{"as_of":"2026-08-11T19:27:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:6e22d6cf888738cda161c02ac4e59671887d68a007580eca04c36c936ef88751","coverage":[{"denominator":56,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":56,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-10T20:35:52.915101Z","state":"measured"},{"denominator":56,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":56,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-11T06:34:44.6726+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2501.07959/citation-record","integrity":"/paper/2501.07959/integrity","json":"/paper/2501.07959/citation-record.json","paper":"/paper/2501.07959"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.697345Z","title":"Llama 3 model card","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.697345Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:87e03707eec633a2aa85bc65276234f4ed518221785ba049e5814c3d66bfce6b","observation_id":"51987e9b-db86-4e42-85d4-7ed965eb8c5d","resolution":{"observed_at":"2026-08-10T20:35:52.697345Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.14132","last_updated":"2023-11-07T03:30:15Z","snapshot_observed_at":"2026-07-06T16:10:54.723336Z","submitted_at":"2023-08-27T15:20:06Z","title":"Detecting Language Model Attacks with Perplexity","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.14132","snapshot_observed_at":"2026-08-10T20:35:52.701802Z","title":"Detecting language model attacks with perplexity","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.701802Z"},"links":{"cited_paper":"/paper/2308.14132","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:7efd3ab6e19e9d356434892704f8094dcec7d7ac283ecb03aa7130b5497f14c7","observation_id":"0e399931-dc77-41bf-a8d0-8557088251a1","resolution":{"observed_at":"2026-08-10T20:35:52.701802Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.02151","last_updated":"2025-04-17T18:55:45Z","snapshot_observed_at":"2026-08-10T11:04:18.421023Z","submitted_at":"2024-04-02T17:58:27Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02151","snapshot_observed_at":"2026-08-10T20:35:52.705776Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.705776Z"},"links":{"cited_paper":"/paper/2404.02151","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:de4602d2c9ab3160587ec3203265bc4913813520a6f6d7c32f14817a1718819e","observation_id":"3af79303-da0c-41c9-affa-cbf70b6b7e2c","resolution":{"observed_at":"2026-08-10T20:35:52.705776Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.568699Z","title":"Many-shot jailbreaking","venue":null,"work_id":"c8e45c52-6060-4fcc-9307-1337f49da776","year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.710220Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:feb92907d4d1d17c257874de581b988768c93a165a804cb2a7404fcfdc521608","observation_id":"094b98a7-515f-4d18-b11a-c305be6ca13e","resolution":{"observed_at":"2026-08-10T20:35:53.573329Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.09932","last_updated":"2024-09-06T00:46:40Z","snapshot_observed_at":"2026-07-06T18:00:30.424554Z","submitted_at":"2024-04-15T16:58:28Z","title":"Foundational Challenges in Assuring Alignment and Safety of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.09932","snapshot_observed_at":"2026-08-10T20:35:52.714194Z","title":"Foundational challenges in assuring alignment and safety of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.714194Z"},"links":{"cited_paper":"/paper/2404.09932","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:96187ab85cf65606588df33a91b4931bcefaeda2de6fa32348f25aa0a41c60e9","observation_id":"6bb033e1-ce8e-48c9-a83d-809d6234bd9a","resolution":{"observed_at":"2026-08-10T20:35:52.714194Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.07875","last_updated":"2024-03-19T16:50:50Z","snapshot_observed_at":"2026-08-06T23:45:57.910675Z","submitted_at":"2023-09-14T17:23:37Z","title":"Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructions","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.07875","snapshot_observed_at":"2026-08-10T20:35:52.719204Z","title":"Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.719204Z"},"links":{"cited_paper":"/paper/2309.07875","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:b327ae65ca9289cbe5c17c1161c0f0b18753c28e06c8e8d811dc82c3569f1c9a","observation_id":"b95c695c-de00-4f27-8d69-e1594b0a73d9","resolution":{"observed_at":"2026-08-10T20:35:52.719204Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.724012Z","title":"Language models are few-shot