{"as_of":"2026-08-17T03:15:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:fc0e152abab70658912a71b547d54c7b89f5c682ceca86d26cb8d4db685a47c4","coverage":[{"denominator":83,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":83,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-16T04:34:34.466875Z","state":"measured"},{"denominator":92,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":92,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-16T06:30:59.297886+00:00","state":"measured"},{"denominator":9,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":9,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-15T17:47:19.126970Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-07-04T00:59:21.218293Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-08-07T13:32:46.117270Z","title":"Transferable adversarial attacks on black-box vision-language models.arXiv preprint arXiv:2505.01050, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.21499","last_updated":"2025-05-27T17:59:05Z","snapshot_observed_at":"2026-08-07T13:24:27.400642Z","submitted_at":"2025-05-27T17:59:05Z","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T13:32:46.117270Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2505.21499"},"observation_digest":"sha256:c6940801f8bb505295f64e2ea9d0b2bf674ab88c6830db1e4ceb834f3bbc976e","observation_id":"02d142aa-3a58-466f-8bc4-7634cb758e85","resolution":{"observed_at":"2026-08-07T13:32:46.117270Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-08-15T17:47:19.126970Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.20526","last_updated":"2025-07-28T05:13:04Z","snapshot_observed_at":"2026-08-16T09:52:38.134857Z","submitted_at":"2025-07-28T05:13:04Z","title":"Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-15T17:47:19.126970Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2507.20526"},"observation_digest":"sha256:92564696f8f50cf466955668c154ee19c565a856c883077eb38759295bceb911","observation_id":"083f7259-0d1d-4bde-8eca-180cf529d63e","resolution":{"observed_at":"2026-08-15T17:47:19.126970Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2512.21815","last_updated":"2026-06-29T08:03:34Z","snapshot_observed_at":"2026-08-11T15:48:09.383072Z","submitted_at":"2025-12-26T01:01:25Z","title":"High-Entropy Tokens as Multimodal Failure Points in Vision-Language Models","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-16T19:29:43.382392Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2512.21815"},"observation_digest":"sha256:c8ed2920b18509f2bc54b4c21487ce2bec31f9205ab8ffc538c7d1fc8f95b639","observation_id":"7718ef9e-c485-457e-85e4-0f6bf281c1b3","resolution":{"observed_at":"2026-05-16T19:31:13.089502Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-08-03T14:05:23.148338Z","title":"Trans- ferable adversarial attacks on black-box vision-language models.CoRR, abs/2505.01050, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2512.21815","last_updated":"2026-06-29T08:03:34Z","snapshot_observed_at":"2026-08-11T15:48:09.383072Z","submitted_at":"2025-12-26T01:01:25Z","title":"High-Entropy Tokens as Multimodal Failure Points in Vision-Language Models","version":4},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-03T14:05:23.148338Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2512.21815"},"observation_digest":"sha256:ef15628eda2fd8f217ad632249aec824b2d7d48ca166c2082c80986e0023f14f","observation_id":"b65d8d1c-3f79-4555-8cf8-0ba3c20b67c9","resolution":{"observed_at":"2026-08-03T14:05:23.148338Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2601.23179","last_updated":"2026-04-20T06:15:25Z","snapshot_observed_at":"2026-08-09T08:54:54.090902Z","submitted_at":"2026-01-30T17:03:24Z","title":"Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimization","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-16T09:26:14.799360Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2601.23179"},"observation_digest":"sha256:4a1b18d7dc57d8e8efe85dad2aff47db5b6b7ea011ca9dfbeb3ff7f126e9d312","observation_id":"2385f503-96eb-40c1-99f4-b7e947b121da","resolution":{"observed_at":"2026-05-16T09:27:40.991023Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2605.04261","last_updated":"2026-05-05T19:55:28Z","snapshot_observed_at":"2026-08-15T04:06:36.021932Z","submitted_at":"2026-05-05T19:55:28Z","title":"Laundering AI Authority with Adversarial Examples","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-08T17:19:38.662062Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2605.04261"},"observation_digest":"sha256:7c2d73a3c3b181b904b0ebcfb83145854b23fc1a2abf47c461475b9fe3d0b9aa","observation_id":"367a0044-35ea-4727-84dd-85f327c10403","resolution":{"observed_at":"2026-05-11T17:41:08.067046Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2605.21541","last_updated":"2026-05-20T08:15:56Z","snapshot_observed_at":"2026-08-15T04:04:22.013485Z","submitted_at":"2026-05-20T08:15:56Z","title":"Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMs","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-22T01:25:06.528845Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2605.21541"},"observation_digest":"sha256:965ac40c09e2732b368c0132520dbdbf49602f750d496f8d55e52a7b051a1bbd","observation_id":"3f59c936-afc0-45cb-8666-d687fe540a52","resolution":{"observed_at":"2026-05-22T01:25:52.636726Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2606.18710","last_updated":"2026-06-17T05:51:14Z","snapshot_observed_at":"2026-08-14T06:38:04.767925Z","submitted_at":"2026-06-17T05:51:14Z","title":"Image Prompt Reconstruction Attacks on Distributed MLLM Inference Frameworks","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-06-26T20:44:41.268975Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2606.18710"},"observation_digest":"sha256:4b69a4e3cca6eb0384cafd0a290f6fdcd2f37b207ab83d30a4d2d92849f7eea9","observation_id":"c377a7fd-f605-4322-af3d-26b9ebffd054","resolution":{"observed_at":"2026-07-04T00:59:21.220186Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"cited_work":{"arxiv_id":"2505.01050","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.01050","snapshot_observed_at":"2026-07-04T00:59:21.218293Z","title":"Transferable adversarial attacks on black-box vision-language models","venue":null,"work_id":"a84f879b-db4f-4c45-a73b-a74ef5862be5","year":2025},"citing_paper":{"arxiv_id":"2607.00174","last_updated":"2026-06-30T20:47:35Z","snapshot_observed_at":"2026-08-13T04:37:49.821515Z","submitted_at":"2026-06-30T20:47:35Z","title":"Steal the Patch Size: Adversarially Manipulate Vision-Language Models","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-07-02T19:30:19.691473Z"},"links":{"cited_paper":"/paper/2505.01050","citing_paper":"/paper/2607.00174"},"observation_digest":"sha256:72a19bfe2a7027c6e941e648cfd40829ede870e077ab9d6a5d5ddbfa0a970cd3","observation_id":"4a2d34d4-02f9-4e9a-ac19-5bab80e8a762","resolution":{"observed_at":"2026-07-02T19:37:18.466063Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2505.01050/citation-record","integrity":"/paper/2505.01050/integrity","json":"/paper/2505.01050/citation-record.json","paper":"/paper/2505.01050"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.160872Z","title":"write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.160872Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:05b364a99e17856b0e253affe7da546d4bf9797927c6c2121e63a8a0605d91ae","observation_id":"ee7b22f6-444c-4832-878a-abc3ddd21edb","resolution":{"observed_at":"2026-08-16T04:34:34.160872Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-16T19:40:28.523700Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-16T04:34:34.165708Z","title":"Gpt-4 