{"as_of":"2026-08-20T18:25:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:8365de00c30c5fc44a622489e2f7d16d40fbf575d325c7e1a8a91f7464d904dc","coverage":[{"denominator":68,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":68,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-15T20:12:28.410564Z","state":"measured"},{"denominator":73,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":73,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-20T06:33:59.587034+00:00","state":"measured"},{"denominator":5,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":5,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T10:17:26.916448Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-05-18T18:56:45.840997Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.13862","snapshot_observed_at":"2026-08-07T10:17:26.916448Z","title":"Pandaguard: Systematic evaluation of llm safety against jailbreaking attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.11094","last_updated":"2025-10-30T06:22:33Z","snapshot_observed_at":"2026-08-13T12:53:10.459412Z","submitted_at":"2025-06-06T05:50:50Z","title":"The Scales of Justitia: A Comprehensive Survey on Safety Evaluation of LLMs","version":2},"reference_index":106,"source":"pdf_text","source_observed_at":"2026-08-07T10:17:26.916448Z"},"links":{"cited_paper":"/paper/2505.13862","citing_paper":"/paper/2506.11094"},"observation_digest":"sha256:fc69342812d466ea892b5a10dde33d532707917f0e2e25a22ac799c53896d0a0","observation_id":"1f4f6028-cdad-4fcd-9f77-f3ac8d3676a6","resolution":{"observed_at":"2026-08-07T10:17:26.916448Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"cited_work":{"arxiv_id":"2505.13862","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.13862","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"do anything now","venue":null,"work_id":"7d96a5bc-9a81-4818-ab99-a8ea9bab5fca","year":2025},"citing_paper":{"arxiv_id":"2509.09708","last_updated":"2026-04-28T03:29:39Z","snapshot_observed_at":"2026-08-10T21:52:19.966437Z","submitted_at":"2025-09-07T02:29:07Z","title":"Beyond I'm Sorry, I Can't: Dissecting Large Language Model Refusal","version":3},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-05-18T18:56:13.680353Z"},"links":{"cited_paper":"/paper/2505.13862","citing_paper":"/paper/2509.09708"},"observation_digest":"sha256:2a55a0ae1b4b7cc623c4b251a7466e137f6590aa90614533ee8174b99db7a996","observation_id":"bbdcf00c-f351-4fe0-8dbd-a1677a965279","resolution":{"observed_at":"2026-05-18T18:56:45.844559Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.13862","snapshot_observed_at":"2026-08-04T09:40:46.486872Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.14207","last_updated":"2026-06-29T03:28:16Z","snapshot_observed_at":"2026-08-13T07:44:10.852942Z","submitted_at":"2025-10-16T01:27:44Z","title":"Echoes of Human Malice in Agents: Benchmarking LLMs for Multi-Turn Online Harassment Attacks","version":3},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-04T09:40:46.486872Z"},"links":{"cited_paper":"/paper/2505.13862","citing_paper":"/paper/2510.14207"},"observation_digest":"sha256:f2d8bb8b44bb6259ca932dadb4f7fce461e6af198c55d9aa2d55c033218e8e76","observation_id":"c0a14eb1-5771-4397-bd1c-340f8a782158","resolution":{"observed_at":"2026-08-04T09:40:46.486872Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"cited_work":{"arxiv_id":"2505.13862","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.13862","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"do anything now","venue":null,"work_id":"7d96a5bc-9a81-4818-ab99-a8ea9bab5fca","year":2025},"citing_paper":{"arxiv_id":"2512.20677","last_updated":"2026-04-28T11:52:27Z","snapshot_observed_at":"2026-07-06T22:39:58.137482Z","submitted_at":"2025-12-21T19:12:44Z","title":"Learning-Based Automated Adversarial Red-Teaming for Robustness Evaluation of Large Language Models","version":4},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-16T20:22:29.726790Z"},"links":{"cited_paper":"/paper/2505.13862","citing_paper":"/paper/2512.20677"},"observation_digest":"sha256:e828cf650b7f9eccb85ceddd507d4073453b2191a57aa338316430356226c5fe","observation_id":"bc2eb868-8ecd-46a3-9d65-9f2663b84adc","resolution":{"observed_at":"2026-05-16T20:23:23.520526Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"cited_work":{"arxiv_id":"2505.13862","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.13862","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"do