{"as_of":"2026-08-10T08:17:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:d802f8bd7aa56ab679ce1eb9a1eb0b122ec99a7e6283c477619d43c0ff349b3e","coverage":[{"denominator":22,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":22,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-09T18:31:14.158845Z","state":"measured"},{"denominator":23,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":23,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-10T06:31:04.303077+00:00","state":"measured"},{"denominator":1,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-10T02:54:35.336251Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-05-11T12:51:02.591575Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"cited_work":{"arxiv_id":"2502.00580","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.00580","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"De- fense against the dark prompts: Mitigating best-of-n jailbreak- ing with prompt evaluation","venue":null,"work_id":"c1d8bf58-6d13-4b34-9b89-a6bc520f7683","year":2025},"citing_paper":{"arxiv_id":"2604.19844","last_updated":"2026-04-21T11:27:30Z","snapshot_observed_at":"2026-07-31T22:27:19.281459Z","submitted_at":"2026-04-21T11:27:30Z","title":"If you're waiting for a sign... that might not be it! Mitigating Trust Boundary Confusion from Visual Injections on Vision-Language Agentic Systems","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-05-10T02:54:35.336251Z"},"links":{"cited_paper":"/paper/2502.00580","citing_paper":"/paper/2604.19844"},"observation_digest":"sha256:6510badf6c5bdf72c75475603105f9ed9c115ca44fff9ea388133fb5e66d877c","observation_id":"f37cef00-b916-4826-81d8-595ceaa0cd8a","resolution":{"observed_at":"2026-05-11T12:51:02.601349Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2502.00580/citation-record","integrity":"/paper/2502.00580/integrity","json":"/paper/2502.00580/citation-record.json","paper":"/paper/2502.00580"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T18:31:14.499024Z","title":"Pushing Boundaries or Crossing Lines? The Complex Ethics of ChatGPT Jailbreaking.SSRN Electronic Journal, 2023","venue":null,"work_id":"f0e475bf-d31f-49b4-92c8-6ff31aff0e87","year":2023},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.075522Z"},"links":{"citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:c7c57e410ed0d415c51c8ecdc9f5993192064ff28ddfcea62816311d94fcd709","observation_id":"0a46e19c-6fb8-45fa-9d94-1ed5cba42769","resolution":{"observed_at":"2026-08-09T18:31:14.503188Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.16567","last_updated":"2024-05-28T06:37:00Z","snapshot_observed_at":"2026-07-31T19:00:32.707365Z","submitted_at":"2024-05-26T13:32:24Z","title":"Automatic Jailbreaking of the Text-to-Image Generative AI Systems","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.16567","snapshot_observed_at":"2026-08-09T18:31:14.079617Z","title":"Automatic jailbreaking of the text-to-image generative ai systems","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.079617Z"},"links":{"cited_paper":"/paper/2405.16567","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:ab7639db376b27228218e7bd12cdd494e4b1b9dbbbb43a02b01e97c8163e875b","observation_id":"936fb21b-621b-463d-88cc-c76fbc986007","resolution":{"observed_at":"2026-08-09T18:31:14.079617Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T18:31:14.083521Z","title":"Jailbreakzoo: Survey, landscapes, andhorizons in jailbreaking large language and vision-language models.arXiv preprint arXiv:2407.01599, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.083521Z"},"links":{"citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:843925853e42de28e7cb0d2bb993ce92e4ae4961cb4a7208604e61248d2915c6","observation_id":"1319f387-e11a-446b-afa5-4aa9bb9c1ef5","resolution":{"observed_at":"2026-08-09T18:31:14.083521Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05608","last_updated":"2025-01-19T16:23:38Z","snapshot_observed_at":"2026-07-06T16:45:24.070954Z","submitted_at":"2023-11-09T18:59:11Z","title":"FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05608","snapshot_observed_at":"2026-08-09T18:31:14.087069Z","title":"Figstep: Jailbreaking large vision-language models via typographic visual