learners","venue":null,"work_id":null,"year":1901},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.724012Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:5b8862b93c4b6dd1bd3d0d8147d503ce5cdc19e22c13e946f2310ef4f76f8030","observation_id":"bb0f603f-c2e7-4512-bf45-3b8ccb3bf130","resolution":{"observed_at":"2026-08-10T20:35:52.724012Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.00027","last_updated":"2024-06-09T03:27:40Z","snapshot_observed_at":"2026-08-02T19:45:28.046468Z","submitted_at":"2023-11-15T23:52:05Z","title":"Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injections","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.00027","snapshot_observed_at":"2026-08-10T20:35:52.727788Z","title":"Stealthy and persistent unalignment on large language models via backdoor injections","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.727788Z"},"links":{"cited_paper":"/paper/2312.00027","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:e3d30385c50e0bdb848396f9a743b8f7e60aeb6febc1a85cdd5edcddcf9d1ab8","observation_id":"62be13bd-c7b2-43f6-9867-100bd8c422fa","resolution":{"observed_at":"2026-08-10T20:35:52.727788Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-10T20:35:52.733088Z","title":"Jailbreaking black box large language models in twenty queries","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.733088Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:a56c53beaecb11b0c12728efadeffdb86e0b0f48622991e6d0dfb6c2d1f77fb3","observation_id":"ddfa3eb9-4a42-48a3-abe4-935f61abb4e2","resolution":{"observed_at":"2026-08-10T20:35:52.733088Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.01318","last_updated":"2024-10-31T22:26:40Z","snapshot_observed_at":"2026-08-11T16:28:21.917686Z","submitted_at":"2024-03-28T02:44:02Z","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.01318","snapshot_observed_at":"2026-08-10T20:35:52.737657Z","title":"Jailbreakbench: An open robustness benchmark for jailbreaking large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.737657Z"},"links":{"cited_paper":"/paper/2404.01318","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:c8fbdabcaab8a95d87481f20c93c7aa3e6c9bb156234a67fb58a2b1b7aa0495d","observation_id":"b6413099-72d0-4e21-b4d8-71bf0ae35d1e","resolution":{"observed_at":"2026-08-10T20:35:52.737657Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.742128Z","title":"Combating misinformation in the age of llms: Opportunities and challenges","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.742128Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:3d4c6d784b18ad13f3863a47ff2afa6c12e492c4b06ef6d6dbc9384f6e877958","observation_id":"2138c5fa-c552-429f-a962-5fed6f1913ae","resolution":{"observed_at":"2026-08-10T20:35:52.742128Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.12773","last_updated":"2023-10-19T14:22:03Z","snapshot_observed_at":"2026-08-02T16:56:38.535065Z","submitted_at":"2023-10-19T14:22:03Z","title":"Safe RLHF: Safe Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.12773","snapshot_observed_at":"2026-08-10T20:35:52.746178Z","title":"Safe rlhf: Safe reinforcement learning from human feedback","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.746178Z"},"links":{"cited_paper":"/paper/2310.12773","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:14410647d6662f23b4d21d438acc7ebbcf54c0c7e573c42cd73105bb6b19dfe0","observation_id":"3d825ee4-f14e-40cc-a7dd-8430b73b6ff0","resolution":{"observed_at":"2026-08-10T20:35:52.746178Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06474","last_updated":"2024-03-04T04:03:54Z","snapshot_observed_at":"2026-08-08T01:21:39.731592Z","submitted_at":"2023-10-10T09:44:06Z","title":"Multilingual Jailbreak Challenges in Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06474","snapshot_observed_at":"2026-08-10T20:35:52.750811Z","title":"Multilingual jailbreak chal- lenges in large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.750811Z"},"links":{"cited_paper":"/paper/2310.06474","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:19391a06bf20dc89e25d7b170f1dc16d4dbf94d6ff8dd88f0334a55fd37925c7","observation_id":"5a5e26a7-1a84-457a-9088-1aecc83d8781","resolution":{"observed_at":"2026-08-10T20:35:52.750811Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09283","last_updated":"2024-03-27T13:55:14Z","snapshot_observed_at":"2026-08-09T16:06:53.947436Z","submitted_at":"2024-02-14T16:14:03Z","title":"Attacks, Defenses and Evaluations for LLM Conversation Safety: A Survey","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09283","snapshot_observed_at":"2026-08-10T20:35:52.755719Z","title":"Attacks, defenses and evaluations for llm conversation safety: A