technical report","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.165708Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:ac174f20442b235f6f56cd35180674ef88bb1feb76038b9ce49d1b0ce201a978","observation_id":"c1f9d0ad-3eae-4627-81c5-c258e9542356","resolution":{"observed_at":"2026-08-16T04:34:34.165708Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.169725Z","title":"Llama 3 model card","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.169725Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:2882507249578793acb0dc26bf4f0f0d82921dc8841bdfbee83fb8ffc5f17778","observation_id":"e8e6b134-43b6-48e7-b94d-596091a31889","resolution":{"observed_at":"2026-08-16T04:34:34.169725Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.02151","last_updated":"2025-04-17T18:55:45Z","snapshot_observed_at":"2026-08-16T14:04:12.947538Z","submitted_at":"2024-04-02T17:58:27Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02151","snapshot_observed_at":"2026-08-16T04:34:34.173226Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.173226Z"},"links":{"cited_paper":"/paper/2404.02151","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:1273e8fb7df9246129bb1583bcbb5d097323c466a6264491ea56138a7b3aa29f","observation_id":"9130abb0-0457-4875-8965-f7b8d118eda3","resolution":{"observed_at":"2026-08-16T04:34:34.173226Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.177020Z","title":"Model card and evaluations for claude models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.177020Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:d11f3f6036d2ffe073b4c5b863344e61399d1ed25a077bf9558a1bfc72015fe9","observation_id":"26b926a3-bd56-4dc1-81ca-fba99ae45735","resolution":{"observed_at":"2026-08-16T04:34:34.177020Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.330600Z","title":"The claude 3 model family: Opus, sonnet, haiku","venue":null,"work_id":"b73bf4c1-ef13-46c2-b0ea-99dc54effa48","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.180461Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:775946b37ff327980ba008596092db52b64901f5d1a4eeadf055ae30126caba7","observation_id":"e6f7accd-9ed6-4bf5-90e0-d438fec113c9","resolution":{"observed_at":"2026-08-16T04:34:35.334246Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.13923","last_updated":"2025-02-19T18:00:14Z","snapshot_observed_at":"2026-08-14T04:17:22.593941Z","submitted_at":"2025-02-19T18:00:14Z","title":"Qwen2.5-VL Technical Report","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.13923","snapshot_observed_at":"2026-08-16T04:34:34.183861Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.183861Z"},"links":{"cited_paper":"/paper/2502.13923","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:7cac24cf36e07bf3bb29e2c2e6a15ae830b77a877c05c4935d1185ace15d233f","observation_id":"51845fca-6eda-4c25-aa77-cae82fd698f9","resolution":{"observed_at":"2026-08-16T04:34:34.183861Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00236","last_updated":"2024-09-17T19:56:09Z","snapshot_observed_at":"2026-08-16T15:04:07.280896Z","submitted_at":"2023-09-01T03:53:40Z","title":"Image Hijacks: Adversarial Images can Control Generative Models at Runtime","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00236","snapshot_observed_at":"2026-08-16T04:34:34.187704Z","title":"Image hijacks: Adversarial images can control generative models at runtime","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.187704Z"},"links":{"cited_paper":"/paper/2309.00236","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:13f2990a7036ba6f3726bf5cde786a7a6fa7bd640f207452947c5bf35a863184","observation_id":"836fd2c4-9d7f-40e5-b3d4-6ada7dcd91ce","resolution":{"observed_at":"2026-08-16T04:34:34.187704Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.320050Z","title":"Evasion attacks against machine learning at test time","venue":null,"work_id":"46a99aad-f003-4cbe-8eb4-34671014de0e","year":2013},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.191197Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:a1edd3c00d83473abf599f814716ac304cfad7d71d72fb17e8bb29ecc10a209a","observation_id":"4e74ba98-fd9a-46b4-bb3e-5d9664275554","resolution":{"observed_at":"2026-08-16T04:34:35.323690Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15818","last_updated":"2023-07-28T21:18:02Z","snapshot_observed_at":"2026-08-02T16:17:50.621617Z","submitted_at":"2023-07-28T21:18:02Z","title":"RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Control","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15818","snapshot_observed_at":"2026-08-16T04:34:34.194529Z","title":"Rt-2: Vision-language-action models transfer web knowledge to robotic control","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.194529Z"},"links":{"cited_paper":"/paper/2307.15818","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:510bd8e6843a731bae7e5dddff522a92ac19bf980c9c26f7e73f4f390d91c920","observation_id":"39791491-56bc-4bf0-8687-8010b191d4a8","resolution":{"observed_at":"2026-08-16T04:34:34.194529Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.309403Z","title":"Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36, 2023","venue":null,"work_id":"cdc16dbf-d859-4cb1-a6d2-7e4045a8a7a9","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.198028Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:a8b41d373a17509596a304e77a423f2c5850c62b579ef43eca730474c4a961e7","observation_id":"232eb64f-ff7b-4d68-9b15-2d61f3da3c31","resolution":{"observed_at":"2026-08-16T04:34:35.313026Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-08-16T13:08:51.920120Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-16T04:34:34.201186Z","title":"Pappas, and Eric Wong","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.201186Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:2059e4efb4118db7c539f315a2a4422063b6935c0d588e53118cbb522643320b","observation_id":"1ca1d42d-810c-4d58-91f2-90a79f8a560d","resolution":{"observed_at":"2026-08-16T04:34:34.201186Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.09105","last_updated":"2024-03-04T11:30:06Z","snapshot_observed_at":"2026-08-16T15:47:47.661031Z","submitted_at":"2023-03-16T06:37:16Z","title":"Rethinking Model Ensemble in Transfer-based Adversarial Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.09105","snapshot_observed_at":"2026-08-16T04:34:34.204316Z","title":"Rethinking model ensemble in transfer-based adversarial attacks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.204316Z"},"links":{"cited_paper":"/paper/2303.09105","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:de334e3cf3476aa6c949d1f3bb4ef02e2683530d4966bfdab73a21ac870f9a07","observation_id":"807f4dd1-4a16-4aae-ad71-fb07a707204f","resolution":{"observed_at":"2026-08-16T04:34:34.204316Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.03411","last_updated":"2024-12-15T20:50:51Z","snapshot_observed_at":"2026-08-16T14:03:39.515956Z","submitted_at":"2024-04-04T12:38:14Z","title":"Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.03411","snapshot_observed_at":"2026-08-16T04:34:34.207424Z","title":"Red