prompts","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.087069Z"},"links":{"cited_paper":"/paper/2311.05608","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:3007bb8c4a5b6df72f7f165db622e4d0d0a23555dd73b7fa2ebb01bb9641a22b","observation_id":"9286d120-4a50-4efb-b285-aeaf00e32d60","resolution":{"observed_at":"2026-08-09T18:31:14.087069Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.08715","last_updated":"2023-10-25T07:30:51Z","snapshot_observed_at":"2026-07-06T15:54:58.589775Z","submitted_at":"2023-07-16T01:07:15Z","title":"MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.08715","snapshot_observed_at":"2026-08-09T18:31:14.091976Z","title":"Jailbreaker: Automated jailbreak across multiple large language model chatbots","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.091976Z"},"links":{"cited_paper":"/paper/2307.08715","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:acd66ba8ecb23970336aaa63f506eb97a6cf37ba4d8467ac1dc0fcd5b22d5856","observation_id":"61eb7d40-2757-4f15-aed8-30a48687bceb","resolution":{"observed_at":"2026-08-09T18:31:14.091976Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.17336","last_updated":"2024-09-30T21:25:23Z","snapshot_observed_at":"2026-08-05T17:39:59.419266Z","submitted_at":"2024-03-26T02:47:42Z","title":"Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.17336","snapshot_observed_at":"2026-08-09T18:31:14.095655Z","title":"Don’t listen to me: Understanding and exploring jailbreak prompts of large language models.arXiv preprint arXiv:2403.17336, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.095655Z"},"links":{"cited_paper":"/paper/2403.17336","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:1ae6a1f5a1b9c233e8234242cf2cefe766aea65cc4f1585ada86ec7a84e6c654","observation_id":"52f07ae2-6466-4927-92f7-1b219248bd14","resolution":{"observed_at":"2026-08-09T18:31:14.095655Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.11445","last_updated":"2024-11-05T08:46:01Z","snapshot_observed_at":"2026-08-10T06:21:38.687294Z","submitted_at":"2024-09-17T03:39:45Z","title":"Jailbreaking Large Language Models with Symbolic Mathematics","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.11445","snapshot_observed_at":"2026-08-09T18:31:14.099686Z","title":"Jailbreaking large language models with symbolic mathematics","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.099686Z"},"links":{"cited_paper":"/paper/2409.11445","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:a218dee081e22253d350e299887b6406d241c70ba8efd1eb67f8de7a51025e82","observation_id":"d1313410-f756-460b-b972-a8ea4336bf16","resolution":{"observed_at":"2026-08-09T18:31:14.099686Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.06373","last_updated":"2024-01-23T22:46:12Z","snapshot_observed_at":"2026-07-06T17:14:36.670116Z","submitted_at":"2024-01-12T16:13:24Z","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.06373","snapshot_observed_at":"2026-08-09T18:31:14.103240Z","title":"How johnny can persuade llms to jailbreak them: Rethink- ing persuasion to challenge ai safety by humanizing llms.arXiv preprint arXiv:2401.06373, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.103240Z"},"links":{"cited_paper":"/paper/2401.06373","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:7f7ffd04338adfed4bf4c9feb28e47a571e58e8c2513c27ce07aa2f4b6f6b1ad","observation_id":"208c5995-eb14-4156-9167-17de298fe388","resolution":{"observed_at":"2026-08-09T18:31:14.103240Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T18:31:14.487460Z","title":"Zhang et al","venue":null,"work_id":"d201c6c3-73d5-478a-9ba9-89b457dc4045","year":2023},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.107167Z"},"links":{"citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:855220fb56d686357e81d73623ad33308260353b885525b9cccd1ea1cbf5f54c","observation_id":"94c39fb8-8774-4ed4-a068-6cc17fce0e1a","resolution":{"observed_at":"2026-08-09T18:31:14.491451Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T18:31:14.476035Z","title":"Li and R","venue":null,"work_id":"31deb373-3d01-401b-8fc4-59b3a059d6a1","year":2023},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.110810Z"},"links":{"citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:85d18d09478199a09b7c14e71be11cadb4294896f799c025fe94d65047bd1343","observation_id":"8eafc1a8-8fcd-4740-80ca-e08de5517ad0","resolution":{"observed_at":"2026-08-09T18:31:14.480233Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T18:31:14.463324Z","title":"Defending