survey","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.755719Z"},"links":{"cited_paper":"/paper/2402.09283","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:3c81c333d45673431846e03610e8a944fba655950b7a8b262166e525fdde89be","observation_id":"7a878be1-1938-426c-8f49-4cc7ed5d7ebb","resolution":{"observed_at":"2026-08-10T20:35:52.755719Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-08-10T16:40:37.411115Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-08-10T20:35:52.760004Z","title":"The llama 3 herd of models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.760004Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:f2707c56ff7ae0be9b7bef2d031b925cfe7e8d086ae45950d53d92d7723ef46c","observation_id":"fc414b65-0879-4503-8536-00c59249ef86","resolution":{"observed_at":"2026-08-10T20:35:52.760004Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.539105Z","title":"Red- teaming for generative ai: Silver bullet or security theater? In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, volume 7, pages 421–437, 2024","venue":null,"work_id":"ef0285b0-d64c-45fb-952c-94dbaa42bbe5","year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.763569Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:6c750b1d9332f0aea70caeef433f2000030f4ee36bd1057cf9b01456e45c4c74","observation_id":"bc2925ad-506c-4846-a1f8-ed75d3afb945","resolution":{"observed_at":"2026-08-10T20:35:53.543563Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.526270Z","title":"Badllama: cheaply removing safety fine-tuning from llama 2-chat 13b, 2024","venue":null,"work_id":"565c0554-1c8f-4c59-bae3-084a9d097d8e","year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.767401Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:0434dfe6ed3ad67474437c8e4cddd9932cc4906e4cfb2a07e2b1d943351e6be1","observation_id":"86a9f30c-9aee-4579-b0b6-5d765cd04cf8","resolution":{"observed_at":"2026-08-10T20:35:53.531168Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06674","last_updated":"2023-12-07T19:40:50Z","snapshot_observed_at":"2026-07-06T17:00:00.321552Z","submitted_at":"2023-12-07T19:40:50Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.06674","snapshot_observed_at":"2026-08-10T20:35:52.770507Z","title":"Llama guard: Llm-based input-output safeguard for human-ai conversations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.770507Z"},"links":{"cited_paper":"/paper/2312.06674","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:3fe10e640570f39d5160c4e9e1bf1be670653a0ce086e88bf1fe1b7f6ba9147a","observation_id":"4aebbcbf-ea7f-4815-80f5-81b755a6aee6","resolution":{"observed_at":"2026-08-10T20:35:52.770507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-10T20:35:52.774210Z","title":"Baseline de- fenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.774210Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:8845bfb341be6df2e5b7bb512d181d93b739390d48759b666ded102f86935a2e","observation_id":"1a230f98-a27f-41a7-9c84-bd66a97c4009","resolution":{"observed_at":"2026-08-10T20:35:52.774210Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.513931Z","title":"Perplexity—a measure of the difficulty of speech recognition tasks","venue":null,"work_id":"5285c46c-ac6f-4894-bc56-e22e16f77649","year":1977},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.777767Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:bcf4c417de75760eeda8a0ace4632f041d6b2e2713ffa5a4d2f07271d375fb43","observation_id":"641c1b60-bddc-48c9-aeeb-6d8c3eeda8db","resolution":{"observed_at":"2026-08-10T20:35:53.517940Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-10T20:35:52.781447Z","title":"Mistral 7b","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.781447Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:178ec2d8b78c6af509183ae6f7dad7ad613364531fd0b0f79560a060cebe35f6","observation_id":"b52040c0-11c3-4c80-9989-2315068e87fa","resolution":{"observed_at":"2026-08-10T20:35:52.781447Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.11753","last_updated":"2024-06-07T17:35:17Z","snapshot_observed_at":"2026-08-10T13:50:03.897892Z","submitted_at":"2024-02-19T00:43:31Z","title":"ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.11753","snapshot_observed_at":"2026-08-10T20:35:52.785478Z","title":"Artprompt: Ascii art-based jailbreak attacks against aligned llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.785478Z"},"links":{"cited_paper":"/paper/2402.11753","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:fcaaa34731fd7ad925ffb80fb56d82515de573b10d4a04481a23049095ed0fe2","observation_id":"a1af48f6-8b91-426a-b038-02fffdf6b462","resolution":{"observed_at":"2026-08-10T20:35:52.785478Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.20624","last_updated":"2024-05-22T08:39:46Z","snapshot_observed_at":"2026-08-02T03:56:52.247351Z","submitted_at":"2023-10-31T16:55:06Z","title":"LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70B","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.20624","snapshot_observed_at":"2026-08-10T20:35:52.788923Z","title":"Lora