anything now","venue":null,"work_id":"7d96a5bc-9a81-4818-ab99-a8ea9bab5fca","year":2025},"citing_paper":{"arxiv_id":"2605.05058","last_updated":"2026-05-06T15:53:17Z","snapshot_observed_at":"2026-07-06T23:17:43.402046Z","submitted_at":"2026-05-06T15:53:17Z","title":"SoK: Robustness in Large Language Models against Jailbreak Attacks","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-05-08T16:42:41.137808Z"},"links":{"cited_paper":"/paper/2505.13862","citing_paper":"/paper/2605.05058"},"observation_digest":"sha256:736bbe75fa570eaec201eeeb29d194923b59233597a476281b4ee6bb869a960b","observation_id":"65b758ab-7aa9-48e5-8e67-aff1f084d2d1","resolution":{"observed_at":"2026-05-11T18:01:08.732256Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2505.13862/citation-record","integrity":"/paper/2505.13862/integrity","json":"/paper/2505.13862/citation-record.json","paper":"/paper/2505.13862"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:27.952093Z","title":"Language models are few-shot learners","venue":null,"work_id":null,"year":1901},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:27.952093Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:f71d43bbfa4316a2dc2254cf911f43f6eb8909ebd33fb1bc9f8d43dbe1ab6d7e","observation_id":"df60a4c9-065c-486b-b7ac-20e5933b61f6","resolution":{"observed_at":"2026-08-15T20:12:27.952093Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-08-13T17:20:44.002518Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-08-15T20:12:27.959029Z","title":"The llama 3 herd of models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:27.959029Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:266a4237187d06d902dcbcc1dd1f7bca2484c0615e93368f3263cc8711dc0c3c","observation_id":"28de3028-cefa-44eb-a708-5c9bdebaed77","resolution":{"observed_at":"2026-08-15T20:12:27.959029Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.15115","last_updated":"2025-01-03T02:18:21Z","snapshot_observed_at":"2026-08-17T18:50:07.059564Z","submitted_at":"2024-12-19T17:56:09Z","title":"Qwen2.5 Technical Report","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.15115","snapshot_observed_at":"2026-08-15T20:12:27.965475Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:27.965475Z"},"links":{"cited_paper":"/paper/2412.15115","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:7fba349879aad9554286d11c87ac7bc40feee6efaf60b35bacea1753a1b5949f","observation_id":"3f0b7cbf-1b15-42e9-a6eb-4ac51fec35f0","resolution":{"observed_at":"2026-08-15T20:12:27.965475Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.933072Z","title":"Gemini - Our most intelligent AI models, built for the agentic era, 2025","venue":null,"work_id":"9959f312-9a4e-4d82-ae53-a5b4fc6726f0","year":2025},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:27.972524Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:ad6e5418662d6b01830b77e2f8794ffcde46753d2ad5a55674742cd0f60bcc85","observation_id":"f42d85c6-a069-494e-8907-c733c42ba4ff","resolution":{"observed_at":"2026-08-15T20:12:29.939360Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.912075Z","title":"Eureka: Human-level reward design via coding large language models","venue":null,"work_id":"500050df-a6c3-4f92-8648-8ecf07abfe6a","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:27.981197Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:ec4ebdb94ff2c8f18da58ba581d2a4ed1a673585babc154f33f8deefd5b1313f","observation_id":"aa19e645-c592-4fb8-972f-6a658926bac0","resolution":{"observed_at":"2026-08-15T20:12:29.918845Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.890339Z","title":"Creating large language model applications utilizing langchain: A primer on developing llm apps fast","venue":null,"work_id":"e8235c70-43b2-4e42-b849-a9bc570d3a57","year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:27.987784Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:b57f2516a60a5c4a80e2354452a9480bfda567b0f3f85421851e94c47f6ca57c","observation_id":"40ca29c7-6ba4-4278-b073-8077625fdc2a","resolution":{"observed_at":"2026-08-15T20:12:29.896603Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:27.996184Z","title":"Taxonomy