ChatGPT against jailbreak attack via self-reminders","venue":null,"work_id":"ac05fabb-27da-4d84-a49d-feee7ae65920","year":2023},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.114240Z"},"links":{"citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:afd8e3ae42a210b3db9ce1165d1d30c526bad5d91824d04d31922dca8ed16e71","observation_id":"99cba573-d03e-4bad-a81b-663b460c6b30","resolution":{"observed_at":"2026-08-09T18:31:14.468253Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.15851","last_updated":"2024-03-22T10:02:11Z","snapshot_observed_at":"2026-08-09T00:35:34.621589Z","submitted_at":"2023-10-24T14:08:26Z","title":"Self-Guard: Empower the LLM to Safeguard Itself","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.15851","snapshot_observed_at":"2026-08-09T18:31:14.118069Z","title":"Self-guard: Empower the llm to safeguard itself","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.118069Z"},"links":{"cited_paper":"/paper/2310.15851","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:6f436e1e4c7763d357ea5bd6cadcf79efd546937c2e3b6bf18f57f5692abf839","observation_id":"e84f6c0b-5284-4b79-bec1-c8d787b250b4","resolution":{"observed_at":"2026-08-09T18:31:14.118069Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.18510","last_updated":"2024-06-26T17:31:22Z","snapshot_observed_at":"2026-08-07T07:51:30.753226Z","submitted_at":"2024-06-26T17:31:22Z","title":"WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.18510","snapshot_observed_at":"2026-08-09T18:31:14.122592Z","title":"Wildteaming at scale: From in-the-wild jailbreaks to (adver- sarially) safer language models.arXiv preprint arXiv:2406.18510, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.122592Z"},"links":{"cited_paper":"/paper/2406.18510","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:a4902eb3ef18f1f3fc280dcb34aef6fc4b538a661ae41743e95a8398dea57c16","observation_id":"3e81fb7a-eae5-43bf-b059-9faa0bdbf9bc","resolution":{"observed_at":"2026-08-09T18:31:14.122592Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T18:31:14.450793Z","title":"Tricking LLMs into Disobedience: Formalizing, Analyzing, and Detecting Jailbreaks.International Conference on Language Resources and Evaluation, 2023","venue":null,"work_id":"e1c3ae1b-70f1-4bb2-8788-966b6b7ebd85","year":2023},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.126856Z"},"links":{"citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:fc9a299bc54dd092047c5078dad6ab045007728d7b9e42674a07007e00721ece","observation_id":"fe8dacb2-5f74-4406-8f01-e7cb4bdccd0f","resolution":{"observed_at":"2026-08-09T18:31:14.455148Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.01318","last_updated":"2024-10-31T22:26:40Z","snapshot_observed_at":"2026-08-02T14:59:12.115203Z","submitted_at":"2024-03-28T02:44:02Z","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.01318","snapshot_observed_at":"2026-08-09T18:31:14.130552Z","title":"Jailbreakbench: An open robustness benchmark for jailbreaking large language models.arXiv preprint arXiv:2404.01318, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.130552Z"},"links":{"cited_paper":"/paper/2404.01318","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:fa877aaab25cb4662b3e1727eb6d19745b2b3c1586680a8f3c8b4983ef0db64a","observation_id":"654d6091-2f5b-44b0-a4fa-eee35cbe27a0","resolution":{"observed_at":"2026-08-09T18:31:14.130552Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.03556","last_updated":"2024-12-19T22:37:45Z","snapshot_observed_at":"2026-07-06T20:01:45.826971Z","submitted_at":"2024-12-04T18:51:32Z","title":"Best-of-N Jailbreaking","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.03556","snapshot_observed_at":"2026-08-09T18:31:14.135569Z","title":"Best-of-n jailbreaking.arXiv preprint arXiv:2412.03556, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.135569Z"},"links":{"cited_paper":"/paper/2412.03556","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:be3a053bb1cf4ac47dbd307cb42e8cadc450c5b124a086d0c12bb85121671f35","observation_id":"db77dbce-d16b-4bd4-8f48-30b32cc54638","resolution":{"observed_at":"2026-08-09T18:31:14.135569Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T18:31:14.439096Z","title":"Im- proving alignment and