":"ea4bdcad-85ea-48ec-9658-3a9c69c6e72f","resolution":{"observed_at":"2026-08-10T22:12:01.733386Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-10T22:12:00.038446Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":68,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.038446Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:c20ea74bf79487c9763546e5755dc6c6f2b1914ad31eddcd560eef31e517a5ea","observation_id":"3c5354cd-83ed-47a9-abe2-7d24d4d00b05","resolution":{"observed_at":"2026-08-10T22:12:00.038446Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.043077Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.043077Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:30220a340a9b9b353428ac894d3ce21b20bff2a7b13637562984ddfd6f660f3b","observation_id":"313787b1-5638-439f-8030-e1bee329838d","resolution":{"observed_at":"2026-08-10T22:12:00.043077Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-07-06T16:15:00.517258Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-10T22:12:00.047226Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":70,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.047226Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:4b18a84b393274263f4006113a20df4344fdf7df531b78a570d017a1a779513c","observation_id":"8dccb1ad-7a00-4758-8163-e94637e9e88d","resolution":{"observed_at":"2026-08-10T22:12:00.047226Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.03191","last_updated":"2024-11-28T13:43:50Z","snapshot_observed_at":"2026-08-04T19:12:56.970085Z","submitted_at":"2023-11-06T15:29:30Z","title":"DeepInception: Hypnotize Large Language Model to Be Jailbreaker","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.03191","snapshot_observed_at":"2026-08-10T22:12:00.060734Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":72,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.060734Z"},"links":{"cited_paper":"/paper/2311.03191","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:6132531f01beb54bd4291ec80f17116296d050d00eab47ea4ec570fec76f3dec","observation_id":"769d9811-7730-41c3-8663-5a5c632bc3df","resolution":{"observed_at":"2026-08-10T22:12:00.060734Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.07124","last_updated":"2023-10-09T03:34:01Z","snapshot_observed_at":"2026-07-06T16:18:06.415304Z","submitted_at":"2023-09-13T17:59:09Z","title":"RAIN: Your Language Models Can Align Themselves without Finetuning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.07124","snapshot_observed_at":"2026-08-10T22:12:00.065764Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":73,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.065764Z"},"links":{"cited_paper":"/paper/2309.07124","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:878264350a7ede99d88c0cbb8095513da9215b7d34c0b4a381106c39adaae124","observation_id":"a8c0d13d-1cb2-4fee-ab23-32fd97d61e10","resolution":{"observed_at":"2026-08-10T22:12:00.065764Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.070815Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":74,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.070815Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:1e1a95cfef2ace43aa63726d7d413b5632e8a48f39e476637e9d76fb03044f94","observation_id":"1446adb2-08fd-4e25-8eff-8c5b53259345","resolution":{"observed_at":"2026-08-10T22:12:00.070815Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2203.12817","last_updated":"2022-08-13T23:35:30Z","snapshot_observed_at":"2026-07-06T12:51:51.647366Z","submitted_at":"2022-03-24T02:40:33Z","title":"Continual Learning and Private Unlearning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2203.12817","snapshot_observed_at":"2026-08-10T22:12:00.074676Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":75,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.074676Z"},"links":{"cited_paper":"/paper/2203.12817","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:e07f97705de9bc60af81517531479c25c88b51b2111f5a216f4e724d48aaf4a8","observation_id":"38831abc-7422-472f-b9e5-3ed9e91f43cf","resolution":{"observed_at":"2026-08-10T22:12:00.074676Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.673496Z","title":null,"venue":null,"work_id":"9e656b1e-c682-4548-8740-35926431be4e","year":2018},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":76,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.081177Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:f0e2737400058eee6646e225d231fac9c1bc14531bb6f3cd46190bdfa10a20e5","observation_id":"a972048a-9b7d-4dc7-8159-6995379306e2","resolution":{"observed_at":"2026-08-10T22:12:01.682616Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-06T02:57:30.438059Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-10T22:12:00.087620Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":77,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.087620Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:a4679