fine-tuning efficiently undoes safety training in llama 2-chat 70b","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.788923Z"},"links":{"cited_paper":"/paper/2310.20624","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:1435c404bf2f5f19bd479f025bd96de840be836dc86305589f3a05a5169c5cf9","observation_id":"b5580c03-ad9d-4d82-a648-b82d36d9a824","resolution":{"observed_at":"2026-08-10T20:35:52.788923Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.00530","last_updated":"2024-06-07T20:28:36Z","snapshot_observed_at":"2026-08-09T09:08:37.888988Z","submitted_at":"2024-02-01T11:57:53Z","title":"Superfiltering: Weak-to-Strong Data Filtering for Fast Instruction-Tuning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.00530","snapshot_observed_at":"2026-08-10T20:35:52.792439Z","title":"Superfiltering: Weak-to-strong data filtering for fast instruction-tuning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.792439Z"},"links":{"cited_paper":"/paper/2402.00530","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:24e1d4bba476f5489446daad3d807dd250a8d5286e155fc3db0168f57d937b37","observation_id":"d31ed7c8-b58b-43ea-af7d-f97174656187","resolution":{"observed_at":"2026-08-10T20:35:52.792439Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.03191","last_updated":"2024-11-28T13:43:50Z","snapshot_observed_at":"2026-08-04T19:12:56.970085Z","submitted_at":"2023-11-06T15:29:30Z","title":"DeepInception: Hypnotize Large Language Model to Be Jailbreaker","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.03191","snapshot_observed_at":"2026-08-10T20:35:52.796233Z","title":"Deepinception: Hypnotize large language model to be jailbreaker","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.796233Z"},"links":{"cited_paper":"/paper/2311.03191","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:a23b103e8af3c8f95f0c1a8160639ff6803d2c258ec989df0cf6f42a8e69810a","observation_id":"e59b2646-f26c-4178-a01d-b79d06bbc569","resolution":{"observed_at":"2026-08-10T20:35:52.796233Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.07124","last_updated":"2023-10-09T03:34:01Z","snapshot_observed_at":"2026-07-06T16:18:06.415304Z","submitted_at":"2023-09-13T17:59:09Z","title":"RAIN: Your Language Models Can Align Themselves without Finetuning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.07124","snapshot_observed_at":"2026-08-10T20:35:52.799789Z","title":"Rain: Your language models can align themselves without finetuning","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.799789Z"},"links":{"cited_paper":"/paper/2309.07124","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:8f92e1d509ed0bae0f82e10584b04057382037da0610d0d7f10e7a583b0bfe1f","observation_id":"774b9cd4-2bb3-44be-9d77-7e489c0def0f","resolution":{"observed_at":"2026-08-10T20:35:52.799789Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-06T02:57:30.438059Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-10T20:35:52.803418Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.803418Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:d2a3831bb413d895a05d88232896f7ba093e446a6438b803754e8aca82552bde","observation_id":"6d3a996f-7d66-422b-affe-4e8ac9491e96","resolution":{"observed_at":"2026-08-10T20:35:52.803418Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.04249","last_updated":"2024-02-27T04:43:08Z","snapshot_observed_at":"2026-07-06T17:26:23.067923Z","submitted_at":"2024-02-06T18:59:08Z","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.04249","snapshot_observed_at":"2026-08-10T20:35:52.807650Z","title":"Harmbench: A standardized evaluation frame- work for automated red teaming and robust refusal, 2024.URL https://arxiv","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.807650Z"},"links":{"cited_paper":"/paper/2402.04249","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:d901668432d75ac8ddbe637aedd29e91bbcab5d598d2b3e8615cfed28ca2d2b7","observation_id":"5c6e3624-1cf6-460d-a82e-630435d229c8","resolution":{"observed_at":"2026-08-10T20:35:52.807650Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.811437Z","title":"Training language models to follow instructions with human feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.811437Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:f1974088ae6d1a96312e41913d11a2cc7c889016e7da1d4181101980c28538e0","observation_id":"f52b7b31-46da-41ec-815f-3d1ac87b91e2","resolution":{"observed_at":"2026-08-10T20:35:52.811437Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.07308","last_updated":"2024-05-02T14:28:39Z","snapshot_observed_at":"2026-08-10T17:53:09.843403Z","submitted_at":"2023-08-14T17:54:10Z","title":"LLM Self Defense: By Self Examination, LLMs Know They Are Being Tricked","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.07308","snapshot_observed_at":"2026-08-10T20:35:52.814907Z","title":"Llm self defense: By self examination, llms know they are being tricked","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.814907Z"},"links":{"cited_paper":"/paper/2308.07308","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:816377075a136f4d32fbeedf5041b5d59c99336f0a12bf022dca66054c424dfa","observation_id":"e9d98946-ae4a-4eb0-acfd-02da1a80b42a","resolution":{"observed_at":"2026-08-10T20:35:52.814907Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.14455","last_updated":"2024-04-29T12:37:59Z","snapshot_observed_at":"2026-08-06T08:16:16.062348Z","submitted_at":"2023-11-24T13:09:34Z","title":"Universal Jailbreak Backdoors from Poisoned Human Feedback","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.14455","snapshot_observed_at":"2026-08-10T20:35:52.818464Z","title":"Universal jailbreak backdoors from poisoned human feedback","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.818464Z"},"links":{"cited_paper":"/paper/2311.14455","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:ae10a7b5abdbfb68e0d94e92a1820be346fda4b2b4fb297ccdc2c74035b71e77","observation_id":"ea4c7205-f1b4-4f54-b765-64f8e0121f7e","resolution":{"observed_at":"2026-08-10T20:35:52.818464Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1908.10084","last_updated":"2019-08-27T08:50:17Z","snapshot_observed_at":"2026-07-06T08:17:05.681370Z","submitted_at":"2019-08-27T08:50:17Z","title":"Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1908.10084","snapshot_observed_at":"2026-08-10T20:35:52.822255Z","title":"Sentence-bert: Sentence embeddings using siamese bert-networks","venue":null,"work_id":null,"year":1908},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.822255Z"},"links":{"cited_paper":"/paper/1908.10084","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:848d4be096b2c900a7e993baf8f9fb066993f61144db4a8b2630e4a092abc951","observation_id":"8b8d9d38-736e-4310-821b-d742885177bc","resolution":{"observed_at":"2026-08-10T20:35:52.822255Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.07865","last_updated":"2024-09-14T11:41:49Z","snapshot_observed_at":"2026-08-10T03:17:35.544423Z","submitted_at":"2024-03-12T17:55:38Z","title":"CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.07865","snapshot_observed_at":"2026-08-10T20:35:52.825816Z","title":"Ex- ploring safety generalization challenges of large language models via code","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.825816Z"},"links":{"cited_paper":"/paper/2403.07865","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:fadc0f183d47fa0da29077942d4cda1aa72e7f8d3346a41615e14aefbe397857","observation_id":"4146389d-132b-4bd6-8081-1fe955e307fc","resolution":{"observed_at":"2026-08-10T20:35:52.825816Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03684","last_updated":"2024-06-11T19:02:52Z","snapshot_observed_at":"2026-07-06T16:28:22.350574Z","submitted_at":"2023-10-05T17:01:53Z","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03684","snapshot_observed_at":"2026-08-10T20:35:52.829433Z","title":"Smoothllm: Defending large language models against jailbreaking attacks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.829433Z"},"links":{"cited_paper":"/paper/2310.03684","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:3a754b547c66ec7c12d1bd7a517e7669c6d3b0d6b9a3fba4d6f45d568ae95bea","observation_id":"44356f20-045e-4da2-9e84-8b14a768a0dc","resolution":{"observed_at":"2026-08-10T20:35:52.829433Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.833240Z","title":"do anything now","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.833240Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:1a4244655e751ae4b6f13caf3028629e934d25cc2deda93545d3aafc705bc1bf","observation_id":"33988b2a-c35b-48c8-b3ec-b58bdf2dea45","resolution":{"observed_at":"2026-08-10T20:35:52.833240Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.837049Z","title":"Qwen2.5: A party of foundation models, September 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.837049Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:4b41ba3db6e2aa7f4c14b651c1e3c22d71054947f9a1e782efc249181608288c","observation_id":"7c72ef52-306c-49f2-815e-41f77be8cc23","resolution":{"observed_at":"2026-08-10T20:35:52.837049Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-10T20:35:52.840899Z","title":"Llama 