teaming gpt-4v: Are gpt-4v safe against uni/multi-modal jailbreak attacks?, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.207424Z"},"links":{"cited_paper":"/paper/2404.03411","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:665a5ac4859cbf3488e730523264a393e1a4a7c776ee1651d997083554316153","observation_id":"9426dbcb-d891-4347-82ca-93130fa736ae","resolution":{"observed_at":"2026-08-16T04:34:34.207424Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.200987Z","title":"Certified adversarial robustness via randomized smoothing","venue":null,"work_id":"b3980a86-214b-4666-8685-a08ba5c10bef","year":2019},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.210767Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:8645980a794cb35c7c72e0a44b51e48f4ce8a7afd4e8904f3348deaa391fd582","observation_id":"d3ecb44a-bc7b-408e-8fa1-50e26bffde9f","resolution":{"observed_at":"2026-08-16T04:34:35.302101Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.16588","last_updated":"2024-04-12T09:38:33Z","snapshot_observed_at":"2026-08-07T09:40:32.614733Z","submitted_at":"2023-09-28T16:45:46Z","title":"Vision Transformers Need Registers","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.16588","snapshot_observed_at":"2026-08-16T04:34:34.214741Z","title":"Vision transformers need registers","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.214741Z"},"links":{"cited_paper":"/paper/2309.16588","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:7534cbe268fc9e2493db5dcaab48d66bff36c3f4c66b7887bb03afb78708dd2a","observation_id":"a52e39a9-b6c0-42c4-ba6e-9bbd402ddff1","resolution":{"observed_at":"2026-08-16T04:34:34.214741Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.190998Z","title":"Paddleocr: An easy-to-use ocr tool based on paddlepaddle","venue":null,"work_id":"feeb1b73-027e-4539-b6b5-1821f1471727","year":2025},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.218313Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:768687ebd4826bf70da01e678129a395a9f31914b1fc3dbe6de9d367e94dcc3b","observation_id":"50de2276-79c0-4cee-ab66-7476e8d7afae","resolution":{"observed_at":"2026-08-16T04:34:35.194540Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.11751","last_updated":"2023-10-14T12:56:13Z","snapshot_observed_at":"2026-08-16T14:58:55.951885Z","submitted_at":"2023-09-21T03:24:30Z","title":"How Robust is Google's Bard to Adversarial Image Attacks?","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.11751","snapshot_observed_at":"2026-08-16T04:34:34.222225Z","title":"How robust is google's bard to adversarial image attacks? arXiv preprint arXiv:2309.11751, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.222225Z"},"links":{"cited_paper":"/paper/2309.11751","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:b40d620585c92bdc63112cc02f3949a95ef669eab060f1236fbdc727365372ba","observation_id":"7ca23396-7e39-4883-8729-a54a7e1a16fe","resolution":{"observed_at":"2026-08-16T04:34:34.222225Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.181022Z","title":"Large language models in radiology: fundamentals, applications, ethical considerations, risks, and future directions","venue":null,"work_id":"f1e429c3-560a-498e-b9c0-5de90b25a12e","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.226222Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:10e0a06b3de856f1077f06a7b2265ab4b0b29ac313c61c5b9712d23afc47685c","observation_id":"f1c10498-814c-4243-abb0-4f67ac295e5e","resolution":{"observed_at":"2026-08-16T04:34:35.184607Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.229543Z","title":"Robust physical-world attacks on deep learning visual classification","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.229543Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:443aca751a958c90930f5a4bbb3778a4811923166ce720aff32be13c833cd3c8","observation_id":"da38a1d0-1415-4c07-aca8-e13158d5c825","resolution":{"observed_at":"2026-08-16T04:34:34.229543Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.17425","last_updated":"2023-11-06T02:47:51Z","snapshot_observed_at":"2026-08-16T14:56:25.720519Z","submitted_at":"2023-09-29T17:37:29Z","title":"Data Filtering Networks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.17425","snapshot_observed_at":"2026-08-16T04:34:34.232849Z","title":"Data filtering networks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.232849Z"},"links":{"cited_paper":"/paper/2309.17425","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:45608793c9ab587b43bbfcb1eeb0a4cf86c9a3421abfcebd8ccc5fe5fdc4c981","observation_id":"c917b5d7-14cd-4058-acf7-ac06200894c6","resolution":{"observed_at":"2026-08-16T04:34:34.232849Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2010.01412","last_updated":"2021-04-29T16:44:25Z","snapshot_observed_at":"2026-08-15T12:34:14.131778Z","submitted_at":"2020-10-03T19:02:10Z","title":"Sharpness-Aware Minimization for Efficiently Improving Generalization","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2010.01412","snapshot_observed_at":"2026-08-16T04:34:34.236251Z","title":"Sharpness-aware minimization for efficiently improving generalization","venue":null,"work_id":null,"year":2010},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.236251Z"},"links":{"cited_paper":"/paper/2010.01412","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:f7be1b71af78347f73d82b9367f45988fc7456dcef7aff5a547b1d4986357a9f","observation_id":"7048848a-7e78-4c27-bd35-59cfc9c775cf","resolution":{"observed_at":"2026-08-16T04:34:34.236251Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.239756Z","title":"Multimodal neurons in artificial neural networks","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.239756Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:776b0bfce378e6788eb542d80eb157987f7ab6f7340972355290a666b8357125","observation_id":"baeb416b-e12e-4682-99b0-3df4979f8d64","resolution":{"observed_at":"2026-08-16T04:34:34.239756Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.243186Z","title":"Goodfellow, Jonathon Shlens, and Christian Szegedy","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.243186Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:dca428697b381848b6dfdb65c60a39439c31cab74b2e0dfb06c4ff2c4bc43e73","observation_id":"edf5d497-06fc-4a0f-aa12-a64ea4280b78","resolution":{"observed_at":"2026-08-16T04:34:34.243186Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.153093Z","title":"Regulating chatgpt and other large generative ai models","venue":null,"work_id":"3bc8fdd6-9891-4ddc-9f0d-1940bf77daea","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.247003Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:d9f605aa8221b8adec4099f183d3e26a19a5a99c7469d6178f2703902fd1be40","observation_id":"aecff6d5-dc7e-406e-85fa-25e26479f794","resolution":{"observed_at":"2026-08-16T04:34:35.156584Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.250782Z","title":"Deep residual learning for image recognition","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.250782Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:64e2127a38f14159043a0afd6ee2dc523e3d60a670d7819fe1bf7f4beee24c6f","observation_id":"e246c911-ba7e-4294-9dd0-eac34feaeae7","resolution":{"observed_at":"2026-08-16T04:34:34.250782Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.136374Z","title":"Deep networks with stochastic