b33aadd3ac7788bdc8a560cb649576a89d7654135e6773dfdaa19afff62","observation_id":"4fed2f62-7737-4914-bba4-146f37c96d43","resolution":{"observed_at":"2026-08-10T22:12:00.087620Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.092301Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":78,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.092301Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:35775ac1eb9ffa5ffdaa7b0092b83a70760b3fbfa47a43716145dc914de27227","observation_id":"8e5bb156-2976-47d8-87f5-f336cd68bd1d","resolution":{"observed_at":"2026-08-10T22:12:00.092301Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.00029","last_updated":"2024-08-18T22:26:13Z","snapshot_observed_at":"2026-08-10T13:04:17.737840Z","submitted_at":"2023-11-16T07:31:18Z","title":"Bergeron: Combating Adversarial Attacks through a Conscience-Based Alignment Framework","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.00029","snapshot_observed_at":"2026-08-10T22:12:00.096522Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":79,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.096522Z"},"links":{"cited_paper":"/paper/2312.00029","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:41ee081de0073aa6e71d7576234c641d79d9b7ac24cfaedded490728f7e0f4ad","observation_id":"871466a3-1766-4a9a-a112-e67accee42a5","resolution":{"observed_at":"2026-08-10T22:12:00.096522Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.100680Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":80,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.100680Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:dcd68a37e779561a6f73f17fefb02b0d454b188e52d1559284b99edad8b84fd4","observation_id":"b36f8b56-654e-495e-9c91-81465a039516","resolution":{"observed_at":"2026-08-10T22:12:00.100680Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.634277Z","title":null,"venue":null,"work_id":"d0db60ea-fab5-4f34-adc2-016ba58b229f","year":2021},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":81,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.108615Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:3280760c7fc8f4297e6cfd0f0075e717f62f17323a03c599aa3240f50ccd92d3","observation_id":"f5b7649f-1476-4a73-8a4c-bf646e6c2ef5","resolution":{"observed_at":"2026-08-10T22:12:01.638915Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.03825","last_updated":"2024-05-15T12:06:31Z","snapshot_observed_at":"2026-07-06T16:03:34.432602Z","submitted_at":"2023-08-07T16:55:20Z","title":"\"Do Anything Now\": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.03825","snapshot_observed_at":"2026-08-10T22:12:00.113756Z","title":"do anything now","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":82,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.113756Z"},"links":{"cited_paper":"/paper/2308.03825","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:e61c9a3c1cd32459d51411371e19b9dee6684945670b0b78b2d99d2980583b29","observation_id":"33fc8aed-559c-4a39-a5e4-964e7b34a414","resolution":{"observed_at":"2026-08-10T22:12:00.113756Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.620668Z","title":null,"venue":null,"work_id":"51830d92-6a56-48c7-aebd-0949ceeca6d6","year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":83,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.120086Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:5d8469cf56afac8415709a9d88a8a087e42db28cdf8aafa328f98b12dce61aac","observation_id":"fa2f11b2-e212-4694-9b34-fb7e08c16973","resolution":{"observed_at":"2026-08-10T22:12:01.625820Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-10T22:12:00.125110Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":84,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.125110Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:608b855ac1d7c152b0969f3edf833eb20f304f2d21affdf8474f880a31086eaa","observation_id":"98a32bbc-29f3-47b6-b6bb-fe767a83158a","resolution":{"observed_at":"2026-08-10T22:12:00.125110Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14472","last_updated":"2024-05-28T09:11:25Z","snapshot_observed_at":"2026-07-06T17:48:24.076444Z","submitted_at":"2024-03-21T15:18:30Z","title":"Detoxifying Large Language Models via Knowledge Editing","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14472","snapshot_observed_at":"2026-08-10T22:12:00.130101Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":85,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.130101Z"},"links":{"cited_paper":"/paper/2403.14472","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:36dde5769891aec983db3a20af490014ec201680e84f94d80b63b0e62bc76775","observation_id":"c0383e78-96ff-4219-8b2f-fe014c46f662","resolution":{"observed_at":"2026-08-10T22:12:00.130101Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.11182","last_updated":"2025-02-07T01:18:07Z","snapshot_observed_at":"2026-07-06T19:03:43.883872Z","submitted_at":"2024-08-20T20:35:04Z","title":"Hide