2: Open foundation and fine-tuned chat models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.840899Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:c1e8e4fce212eded589cd48827e66286d0e10f10b3aae6083588b8d80a2a44bc","observation_id":"ff03216b-92ee-4574-83e4-69f22ea01aba","resolution":{"observed_at":"2026-08-10T20:35:52.840899Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.11235","last_updated":"2024-03-16T04:32:25Z","snapshot_observed_at":"2026-08-07T05:19:58.002826Z","submitted_at":"2023-09-20T11:54:40Z","title":"OpenChat: Advancing Open-source Language Models with Mixed-Quality Data","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.11235","snapshot_observed_at":"2026-08-10T20:35:52.844524Z","title":"Open- chat: Advancing open-source language models with mixed-quality data","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.844524Z"},"links":{"cited_paper":"/paper/2309.11235","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:afaf5b978882591d765d637c894dc4e45e8e2c5b24e8903b22580f9f73f8d65b","observation_id":"eeec823e-f6ed-45c5-9d6c-b5e2ec9ce37e","resolution":{"observed_at":"2026-08-10T20:35:52.844524Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09433","last_updated":"2024-08-15T19:51:07Z","snapshot_observed_at":"2026-08-11T00:45:48.191177Z","submitted_at":"2023-11-15T23:07:40Z","title":"Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09433","snapshot_observed_at":"2026-08-10T20:35:52.848329Z","title":"Backdoor activation attack: Attack large language models using activation steering for safety-alignment","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.848329Z"},"links":{"cited_paper":"/paper/2311.09433","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:58fed7c3234a6933fc61696d93b5290a6d18fac33de35f78e96137f59a1a58fb","observation_id":"8a8eaf54-aad6-4d17-9a68-39953e2e431d","resolution":{"observed_at":"2026-08-10T20:35:52.848329Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.852850Z","title":"Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.852850Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:963e4d7238719f43f2ef32fe4103aafd9eca00eb68a4a88c035b8bd191006564","observation_id":"524a50a4-a35c-481a-ac54-2ececa3686b3","resolution":{"observed_at":"2026-08-10T20:35:52.852850Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06387","last_updated":"2024-05-25T07:01:15Z","snapshot_observed_at":"2026-08-06T13:25:52.403871Z","submitted_at":"2023-10-10T07:50:29Z","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06387","snapshot_observed_at":"2026-08-10T20:35:52.856473Z","title":"Jailbreak and guard aligned language models with only few in-context demonstrations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.856473Z"},"links":{"cited_paper":"/paper/2310.06387","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:f44dfd6c5385398e1d09737ec8e6b6efe91ac52752b09c73d697875de9ac2a47","observation_id":"ed581a41-2e19-4c3a-93a0-50d01a279b19","resolution":{"observed_at":"2026-08-10T20:35:52.856473Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.472566Z","title":"Defending chatgpt against jailbreak attack via self-reminder","venue":null,"work_id":"55dc4488-082f-417e-a1d6-fea8bdca19cb","year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.860142Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:05aacb3935228388bbdfd1ccb2ac99a2d8299ce7ac8e7d7ee7e573e8219ec6e7","observation_id":"1738ef74-4719-47c3-8ad8-c8494ed086b2","resolution":{"observed_at":"2026-08-10T20:35:53.477073Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.14710","last_updated":"2024-04-03T09:15:15Z","snapshot_observed_at":"2026-08-11T07:29:55.869710Z","submitted_at":"2023-05-24T04:27:21Z","title":"Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.14710","snapshot_observed_at":"2026-08-10T20:35:52.863562Z","title":"Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.863562Z"},"links":{"cited_paper":"/paper/2305.14710","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:46076bd8a7d4c6fd340298c720f46833e37a9e65fda7258b19bbefa935a5d13c","observation_id":"493da253-3d00-4cab-9e27-74a02732220c","resolution":{"observed_at":"2026-08-10T20:35:52.863562Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.10671","last_updated":"2024-09-10T13:25:53Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-07-15T12:35:42Z","title":"Qwen2 Technical Report","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.10671","snapshot_observed_at":"2026-08-10T20:35:52.867549Z","title":"Qwen2 technical