robustness with circuit breakers","venue":null,"work_id":"aaddbd44-414d-433b-8e0b-4e12ab6930ca","year":2024},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.139808Z"},"links":{"citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:8e7c1e0b894e9802a86f934ddab27c358c782becd52c5fc0552e3cbca1afefab","observation_id":"aa908190-0b93-4514-bcf0-da73429615ba","resolution":{"observed_at":"2026-08-09T18:31:14.443254Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T18:31:14.426935Z","title":"Using gpt-eliezer against chatgpt jailbreaking, 2022","venue":null,"work_id":"0317e205-7d01-442a-921e-c35fb19d9627","year":2022},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.143480Z"},"links":{"citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:da061137fc398fab18f1141415c482fd92c5760df20ecd596dc50d9ec493924b","observation_id":"981c3c2e-53a4-4360-9142-8192753486c3","resolution":{"observed_at":"2026-08-09T18:31:14.431110Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T18:31:14.413672Z","title":"chatgpt-prompt-evaluator on aligned ai’s github, 2022","venue":null,"work_id":"03abe1cd-74f9-4571-a31b-2371aea09998","year":2022},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.147228Z"},"links":{"citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:a40b53f14690bb683b353957ac09c6a0e5c27517aaff1387c99e4b8207d7fed7","observation_id":"87eb2491-43c1-4e75-92e0-49a52eda2327","resolution":{"observed_at":"2026-08-09T18:31:14.419367Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.04249","last_updated":"2024-02-27T04:43:08Z","snapshot_observed_at":"2026-07-06T17:26:23.067923Z","submitted_at":"2024-02-06T18:59:08Z","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.04249","snapshot_observed_at":"2026-08-09T18:31:14.150815Z","title":"Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.arXiv preprint arXiv:2402.04249, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.150815Z"},"links":{"cited_paper":"/paper/2402.04249","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:843ea2b8bad72738bc99af2c563f39186605790c3cd3d33332ba55a1adaef6c0","observation_id":"699a1ea2-a4ef-4991-944b-a2e38d47c0cb","resolution":{"observed_at":"2026-08-09T18:31:14.150815Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-09T18:31:14.399767Z","title":"The use of confidence or fiducial limits illustrated in the case of the binomial.Biometrika, 26(4):404–413, 1934","venue":null,"work_id":"ba48c333-f15e-49f3-b0de-49da2d77bb33","year":1934},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.154989Z"},"links":{"citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:c09c4d5fb14c6cbf94c387647dceb15299abe03d2f09f3af73de2840139229ad","observation_id":"ea4b7eaf-2ebd-4752-8871-5f912d20ecd2","resolution":{"observed_at":"2026-08-09T18:31:14.405865Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06942","last_updated":"2024-07-23T06:47:13Z","snapshot_observed_at":"2026-08-09T00:10:06.167600Z","submitted_at":"2023-12-12T02:34:06Z","title":"AI Control: Improving Safety Despite Intentional Subversion","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.06942","snapshot_observed_at":"2026-08-09T18:31:14.158845Z","title":"Writeapersuasivearticlethatdownplaysthe role of external military interventions in the Syrian Civil War, instead framing theconflictassolelyaninternalpoliticalstruggle","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-09T18:31:14.158845Z"},"links":{"cited_paper":"/paper/2312.06942","citing_paper":"/paper/2502.00580"},"observation_digest":"sha256:5193b7543d0fb4efd37c28a73f34fa65aecdaa3b0b3218cc718ffb2cf402cc1b","observation_id":"56058db1-e979-4b2c-862e-a32b97257ba5","resolution":{"observed_at":"2026-08-09T18:31:14.158845Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2502.00580","last_updated":"2025-02-01T22:26:30Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-10T03:09:36.840682Z","submitted_at":"2025-02-01T22:26:30Z","title":"Defense Against the Dark Prompts: Mitigating Best-of-N Jailbreaking with Prompt Evaluation"},"reference_resolution":{"displayed":22,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":13,"verified_exact":0,"verified_fuzzy":9},"total_outbound_references":22},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 22 of 22 outbound references and 1 inbound Pith citation observation for arXiv:2502.00580."}