of risks posed by language models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:27.996184Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:3a9c1d67dcf6ddd30e925a1e1aa59e9449373935c6a23ec2b8212f5b3be3cd7b","observation_id":"9c09b8a8-f03c-48d4-9b3d-966ea09ffdb0","resolution":{"observed_at":"2026-08-15T20:12:27.996184Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.841066Z","title":"Navigating the risks: A review of safety issues in large language models","venue":null,"work_id":"54b749e7-b8b9-4f11-b038-1aeddef9d803","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.002672Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:966d350d8aaaff2a4eb83f523e883c0ba39b0cbf2bab502c922548cea7e766a8","observation_id":"ef1706d5-da10-47fd-9963-bdbcc9a7ebc2","resolution":{"observed_at":"2026-08-15T20:12:29.850221Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.010548Z","title":"A survey on large language model (llm) security and privacy: The good, the bad, and the ugly","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.010548Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:aaf4812c8b44faa0ddc1bddbbfaa26a1bb005bd7e9555f6b0d0ec11bbff008d6","observation_id":"b0bf3749-b52a-4709-a08e-d22973a5053b","resolution":{"observed_at":"2026-08-15T20:12:28.010548Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.802844Z","title":"Multimodal situational safety","venue":null,"work_id":"e1d2dea4-ecd9-4599-8564-1a21cbf0a06c","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.016883Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:32f5a41dd2923d4613bbe26cc80743b9ab6c440b559c747f6fea46d8c0638e8d","observation_id":"9c117881-0b0c-4e9c-b21b-0b863a6aba2e","resolution":{"observed_at":"2026-08-15T20:12:29.809951Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.776565Z","title":"Air-bench 2024: A safety benchmark based on regulation and policies specified risk categories","venue":null,"work_id":"caf013e5-e122-4d7e-a377-feef33648c50","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.023470Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:72ed552075460523bb28c0c5c8ba674953404b909c99eee04afd936cc84e804f","observation_id":"dba124c1-07b9-45af-b6f2-d440207e5696","resolution":{"observed_at":"2026-08-15T20:12:29.784390Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.030062Z","title":"Safe rlhf: Safe reinforcement learning from human feedback","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.030062Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:d2d60a843d1102f62ac8209c8133c151db91921aad5bd375e192a4a3f77f69e2","observation_id":"d19f4f79-0f54-4a4d-af8d-e4fa17fd46f8","resolution":{"observed_at":"2026-08-15T20:12:28.030062Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.05668","last_updated":"2025-05-26T12:56:04Z","snapshot_observed_at":"2026-08-18T10:26:02.157762Z","submitted_at":"2024-02-08T13:42:50Z","title":"JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.05668","snapshot_observed_at":"2026-08-15T20:12:28.036730Z","title":"Com- prehensive assessment of jailbreak attacks against llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.036730Z"},"links":{"cited_paper":"/paper/2402.05668","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:a718055581a64fdf02059ddc820d30e4924f5d6d529f32a71e93048b15893deb","observation_id":"62005d79-be73-4562-bb62-37f732cd1b2b","resolution":{"observed_at":"2026-08-15T20:12:28.036730Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.044177Z","title":"Zico Kolter, and Matt Fredrikson","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.044177Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:0103892c79e9f636b7e6e2e5b2a32a7037282fcfaa89c881470a2ffc74576435","observation_id":"117632e5-4bce-4502-8524-66f8ac717635","resolution":{"observed_at":"2026-08-15T20:12:28.044177Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.13860","last_updated":"2024-03-10T13:58:08Z","snapshot_observed_at":"2026-08-19T22:25:04.062400Z","submitted_at":"2023-05-23T09:33:38Z","title":"Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.13860","snapshot_observed_at":"2026-08-15T20:12:28.050206Z","title":"Jailbreaking