report","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.867549Z"},"links":{"cited_paper":"/paper/2407.10671","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:a20d571e6112c2be61222b1e2ce430739b7dacd5b3b43b2545d729d1e1ea6597","observation_id":"4383d3df-5b9c-40cb-9135-33ab224320d0","resolution":{"observed_at":"2026-08-10T20:35:52.867549Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.02949","last_updated":"2023-10-04T16:39:31Z","snapshot_observed_at":"2026-08-07T11:20:01.991656Z","submitted_at":"2023-10-04T16:39:31Z","title":"Shadow Alignment: The Ease of Subverting Safely-Aligned Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.02949","snapshot_observed_at":"2026-08-10T20:35:52.870948Z","title":"Shadow alignment: The ease of subverting safely-aligned language models.(2023)","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.870948Z"},"links":{"cited_paper":"/paper/2310.02949","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:ab5cbff4b6c628d8ac1259f66465ff03a1d13ee08ee1a199eea2698d4856463e","observation_id":"35f49797-2e6a-4e80-ad93-790aa4ed03df","resolution":{"observed_at":"2026-08-10T20:35:52.870948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:52.874542Z","title":"A survey on large language model (llm) security and privacy: The good, the bad, and the ugly","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.874542Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:19d89878395c8e21f59b59a2b88c0b565118be597c700fff1f6ff8dde9bf8f37","observation_id":"99b54b90-02ac-41d0-919d-823d6d7cfc14","resolution":{"observed_at":"2026-08-10T20:35:52.874542Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.02446","last_updated":"2024-01-27T22:54:52Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-03T21:30:56Z","title":"Low-Resource Languages Jailbreak GPT-4","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.02446","snapshot_observed_at":"2026-08-10T20:35:52.877810Z","title":"Low-resource languages jailbreak gpt-4","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.877810Z"},"links":{"cited_paper":"/paper/2310.02446","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:bf320d0993f4d4bc3ac8598a13ef5f010ce1705faf197f30f9b0ecf207af581a","observation_id":"e088c2cf-5dc4-4985-8771-c216233db363","resolution":{"observed_at":"2026-08-10T20:35:52.877810Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.06463","last_updated":"2024-03-26T04:23:12Z","snapshot_observed_at":"2026-07-06T16:05:31.757410Z","submitted_at":"2023-08-12T04:05:57Z","title":"GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.06463","snapshot_observed_at":"2026-08-10T20:35:52.881332Z","title":"Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.881332Z"},"links":{"cited_paper":"/paper/2308.06463","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:893937faa5998bd5dc653a9b6c31e8de0afeb6c68a498c379ec2a43a2dd51ce1","observation_id":"095ec9a2-ea40-4352-a2c7-27ea35e465f3","resolution":{"observed_at":"2026-08-10T20:35:52.881332Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.06373","last_updated":"2024-01-23T22:46:12Z","snapshot_observed_at":"2026-08-10T11:13:59.778209Z","submitted_at":"2024-01-12T16:13:24Z","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.06373","snapshot_observed_at":"2026-08-10T20:35:52.885191Z","title":"How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.885191Z"},"links":{"cited_paper":"/paper/2401.06373","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:65d0984931bc0b45887dfcc5bfc6f4893c06427c55c5d1e64416d158010a3288","observation_id":"de2ff848-1cfe-45d1-91dd-fbcea379715e","resolution":{"observed_at":"2026-08-10T20:35:52.885191Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09096","last_updated":"2024-06-12T08:28:15Z","snapshot_observed_at":"2026-08-11T11:25:37.365684Z","submitted_at":"2023-11-15T16:42:29Z","title":"Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09096","snapshot_observed_at":"2026-08-10T20:35:52.889218Z","title":"Defending large language models against jailbreaking attacks through goal prioritization","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.889218Z"},"links":{"cited_paper":"/paper/2311.09096","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:16cb2f4f9b6c2fd3d65edf20cae9a403cd178bc05a29cab92338d90dcf736b1c","observation_id":"34f0c01b-75ba-442b-891f-23955059e5e6","resolution":{"observed_at":"2026-08-10T20:35:52.889218Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.04223","last_updated":"2025-05-11T03:35:52Z","snapshot_observed_at":"2026-07-06T19:46:24.121362Z","submitted_at":"2024-11-06T19:39:48Z","title":"Diversity Helps Jailbreak Large Language