depth","venue":null,"work_id":"c4660cd2-724e-4c0d-b51d-a83e2365d813","year":2016},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.253970Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:76a1eee951e0a66f02728f1bedd22495cd9b6fbf4f4ea7e701a5dc48fe2e5093","observation_id":"9f14c6a3-d17a-479d-9f35-df75d17c215e","resolution":{"observed_at":"2026-08-16T04:34:35.140252Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.257743Z","title":"Densely connected convolutional networks","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.257743Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:cfb94ece20a176041e8e5bcd5cdc13492199089f4e7575bd2f5b91328e91ce76","observation_id":"cd3aeb0a-9296-4bee-a9e1-a04458abb6d5","resolution":{"observed_at":"2026-08-16T04:34:34.257743Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1803.05407","last_updated":"2019-02-25T14:18:11Z","snapshot_observed_at":"2026-08-14T19:36:09.254749Z","submitted_at":"2018-03-14T17:09:27Z","title":"Averaging Weights Leads to Wider Optima and Better Generalization","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1803.05407","snapshot_observed_at":"2026-08-16T04:34:34.261402Z","title":"Averaging weights leads to wider optima and better generalization","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.261402Z"},"links":{"cited_paper":"/paper/1803.05407","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:f5e310bb615f65ab701791a57c01a1e5e34e6ff3573130d900aba96f7a5ab6b5","observation_id":"cbe52011-36f5-4a70-9efc-7a6331ddbfb2","resolution":{"observed_at":"2026-08-16T04:34:34.261402Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-16T04:34:34.264833Z","title":"Baseline defenses for adversarial attacks against aligned language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.264833Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:1b9c585a4e7096563ea154e4965a319a80ebab839293be1c563f4b14b43beb37","observation_id":"1b224d41-e382-4346-9245-fc29747c201a","resolution":{"observed_at":"2026-08-16T04:34:34.264833Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2004.10190","last_updated":"2020-07-31T13:43:53Z","snapshot_observed_at":"2026-08-17T00:06:04.512571Z","submitted_at":"2020-04-21T17:57:04Z","title":"Never Stop Learning: The Effectiveness of Fine-Tuning in Robotic Reinforcement Learning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2004.10190","snapshot_observed_at":"2026-08-16T04:34:34.268065Z","title":"Never stop learning: The effectiveness of fine-tuning in robotic reinforcement learning","venue":null,"work_id":null,"year":2004},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.268065Z"},"links":{"cited_paper":"/paper/2004.10190","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:af8d93cb87020e264834b8b8584e05ea31af4b8d698a575056c73a2db171c19c","observation_id":"3655163f-0bf5-429b-8b3a-382f9c8e6832","resolution":{"observed_at":"2026-08-16T04:34:34.268065Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.119275Z","title":"Adversarial attacks and defences competition","venue":null,"work_id":"0dbb0fe5-aedf-4afd-b9ba-d33153efa1e3","year":2018},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.271617Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:dc5585d4b7618db09d929aa84fc49aabad29d920d07a46e58d5ff7af4f576fc4","observation_id":"2871704e-3301-4862-ad25-a614fd5e33e4","resolution":{"observed_at":"2026-08-16T04:34:35.123434Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.108240Z","title":"Building and better understanding vision-language models: insights and future directions","venue":null,"work_id":"ba4d9ee6-1839-4433-9e3a-75cc40c5f9a0","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.274647Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:083d602fcfdd1dca2458ad8ef07cba2148ae19a306cf93dcdeefa9af3a7fa120","observation_id":"4312c81d-cf67-4f78-941b-c871117676aa","resolution":{"observed_at":"2026-08-16T04:34:35.111904Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.07895","last_updated":"2024-07-28T19:58:08Z","snapshot_observed_at":"2026-08-13T00:09:23.835117Z","submitted_at":"2024-07-10T17:59:43Z","title":"LLaVA-NeXT-Interleave: Tackling Multi-image, Video, and 3D in Large Multimodal Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.07895","snapshot_observed_at":"2026-08-16T04:34:34.278320Z","title":"Llava-next-interleave: Tackling multi-image, video, and 3d in large multimodal models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.278320Z"},"links":{"cited_paper":"/paper/2407.07895","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:694c05653f92ada55af1fd593f13ebb101a0d7cff833cb901d90ee65584c74a2","observation_id":"9cc1f752-8afe-4863-b58a-5f4a0ff6ad60","resolution":{"observed_at":"2026-08-16T04:34:34.278320Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-08-16T13:23:25.577041Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-16T04:34:34.281806Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.281806Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:d2565efde38d6f2f9c77e651dfb9bed0d9f40c8b1196a68230d39498e96b7bd8","observation_id":"9aa46f9c-67aa-45d8-85ed-081b9373d979","resolution":{"observed_at":"2026-08-16T04:34:34.281806Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.15658","last_updated":"2023-06-27T17:51:06Z","snapshot_observed_at":"2026-08-16T15:20:39.273734Z","submitted_at":"2023-06-27T17:51:06Z","title":"CLIPA-v2: Scaling CLIP Training with 81.1% Zero-shot ImageNet Accuracy within a \\$10,000 Budget; An Extra \\$4,000 Unlocks 81.8% Accuracy","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.15658","snapshot_observed_at":"2026-08-16T04:34:34.285319Z","title":"Clipa-v2: Scaling clip training with 81.1 accuracy within a 10,000 budget; an extra 4,000 unlocks 81.8 arXiv preprint arXiv:2306.15658, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.285319Z"},"links":{"cited_paper":"/paper/2306.15658","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:5c61453127997c8327569328bf8b05e49bcb59fd659f5ba25e52515cf7f45143","observation_id":"1eb14972-568b-4528-8915-f112ab047e13","resolution":{"observed_at":"2026-08-16T04:34:34.285319Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.288730Z","title":"Microsoft coco: Common objects in context","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.288730Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:32c11ffa5a30d1ddbdca4efeddc119f619d4c413fb4af40e6e2b578e5d718752","observation_id":"d5de2046-b404-4555-98cb-c10e2f1e9d27","resolution":{"observed_at":"2026-08-16T04:34:34.288730Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.292579Z","title":"Visual instruction tuning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.292579Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:8632c498e075b4145e68e4b84c74a6a2cf2ecb5072764dcd0fd21f89b16deb18","observation_id":"9252b662-3bce-4a33-b020-cdf5d0e2d9cf","resolution":{"observed_at":"2026-08-16T04:34:34.292579Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-16T14:36:14.029419Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-16T04:34:34.296596Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models, 2024 b","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.296596Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:72e8251c15748f8130c95484d61a9cf930e358d7aa3d5c564df77c8030ced640","observation_id":"80a0dc0b-8f2e-43e9-9603-5a92ea86eda5","resolution":{"observed_at":"2026-08-16T04:34:34.296596Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1611.02770","last_updated":"2017-02-07T14:24:44Z","snapshot_observed_at":"2026-08-14T21:31:19.477872Z","submitted_at":"2016-11-08T23:25:00Z","title":"Delving