chatgpt via prompt engineering: An empirical study","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.050206Z"},"links":{"cited_paper":"/paper/2305.13860","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:16b3a9f5827f4e4636f89ac577be3f42788baf59e9dfc6e3eeda66c62dc16378","observation_id":"6fbf680e-e989-4c37-a0fd-9894f09cb4d1","resolution":{"observed_at":"2026-08-15T20:12:28.050206Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.04295","last_updated":"2024-08-30T11:57:47Z","snapshot_observed_at":"2026-08-12T17:45:10.384900Z","submitted_at":"2024-07-05T06:57:30Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.04295","snapshot_observed_at":"2026-08-15T20:12:28.056212Z","title":"Jailbreak attacks and defenses against large language models: A survey","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.056212Z"},"links":{"cited_paper":"/paper/2407.04295","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:9d32ac0bfed0513914d410568f616a909bcd4b2309a74775f6c48595aea0a970","observation_id":"547b3c93-8e26-4c08-98c5-34219cd2557d","resolution":{"observed_at":"2026-08-15T20:12:28.056212Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.14598","last_updated":"2025-03-01T21:45:36Z","snapshot_observed_at":"2026-08-19T14:52:32.218201Z","submitted_at":"2024-06-20T17:56:07Z","title":"SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.14598","snapshot_observed_at":"2026-08-15T20:12:28.062971Z","title":"Sorry-bench: Systematically evaluating large language model safety refusal behaviors","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.062971Z"},"links":{"cited_paper":"/paper/2406.14598","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:db765b45a6208506c4ce17ce563c4b1e44dc436385c99ee279fc286e3386ed98","observation_id":"ce3c3ccf-2d06-49e5-ac7c-7cf0b2153678","resolution":{"observed_at":"2026-08-15T20:12:28.062971Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.09121","last_updated":"2025-05-23T04:31:00Z","snapshot_observed_at":"2026-08-19T03:12:11.573888Z","submitted_at":"2024-07-12T09:36:33Z","title":"Refuse Whenever You Feel Unsafe: Improving Safety in LLMs via Decoupled Refusal Training","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.09121","snapshot_observed_at":"2026-08-15T20:12:28.070723Z","title":"Refuse whenever you feel unsafe: Improving safety in llms via decoupled refusal training","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.070723Z"},"links":{"cited_paper":"/paper/2407.09121","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:e18dcff3a7d7f9ccce87c3724d4ba60b45bc325a712cb845ee26b4071433caa7","observation_id":"3f91d558-0aab-4c3f-9204-a0809c379448","resolution":{"observed_at":"2026-08-15T20:12:28.070723Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.725812Z","title":"Jailbreak antidote: Runtime safety-utility balance via sparse representation adjustment in large language models","venue":null,"work_id":"55650929-7dca-44e4-ac30-bb0d714755f7","year":2025},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.076502Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:d1b4c8f1eb4412c66133165f784a7ff56dc2e967a5378f49c8f02d738ba094d4","observation_id":"ca58e9ef-186d-4163-a9bd-0937d8001d7b","resolution":{"observed_at":"2026-08-15T20:12:29.732854Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.081961Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.081961Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:d58c7b03b2a55f6d33bcfd8c979f559ba7e3e6a75fadbd87332b3e61b1a0c9f8","observation_id":"4e7c375d-e4b4-4c32-af61-51fd5b2a7bee","resolution":{"observed_at":"2026-08-15T20:12:28.081961Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.674898Z","title":"Jailbreaking black box large language models in twenty queries","venue":null,"work_id":"fb3fad6c-1da7-48d3-9126-17a6da4056e1","year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.087538Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:741dc2039986b1ebcb23983a0d39d531c93cfbeef97a8d821928314bb3d3f6de","observation_id":"e23ca5eb-8e7b-4054-8846-bb347eec362d","resolution":{"observed_at":"2026-08-15T20:12:29.683140Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.092938Z","title":"Defending chatgpt against