Models","version":3},"cited_work":{"arxiv_id":"2411.04223","doi":null,"metadata_source":"pith","pith_arxiv_id":"2411.04223","snapshot_observed_at":"2026-08-10T20:35:52.990680Z","title":"Diversity Helps Jailbreak Large Language Models","venue":"cs.CL","work_id":"1a574b5e-94d2-473b-bd72-e3be57e64848","year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.893040Z"},"links":{"cited_paper":"/paper/2411.04223","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:841cebcd00a61f572b7b8a18f9b70e5eb7605e78d406627b4d619f4b859da0fd","observation_id":"2424d0e2-b828-4159-bed6-f8e2cce7f211","resolution":{"observed_at":"2026-08-10T20:35:52.997180Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.01288","last_updated":"2024-10-30T12:08:42Z","snapshot_observed_at":"2026-08-06T18:17:00.986434Z","submitted_at":"2024-06-03T12:59:17Z","title":"Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.01288","snapshot_observed_at":"2026-08-10T20:35:52.898323Z","title":"Improved few- shot jailbreaking can circumvent aligned language models and their defenses","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.898323Z"},"links":{"cited_paper":"/paper/2406.01288","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:0740b2b8a0844680766d68e5e8dc4b24b8c71e654c7bbcc4eb8757cea206ce16","observation_id":"1f9f5f83-9ceb-4d85-b6b7-63b0cdaa32b1","resolution":{"observed_at":"2026-08-10T20:35:52.898323Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.12343","last_updated":"2024-06-06T12:54:48Z","snapshot_observed_at":"2026-08-10T22:54:13.233449Z","submitted_at":"2024-02-19T18:16:51Z","title":"Emulated Disalignment: Safety Alignment for Large Language Models May Backfire!","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.12343","snapshot_observed_at":"2026-08-10T20:35:52.902122Z","title":"Emulated disalignment: Safety alignment for large language models may backfire! arXiv preprint arXiv:2402.12343, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.902122Z"},"links":{"cited_paper":"/paper/2402.12343","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:83e72c3810a450e1897cce08e1a89c4447ea3e22be70a3ca3550832e576a67ae","observation_id":"ed8e2339-b36c-4fba-a62a-9510ab9119d9","resolution":{"observed_at":"2026-08-10T20:35:52.902122Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.450967Z","title":"Starling-7b: Improving llm helpfulness & harmlessness with rlaif, November 2023","venue":null,"work_id":"2c69e0af-4922-47fc-af8f-9428eb707c31","year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.906616Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:28655f93c79a21fc1fdb41c912cb3fc94e73db18681780e7b114bc2934d46b6f","observation_id":"b9476d38-a2a4-4bdb-b25d-3c64abba7121","resolution":{"observed_at":"2026-08-10T20:35:53.455117Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-10T20:35:52.910697Z","title":"Sure\" and","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.910697Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:11795e5c69c194ca6f97c227709871cd506e5bc5b9dc3f8b45277c18b3a8b358","observation_id":"dea701a4-d2cc-4c57-96ba-73755f0076f1","resolution":{"observed_at":"2026-08-10T20:35:52.910697Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-10T20:35:53.434170Z","title":"As shown in Table 10, our method can still achieve remarkable performance on HarmBench [28]","venue":null,"work_id":"e795ce6b-d1aa-4642-9eee-efefd0ac1667","year":null},"citing_paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning","version":2},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-10T20:35:52.915101Z"},"links":{"citing_paper":"/paper/2501.07959"},"observation_digest":"sha256:752581b4769a16d6b74e45a3d593ba2584a1850690757ea165401d2e5e696976","observation_id":"47c3d999-626e-41cc-8893-c678846a02e7","resolution":{"observed_at":"2026-08-10T20:35:53.439187Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-11T06:34:44.6726+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2501.07959","last_updated":"2025-02-01T09:30:34Z","latest_version":2,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-11T16:47:14.277757Z","submitted_at":"2025-01-14T09:23:30Z","title":"Self-Instruct Few-Shot Jailbreaking: Decompose the Attack into Pattern and Behavior Learning"},"reference_resolution":{"displayed":56,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":48,"verified_exact":1,"verified_fuzzy":7},"total_outbound_references":56},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-11T06:34:44.6726+00:00","source":"crossref"},{"observed_at":"2026-08-11T06:34:36.301508+00:00","source":"retraction_watch"}],"thesis":"As of 11 August 2026, this Paper Citation Record lists 56 of 56 outbound references and 0 inbound Pith citation observations for arXiv:2501.07959."}