Your Malicious Goal Into Benign Narratives: Jailbreak Large Language Models through Carrier Articles","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.11182","snapshot_observed_at":"2026-08-10T22:12:00.134348Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":86,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.134348Z"},"links":{"cited_paper":"/paper/2408.11182","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:10e8aa5e4d5a945975d68aefcc165385478633b38d6aef67ba739f4ca662bef1","observation_id":"83729fab-ed01-4188-8143-48411c326c8d","resolution":{"observed_at":"2026-08-10T22:12:00.134348Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-08-08T18:11:45.725753Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-08-10T22:12:00.140146Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":87,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.140146Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:15578a6176bc5cc2d449d8cb3f0fe464261d0036e0ac44aa1466bfe121af87ac","observation_id":"bdc802f1-e24e-41c5-9d3a-d17e9e36c5d7","resolution":{"observed_at":"2026-08-10T22:12:00.140146Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09127","last_updated":"2024-01-20T18:55:51Z","snapshot_observed_at":"2026-08-09T01:09:44.001852Z","submitted_at":"2023-11-15T17:17:39Z","title":"Jailbreaking GPT-4V via Self-Adversarial Attacks with System Prompts","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09127","snapshot_observed_at":"2026-08-10T22:12:00.144197Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":88,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.144197Z"},"links":{"cited_paper":"/paper/2311.09127","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:36bf87c2c6c2d073a2c0c90fd7a90c608597ec12428f47f5a2eb31956a4fe711","observation_id":"4ac1aeb8-916b-4f5f-b359-c04df564118e","resolution":{"observed_at":"2026-08-10T22:12:00.144197Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.08983","last_updated":"2024-07-25T22:59:44Z","snapshot_observed_at":"2026-08-06T04:06:56.137869Z","submitted_at":"2024-02-14T06:54:31Z","title":"SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.08983","snapshot_observed_at":"2026-08-10T22:12:00.149220Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":89,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.149220Z"},"links":{"cited_paper":"/paper/2402.08983","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:d0bcc26caefb55949064cbce96a0a88739dc145f0533a056385f4fa430201c84","observation_id":"7a3ca14b-fb12-45b5-b492-f91c1014ad53","resolution":{"observed_at":"2026-08-10T22:12:00.149220Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.13457","last_updated":"2024-05-17T05:00:24Z","snapshot_observed_at":"2026-08-11T04:52:50.241599Z","submitted_at":"2024-02-21T01:26:39Z","title":"A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.13457","snapshot_observed_at":"2026-08-10T22:12:00.154510Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":90,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.154510Z"},"links":{"cited_paper":"/paper/2402.13457","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:19ccda80bb7e262e83561ae95092305df60e76f3d1ff5449e8d4304a90bd43b3","observation_id":"292305e5-41b3-4e01-b65b-de621a70054c","resolution":{"observed_at":"2026-08-10T22:12:00.154510Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:01.595812Z","title":null,"venue":null,"work_id":"37a28f8f-f43c-4d8a-9a0a-3ec90b3c2de7","year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":91,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.158627Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:8a1f31b7188df1778ee6f76d547df8ef9f71bc5ea59b1b7c52ca7cdaa842650d","observation_id":"848f4694-f3dd-4a14-89e6-89b4cc3f0fa4","resolution":{"observed_at":"2026-08-10T22:12:01.599943Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T22:12:00.162774Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":92,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.162774Z"},"links":{"citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:2bf21d7448a3ab5cd67533906ca755baa5290cd00f41ea79e112af4754b6b769","observation_id":"2ce040d5-31ee-4569-87ca-d3b310ac162d","resolution":{"observed_at":"2026-08-10T22:12:00.162774Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.10683","last_updated":"2024-02-16T19:47:36Z","snapshot_observed_at":"2026-08-04T08:36:17.664739Z","submitted_at":"2023-10-14T00:32:55Z","title":"Large Language Model