into Transferable Adversarial Examples and Black-box Attacks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1611.02770","snapshot_observed_at":"2026-08-16T04:34:34.300807Z","title":"Delving into transferable adversarial examples and black-box attacks","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.300807Z"},"links":{"cited_paper":"/paper/1611.02770","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:12bc90eb2064b131bc6f641c085b133fbefaf5ba87fdad7f47edce0d40bd570c","observation_id":"481d7042-6bb0-4912-8d02-81dac63c5978","resolution":{"observed_at":"2026-08-16T04:34:34.300807Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.086013Z","title":"Patchdropout: Economizing vision transformers using patch dropout","venue":null,"work_id":"21eaa8b1-c0b8-4ebb-a64a-d2f128ab994f","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.304830Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:f61ef5192bd7c6aba32bb469ed9775af4d8571fd987c499e791c7ff45ac43d30","observation_id":"27af11fa-8c4d-498b-811b-0c7b81a84cdd","resolution":{"observed_at":"2026-08-16T04:34:35.089645Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.12931","last_updated":"2024-04-30T21:35:53Z","snapshot_observed_at":"2026-08-02T10:40:03.816188Z","submitted_at":"2023-10-19T17:31:01Z","title":"Eureka: Human-Level Reward Design via Coding Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.12931","snapshot_observed_at":"2026-08-16T04:34:34.309778Z","title":"Eureka: Human-level reward design via coding large language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.309778Z"},"links":{"cited_paper":"/paper/2310.12931","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:dfcd107e23a83cd126eb19dd03199646d6855e404caf677197f13d95bbffc5ed","observation_id":"11573e70-cf04-4886-be86-0cdff54478d7","resolution":{"observed_at":"2026-08-16T04:34:34.309778Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.00438","last_updated":"2023-12-01T09:10:33Z","snapshot_observed_at":"2026-08-16T14:38:32.813265Z","submitted_at":"2023-12-01T09:10:33Z","title":"Dolphins: Multimodal Language Model for Driving","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.00438","snapshot_observed_at":"2026-08-16T04:34:34.313636Z","title":"Dolphins: Multimodal language model for driving","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.313636Z"},"links":{"cited_paper":"/paper/2312.00438","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:0f4e7a06a9fafcec0fa885258eb33e91e3c7ce3f570be9db7753f7aa2420ed14","observation_id":"68622cfc-ae15-4c87-9263-e6bd30a6981e","resolution":{"observed_at":"2026-08-16T04:34:34.313636Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1706.06083","last_updated":"2019-09-04T18:53:10Z","snapshot_observed_at":"2026-08-07T14:27:46.872660Z","submitted_at":"2017-06-19T17:53:11Z","title":"Towards Deep Learning Models Resistant to Adversarial Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1706.06083","snapshot_observed_at":"2026-08-16T04:34:34.317179Z","title":"Towards deep learning models resistant to adversarial attacks","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.317179Z"},"links":{"cited_paper":"/paper/1706.06083","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:28338daf43770dde662d13bf389345cabb39312263c8acf6bdc748e2028e4ffd","observation_id":"d49c94cf-a37c-4eab-ad42-605e4f34c7d5","resolution":{"observed_at":"2026-08-16T04:34:34.317179Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.07016","last_updated":"2023-04-21T17:08:27Z","snapshot_observed_at":"2026-08-16T16:08:49.584396Z","submitted_at":"2022-12-14T04:08:56Z","title":"Understanding Zero-Shot Adversarial Robustness for Large-Scale Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.07016","snapshot_observed_at":"2026-08-16T04:34:34.321269Z","title":"Understanding zero-shot adversarial robustness for large-scale models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.321269Z"},"links":{"cited_paper":"/paper/2212.07016","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:52e031cc89cf67069f436b643f3856bb9645326921b6f1fb453554bbef0256a3","observation_id":"c25168d4-a740-44fa-afbd-38e34691dd90","resolution":{"observed_at":"2026-08-16T04:34:34.321269Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.324838Z","title":"Harmbench: A standardized evaluation framework for automated red teaming and robust refusal, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.324838Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:0823c3aef751c348631604d43367f04bc962a286129b035fce62a560c8933dca","observation_id":"aaac4266-6e2e-4a63-81a3-a2c5efbe9873","resolution":{"observed_at":"2026-08-16T04:34:34.324838Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.17035","last_updated":"2023-11-28T18:47:03Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-11-28T18:47:03Z","title":"Scalable Extraction of Training Data from (Production) Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.17035","snapshot_observed_at":"2026-08-16T04:34:34.328770Z","title":"Scalable extraction of training data from (production) language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.328770Z"},"links":{"cited_paper":"/paper/2311.17035","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:28e7f33132c83553272ae0a0b53fa7caeac3024f956bfa6a88d3437b164ec951","observation_id":"e690f6c5-0185-41da-a841-e90c7a6c9afc","resolution":{"observed_at":"2026-08-16T04:34:34.328770Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.068525Z","title":"Jailbreaking attack against multimodal large language model, 2024","venue":null,"work_id":"cf446817-4ab2-4c29-9371-5068cc5ee5eb","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.332699Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:bc41dd87a5c4d451f6101be835b3595cdbfd008136df8eb27c3e7312fea3fc93","observation_id":"fbc5b27a-69e5-4e4a-8941-14352182ff0f","resolution":{"observed_at":"2026-08-16T04:34:35.072486Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2103.10480","last_updated":"2021-03-18T18:56:51Z","snapshot_observed_at":"2026-08-16T18:37:54.226322Z","submitted_at":"2021-03-18T18:56:51Z","title":"Reading Isn't Believing: Adversarial Attacks On Multi-Modal Neurons","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2103.10480","snapshot_observed_at":"2026-08-16T04:34:34.336232Z","title":"Noever and Samantha E","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.336232Z"},"links":{"cited_paper":"/paper/2103.10480","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:0caeef3d1ed5d270ad302697b3c64ca7b591e0ad9ea755acd36aea55d611f3c5","observation_id":"6e009c27-e2dd-4a1a-b694-386043d21d7a","resolution":{"observed_at":"2026-08-16T04:34:34.336232Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.057449Z","title":"Gpt-4v(ision) system card","venue":null,"work_id":"6b0eb00d-545a-45df-b555-50363c921400","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":50,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.340244Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:6c17ffbdccd8e29a3d951aec684faee7ffff00bc31a54c95ca5fab8ba95da236","observation_id":"397a5291-2ca0-459b-b322-721411ef9bf7","resolution":{"observed_at":"2026-08-16T04:34:35.061079Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2304.07193","last_updated":"2024-02-02T10:24:09Z","snapshot_observed_at":"2026-08-11T10:12:11.384939Z","submitted_at":"2023-04-14T15:12:19Z","title":"DINOv2: Learning Robust Visual Features without Supervision","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.07193","snapshot_observed_at":"2026-08-16T04:34:34.343572Z","title":"Dinov2: Learning robust visual features without supervision","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.343572Z"},"links":{"cited_paper":"/paper/2304.07193","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:d4d5724da20ea83ea1378a7da19ac2fd807cba079ff3c988b7bc411f0e015f67","observation_id":"e452ad34-7705-449e-8ce0-ad8e39aecbe7","resolution":{"observed_at":"2026-08-16T04:34:34.343572Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.347345Z","title":"Training language models to follow instructions with human feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.347345Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:bc9aac1ca7f31e06ff36c5b7601de5e3414d6addf84c76f648f766466d2f833e","observation_id":"31917675-06f1-4ff2-a576-5f522215132b","resolution":{"observed_at":"2026-08-16T04:34:34.347345Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1605.07277","last_updated":"2016-05-24T03:27:48Z","snapshot_observed_at":"2026-08-15T19:47:29.283675Z","submitted_at":"2016-05-24T03:27:48Z","title":"Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1605.07277","snapshot_observed_at":"2026-08-16T04:34:34.351555Z","title":"Transferability in machine learning: from phenomena to black-box attacks using adversarial samples","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":53,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.351555Z"},"links":{"cited_paper":"/paper/1605.07277","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:4919a8d96b1338f018471d04621754b3b42493aeb0bc580e7c2b5c2282ceda33","observation_id":"d3b099a6-3c9b-46a5-95f6-3d137a42650a","resolution":{"observed_at":"2026-08-16T04:34:34.351555Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2202.03286","last_updated":"2022-02-07T15:22:17Z","snapshot_observed_at":"2026-08-15T19:46:54.909325Z","submitted_at":"2022-02-07T15:22:17Z","title":"Red Teaming Language Models with Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.03286","snapshot_observed_at":"2026-08-16T04:34:34.355320Z","title":"Red teaming language models with language models, 2022","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.355320Z"},"links":{"cited_paper":"/paper/2202.03286","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:623db5292eb631c8b74530832d3765e293590a7b3edfe202289b7a476784172e","observation_id":"7294eb77-a106-4f77-961d-072e8f5abf85","resolution":{"observed_at":"2026-08-16T04:34:34.355320Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.13213","last_updated":"2023-08-16T22:38:55Z","snapshot_observed_at":"2026-08-16T15:21:48.065276Z","submitted_at":"2023-06-22T22:13:03Z","title":"Visual Adversarial Examples Jailbreak Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.13213","snapshot_observed_at":"2026-08-16T04:34:34.359095Z","title":"Visual adversarial examples jailbreak aligned large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.359095Z"},"links":{"cited_paper":"/paper/2306.13213","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:88eb1c5931e1ad0c19441df0b5d713b89282ba2f54d13281002b8b055d19714e","observation_id":"11478142-a000-4211-a3b5-edf8ed4033c9","resolution":{"observed_at":"2026-08-16T04:34:34.359095Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.040793Z","title":"Visual adversarial examples jailbreak aligned large language models","venue":null,"work_id":"486de758-9727-4637-bd1e-e81086492e49","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.362562Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:d61ce9b534f971a54bbfe57ffbfd6f48caeceda445879b55dac394e2e4ffcd56","observation_id":"9ddc675e-172b-404b-95bb-de48503a1681","resolution":{"observed_at":"2026-08-16T04:34:35.044476Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.365888Z","title":"Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.365888Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:0c7a0049aebea622d9a32844bb37ebb478d65e98f0c9d78bbdc50dc9f7635f4d","observation_id":"0d2ef145-9649-4d72-a572-8f2af5b54c4a","resolution":{"observed_at":"2026-08-16T04:34:34.365888Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.023849Z","title":"Differentiable jpeg: The devil is in the details","venue":null,"work_id":"731c1cc9-5f6a-4e00-b2dd-a3c5b8b604a7","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.369398Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:2fb1d003d99678cd5bdf94d93d1d40058e3c32f45c34fe2af0c9fa10a69dbd4d","observation_id":"d88ab7dc-704e-43c5-aa28-716ad2bb366d","resolution":{"observed_at":"2026-08-16T04:34:35.027475Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.05530","last_updated":"2024-12-16T17:39:39Z","snapshot_observed_at":"2026-08-14T18:15:53.516440Z","submitted_at":"2024-03-08T18:54:20Z","title":"Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.05530","snapshot_observed_at":"2026-08-16T04:34:34.372863Z","title":"Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.372863Z"},"links":{"cited_paper":"/paper/2403.05530","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:bd37b93a81bcbe7d2bf373aadb93e59ccbcd563e4ad6c79336922c4f4eecef3c","observation_id":"f9f122a6-6ec2-4f5c-a5e3-0f689f4716c7","resolution":{"observed_at":"2026-08-16T04:34:34.372863Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03684","last_updated":"2024-06-11T19:02:52Z","snapshot_observed_at":"2026-07-06T16:28:22.350574Z","submitted_at":"2023-10-05T17:01:53Z","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03684","snapshot_observed_at":"2026-08-16T04:34:34.376170Z","title":"Smoothllm: Defending large language models against jailbreaking attacks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":60,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.376170Z"},"links":{"cited_paper":"/paper/2310.03684","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:f011d04691173f138140fc856add864e9cc79dbec9948411ed41a18251b7969c","observation_id":"97df4209-91f5-40e2-9329-a443e7ea1f3c","resolution":{"observed_at":"2026-08-16T04:34:34.376170Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.01833","last_updated":"2025-02-26T13:41:41Z","snapshot_observed_at":"2026-08-13T05:33:18.631487Z","submitted_at":"2024-04-02T10:45:49Z","title":"Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.01833","snapshot_observed_at":"2026-08-16T04:34:34.379800Z","title":"Great, now write an article about that: The crescendo multi-turn llm jailbreak attack","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":61,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.379800Z"},"links":{"cited_paper":"/paper/2404.01833","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:60d9d3e1fb2c3c10cfbb42fcfc8411e4937719abc2fb2fd1b6a28d82703a1d65","observation_id":"3a2f6f71-4c12-4d2e-a8fe-04fb90316f91","resolution":{"observed_at":"2026-08-16T04:34:34.379800Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:35.012910Z","title":"On the adversarial robustness of multi-modal foundation models, 