Unlearning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.10683","snapshot_observed_at":"2026-08-10T22:12:00.167216Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":93,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.167216Z"},"links":{"cited_paper":"/paper/2310.10683","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:4ad015f266108562c58bf1ae7067017e827279a2222377b9c28bc0a8174d7d6b","observation_id":"4f748aa9-3291-4ca5-bbba-c7ebdeaf1169","resolution":{"observed_at":"2026-08-10T22:12:00.167216Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.04295","last_updated":"2024-08-30T11:57:47Z","snapshot_observed_at":"2026-08-04T23:34:13.332065Z","submitted_at":"2024-07-05T06:57:30Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.04295","snapshot_observed_at":"2026-08-10T22:12:00.171521Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":94,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.171521Z"},"links":{"cited_paper":"/paper/2407.04295","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:e60cd7a27b719d025a3a62aa513dffa94f37974df967942f8ea727ce9e3ca373","observation_id":"2b2bf9e6-ca15-427c-8341-780a20517969","resolution":{"observed_at":"2026-08-10T22:12:00.171521Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09096","last_updated":"2024-06-12T08:28:15Z","snapshot_observed_at":"2026-08-11T11:25:37.365684Z","submitted_at":"2023-11-15T16:42:29Z","title":"Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09096","snapshot_observed_at":"2026-08-10T22:12:00.175548Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":95,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.175548Z"},"links":{"cited_paper":"/paper/2311.09096","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:9c5b7d63909e8f74fbb21835a2fa372c993a2dba06abce2aaf50c6fd365038cc","observation_id":"54cc01dd-f2fa-4115-a247-eefec3a3e180","resolution":{"observed_at":"2026-08-10T22:12:00.175548Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.18166","last_updated":"2024-06-14T07:27:26Z","snapshot_observed_at":"2026-08-09T23:55:57.827623Z","submitted_at":"2024-05-28T13:26:12Z","title":"Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.18166","snapshot_observed_at":"2026-08-10T22:12:00.181315Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":96,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.181315Z"},"links":{"cited_paper":"/paper/2405.18166","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:0fd463a3cf961848691efef85f9d4690983741d4ac42d0d1f8d11fb01fa1eeb9","observation_id":"ea3b3048-abec-45b6-842e-8574a3f63a75","resolution":{"observed_at":"2026-08-10T22:12:00.181315Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.17256","last_updated":"2025-07-23T18:43:18Z","snapshot_observed_at":"2026-08-10T23:27:47.979166Z","submitted_at":"2024-01-30T18:48:37Z","title":"Weak-to-Strong Jailbreaking on Large Language Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.17256","snapshot_observed_at":"2026-08-10T22:12:00.187801Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":97,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.187801Z"},"links":{"cited_paper":"/paper/2401.17256","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:231bc03df71acf2ab9cbb738331661138deb28db951da734e3603a692dade1f1","observation_id":"9a343cc1-97f1-43e0-91af-e32e44dc361a","resolution":{"observed_at":"2026-08-10T22:12:00.187801Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.12171","last_updated":"2024-03-18T18:39:53Z","snapshot_observed_at":"2026-08-06T21:46:54.063328Z","submitted_at":"2024-03-18T18:39:53Z","title":"EasyJailbreak: A Unified Framework for Jailbreaking Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.12171","snapshot_observed_at":"2026-08-10T22:12:00.193445Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":98,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.193445Z"},"links":{"cited_paper":"/paper/2403.12171","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:0286cc7cd03b5bb60f9f94381afb617a4a67597a107a9b1b4be69bdffd6a73af","observation_id":"a8037181-c287-40cb-9391-0a56fd8b1240","resolution":{"observed_at":"2026-08-10T22:12:00.193445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-10T22:12:00.198263Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense","version":2},"reference_index":99,"source":"arxiv_source","source_observed_at":"2026-08-10T22:12:00.198263Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2501.02629"},"observation_digest":"sha256:59651503cf7ecf8f91f200a30ea03823277b7723341ce9de758c79ecc116ea25","observation_id":"4a760bc7-3b29-4361-b134-ce47eafafdd0","resolution":{"observed_at":"2026-08-10T22:12:00.198263Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2501.02629","last_updated":"2025-02-12T04:55:19Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-11T13:56:33.650905Z","submitted_at":"2025-01-05T19:06:03Z","title":"Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense"},"reference_resolution":{"displayed":84,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":82,"verified_exact":2,"verified_fuzzy":0},"total_outbound_references":84},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"thesis":"As of 11 August 2026, this Paper Citation Record lists 84 of 84 outbound references and 1 inbound Pith citation observation for arXiv:2501.02629."}