2023","venue":null,"work_id":"c3be60f6-ce51-418d-bcdf-f41452463b54","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":62,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.383530Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:cc8dd1de0bc67d36888281c67cd29f1447d2ef3bfdfb689faeba5e6a97e0c973","observation_id":"ca1f1b1f-c6fe-44f6-830f-d534fcc3d422","resolution":{"observed_at":"2026-08-16T04:34:35.016635Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2010.15980","last_updated":"2020-11-07T05:33:35Z","snapshot_observed_at":"2026-08-16T19:09:26.533311Z","submitted_at":"2020-10-29T22:54:00Z","title":"AutoPrompt: Eliciting Knowledge from Language Models with Automatically Generated Prompts","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2010.15980","snapshot_observed_at":"2026-08-16T04:34:34.386874Z","title":"Logan IV au2, Eric Wallace, and Sameer Singh","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":63,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.386874Z"},"links":{"cited_paper":"/paper/2010.15980","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:d460573de9a5a22c367aee9dca74d6c4c92491250a164bdcddb2ea60a72a5579","observation_id":"cc0a9220-ecc6-4d3c-84af-29d5a1aa0ca9","resolution":{"observed_at":"2026-08-16T04:34:34.386874Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.390469Z","title":"Large language models encode clinical knowledge","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":64,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.390469Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:234aea5d50e688bc1788938ccd8e618d49975847edc5668f86b91460fcf24af7","observation_id":"f70b5db4-965e-4f5b-93bf-2b3238c6176b","resolution":{"observed_at":"2026-08-16T04:34:34.390469Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.995587Z","title":"Intriguing properties of neural networks","venue":null,"work_id":"2f616a3a-cc7e-4672-b548-bf75a75dc74b","year":2014},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.393694Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:5b6d3d928e0d2810c62d2e4b540d4008bf3bb6d3abe992f7e7a9ea1d93520edb","observation_id":"b7aec58d-5757-46b4-b2d5-5739a65e39bd","resolution":{"observed_at":"2026-08-16T04:34:34.999340Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.11805","last_updated":"2025-05-09T21:04:06Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-12-19T02:39:27Z","title":"Gemini: A Family of Highly Capable Multimodal Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.11805","snapshot_observed_at":"2026-08-16T04:34:34.402597Z","title":"Gemini: a family of highly capable multimodal models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.402597Z"},"links":{"cited_paper":"/paper/2312.11805","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:3e8a93f4533753b004080e6ee3289e4cccdb902578beb45ace48c37f3b1383dd","observation_id":"59aac060-3960-4ca3-968c-105bd69d0e3c","resolution":{"observed_at":"2026-08-16T04:34:34.402597Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.984923Z","title":"Ocr receipts text detection - retail dataset","venue":null,"work_id":"249f4ca7-0082-42a3-8485-42ec1ae90a53","year":2025},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":68,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.406226Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:0ec6b79e76ab84e127d67a9bf21f0662084e3b61bb234d3d4b964cb9961ce6ff","observation_id":"13566eb0-cbcb-4617-ba8a-27d344237974","resolution":{"observed_at":"2026-08-16T04:34:34.988698Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.974903Z","title":"Revisiting adversarial training at scale","venue":null,"work_id":"66b84faf-6ba1-4a47-9504-5da00e0b1967","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.409854Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:ff760b1bce018dc5e738f71149e9c1333b13114cfb2d0226d099705bacfc20f8","observation_id":"be2e8e0e-1bd3-4924-bcb3-05519571c5a5","resolution":{"observed_at":"2026-08-16T04:34:34.978521Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.964261Z","title":"Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36, 2024 a","venue":null,"work_id":"e5a1d74b-8426-4b34-9ab0-9f8a158cda1c","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":70,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.413580Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:228c12420fca69aa66933c86f8a6476a67be21d1294b6eeb93a4cb1f9f8008e9","observation_id":"b044c04a-fc3d-4f0e-b9bc-62f58051a898","resolution":{"observed_at":"2026-08-16T04:34:34.967929Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.953671Z","title":"Jailbreak and guard aligned language models with only few in-context demonstrations, 2024 b","venue":null,"work_id":"8f30157e-c851-4c44-a880-a1319ab5b07e","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":71,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.417198Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:e53c8f8494ae0f066cce417516f55664619aa60e4e80b53cde15729c3471f664","observation_id":"7244f837-b6ae-4d54-ad5c-8cb269bd01e9","resolution":{"observed_at":"2026-08-16T04:34:34.957335Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.421120Z","title":"Dissecting adversarial robustness of multimodal lm agents","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":72,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.421120Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:a4f565048803be5cbec778289a6b72f83b86784cd7584286399f2c104acd4574","observation_id":"a68d8c79-e523-4acf-bb1e-9ec3731ab0aa","resolution":{"observed_at":"2026-08-16T04:34:34.421120Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.12814","last_updated":"2025-02-04T20:02:17Z","snapshot_observed_at":"2026-08-16T13:41:44.544093Z","submitted_at":"2024-06-18T17:32:48Z","title":"Dissecting Adversarial Robustness of Multimodal LM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.12814","snapshot_observed_at":"2026-08-16T04:34:34.424911Z","title":"Adversarial attacks on multimodal agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":73,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.424911Z"},"links":{"cited_paper":"/paper/2406.12814","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:3655f4acb87604b459c681ee5bb4496f90e5dfce87c5c0d5724015d37245d3c2","observation_id":"670d1895-d82d-4dfd-a0fc-fe322807d972","resolution":{"observed_at":"2026-08-16T04:34:34.424911Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.15720","last_updated":"2024-11-24T05:28:07Z","snapshot_observed_at":"2026-08-16T17:05:06.180602Z","submitted_at":"2024-11-24T05:28:07Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","version":1},"cited_work":{"arxiv_id":"2411.15720","doi":null,"metadata_source":"pith","pith_arxiv_id":"2411.15720","snapshot_observed_at":"2026-08-16T04:34:34.547389Z","title":"Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks","venue":"cs.CV","work_id":"c93348b0-2e25-4c99-abdc-852f28035124","year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":74,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.429357Z"},"links":{"cited_paper":"/paper/2411.15720","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:cbbb48a6bc0e4e52229ab666d2f9ef9855bc3cf4e1adcf1aca9bcd2183e1bc15","observation_id":"8098073a-5b68-454e-a740-3086ae4f2dad","resolution":{"observed_at":"2026-08-16T04:34:34.553216Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.936624Z","title":"Demystifying clip data","venue":null,"work_id":"3422f698-2a04-4e6d-b5de-8d20d0b7e673","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":75,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.433526Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:93007bf51e4b9358e639c0d8d00fd2d3d8133a30b40f8b8cb708e88284887261","observation_id":"72383db9-b1d3-45d9-9f47-65aa2151b5b3","resolution":{"observed_at":"2026-08-16T04:34:34.940263Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.15793","last_updated":"2024-11-11T20:01:15Z","snapshot_observed_at":"2026-07-06T18:19:29.996982Z","submitted_at":"2024-05-06T17:41:33Z","title":"SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.15793","snapshot_observed_at":"2026-08-16T04:34:34.437510Z","title":"Swe-agent: Agent-computer interfaces enable automated software engineering","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":76,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.437510Z"},"links":{"cited_paper":"/paper/2405.15793","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:b92f146d487e29bde9f4253cc08d01a1da16609c2cddb33623628ec3c3100276","observation_id":"b746b0da-fa34-4596-8b86-df187c1e06ed","resolution":{"observed_at":"2026-08-16T04:34:34.437510Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.925924Z","title":"Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models","venue":null,"work_id":"ee873b89-743b-423b-a979-02f86c588183","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":77,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.441258Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:7a319da08b7487162eb5233f17437ee553e782e7222129e009e7a0f8aea67997","observation_id":"5bf8fc7b-d59a-4b8b-b7b6-9e4dc660a90e","resolution":{"observed_at":"2026-08-16T04:34:34.929583Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.15343","last_updated":"2023-09-27T12:05:41Z","snapshot_observed_at":"2026-07-06T15:08:30.190912Z","submitted_at":"2023-03-27T15:53:01Z","title":"Sigmoid Loss for Language Image Pre-Training","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.15343","snapshot_observed_at":"2026-08-16T04:34:34.445195Z","title":"Sigmoid loss for language image pre-training","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":78,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.445195Z"},"links":{"cited_paper":"/paper/2303.15343","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:598443da9a63e5b378d29731085bc6997bf9276b144ae5916e336bdc66fb0127","observation_id":"9c16cce2-a0f2-4c45-97da-395ce6ca2154","resolution":{"observed_at":"2026-08-16T04:34:34.445195Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.914909Z","title":"Towards adversarial attack on vision-language pre-training models","venue":null,"work_id":"35032945-18c2-404c-9a68-033cf2be8602","year":2022},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":79,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.449121Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:b4ab01a7c80591cafd00e60e7c622b2647c40fff64c812aa553072ff71f881d3","observation_id":"a43b2de4-395d-4954-ab51-ac79f180d4f1","resolution":{"observed_at":"2026-08-16T04:34:34.918793Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.05346","last_updated":"2025-03-28T02:55:23Z","snapshot_observed_at":"2026-08-16T13:11:59.634856Z","submitted_at":"2024-10-07T09:45:18Z","title":"AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.05346","snapshot_observed_at":"2026-08-16T04:34:34.452461Z","title":"Anyattack: Towards large-scale self-supervised generation of targeted adversarial examples for vision-language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":80,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.452461Z"},"links":{"cited_paper":"/paper/2410.05346","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:f95fd67c67e1adcef4a7d6cb24179815c4ed4e75438d0e150cacb14a71dfcc36","observation_id":"54dc0068-a54c-4b26-b7f1-045634ffd54f","resolution":{"observed_at":"2026-08-16T04:34:34.452461Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.903868Z","title":"On evaluating adversarial robustness of large vision-language models, 2023","venue":null,"work_id":"0d715e5e-b217-41b2-8d80-9033d4c64116","year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":81,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.456215Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:07890b77e17640235aab22c87a045efe4cee9bea09d3e77151f337b0e23dc047","observation_id":"92dcd7cd-5107-40ce-b3eb-8bff966a0f68","resolution":{"observed_at":"2026-08-16T04:34:34.907765Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2304.10592","last_updated":"2023-10-02T16:38:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-04-20T18:25:35Z","title":"MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.10592","snapshot_observed_at":"2026-08-16T04:34:34.459651Z","title":"Minigpt-4: Enhancing vision-language understanding with advanced large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":82,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.459651Z"},"links":{"cited_paper":"/paper/2304.10592","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:029631335057c0ac59e95ed48389f133fdc718dabfc71b79a6d000672e8cf403","observation_id":"0b7d4655-e1a3-445b-a6f2-bbaf08593a3a","resolution":{"observed_at":"2026-08-16T04:34:34.459651Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T04:34:34.463162Z","title":"Zico Kolter, and Matt Fredrikson","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":83,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.463162Z"},"links":{"citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:4bcc2ea6c8c85eb252c4261f172341b5cf659929851fcb09a3149381dbdb7036","observation_id":"ba8479a5-2b5a-49b7-9c2f-3f3480a5ea99","resolution":{"observed_at":"2026-08-16T04:34:34.463162Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.04313","last_updated":"2024-07-12T16:51:07Z","snapshot_observed_at":"2026-08-16T13:45:24.998996Z","submitted_at":"2024-06-06T17:57:04Z","title":"Improving Alignment and Robustness with Circuit Breakers","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.04313","snapshot_observed_at":"2026-08-16T04:34:34.466875Z","title":"Improving alignment and robustness with circuit breakers, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","version":1},"reference_index":84,"source":"arxiv_source","source_observed_at":"2026-08-16T04:34:34.466875Z"},"links":{"cited_paper":"/paper/2406.04313","citing_paper":"/paper/2505.01050"},"observation_digest":"sha256:75e21974df8953202d2b2d1ee352442a41b57fb5df54822d6ded64c402943be4","observation_id":"321b9f85-1b30-480c-aa8d-879559e90024","resolution":{"observed_at":"2026-08-16T04:34:34.466875Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2505.01050","last_updated":"2025-05-02T06:51:11Z","latest_version":1,"primary_category":"cs.CV","snapshot_observed_at":"2026-08-16T09:52:00.421136Z","submitted_at":"2025-05-02T06:51:11Z","title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models"},"reference_resolution":{"displayed":83,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":57,"verified_exact":1,"verified_fuzzy":25},"total_outbound_references":83},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"thesis":"As of 17 August 2026, this Paper Citation Record lists 83 of 83 outbound references and 9 inbound Pith citation observations for arXiv:2505.01050."}