jailbreak attack via self-reminders","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.092938Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:c0c676339e8c96269af5c2f442b89f568b6d6854a29c1d2ddeeac5b7cdb5ef69","observation_id":"92d0f952-ef6e-45ba-93d5-a2caea2fa3a1","resolution":{"observed_at":"2026-08-15T20:12:28.092938Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.631781Z","title":"Defending llms against jailbreak- ing attacks via backtranslation","venue":null,"work_id":"186d9040-86e3-4c2c-bf3d-eec9dc09217d","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.098601Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:115a2f885b9b8db41616913b82abd10a8541e442cce1240aa330d0e7b07e8771","observation_id":"6f6b1eee-5318-46c1-bc88-0e3174ba4240","resolution":{"observed_at":"2026-08-15T20:12:29.638761Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.487669Z","title":"Pku-saferlhf: A safety alignment preference dataset for llama family models","venue":null,"work_id":"14649baf-6235-41c8-b150-276cb94c5754","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.104148Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:e0f276996dc310320c23e90697d72ee41b4b9480a1731ce8670a6702b82a3dfc","observation_id":"4b7e79ab-22a6-4ca3-8149-57b07f1f491b","resolution":{"observed_at":"2026-08-15T20:12:29.494475Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.16776","last_updated":"2025-02-24T02:11:52Z","snapshot_observed_at":"2026-08-19T03:12:11.073403Z","submitted_at":"2025-02-24T02:11:52Z","title":"AISafetyLab: A Comprehensive Framework for AI Safety Evaluation and Improvement","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.16776","snapshot_observed_at":"2026-08-15T20:12:28.109825Z","title":"Aisafetylab: A comprehensive framework for ai safety evaluation and improvement","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.109825Z"},"links":{"cited_paper":"/paper/2502.16776","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:ba5dc7cab1adb88c5749a8a3b4d90cca977f266849251cbaff13971d6ee48b6a","observation_id":"fb551892-74a7-40f4-a74b-9679ca250279","resolution":{"observed_at":"2026-08-15T20:12:28.109825Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.467660Z","title":"Bag of tricks: Benchmarking of jailbreak attacks on llms","venue":null,"work_id":"1d592217-d274-4365-81ff-f019ebc362a8","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.115989Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:2517d0dfd3091a4f08be180ccf58b4b1bdb02c1f78de8c51744c00664c95db11","observation_id":"cc9e03ed-3170-4be0-ac20-a66274b48ff8","resolution":{"observed_at":"2026-08-15T20:12:29.473277Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.122027Z","title":"Safetybench: Evaluating the safety of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.122027Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:a62e0e94de3e6b0aadfdafe41abb0ab06bf1d4853baef5dbbe7e64421719b86b","observation_id":"36bdcb7e-004a-4ee3-9615-466a71a03cb8","resolution":{"observed_at":"2026-08-15T20:12:28.122027Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.128237Z","title":"Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.128237Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:a0a4bfcb75dc16611ccb147c620f9a6f025f79c53806557c090fc258f26aaf30","observation_id":"525f3b0b-d83b-410f-82f1-d5b88db63591","resolution":{"observed_at":"2026-08-15T20:12:28.128237Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.134188Z","title":"A survey on evaluation of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.134188Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:5117e9c248f2b1d080b270b76d08bdbabfee27e5dc922f36a3cac4140421e6c1","observation_id":"11714a50-da6d-4253-aeef-d85e5da45f71","resolution":{"observed_at":"2026-08-15T20:12:28.134188Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.392628Z","title":"Advbench: a framework to evaluate adversarial attacks against fraud detection systems","venue":null,"work_id":"1a57c177-cef9-41da-8f06-8e05dab3812f","year":2022},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.140900Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:9c8bb0292609998d5d18652a53cabe0d4362442db22bf2f905e233f05404044e","observation_id":"4f293da4-244d-4fd7-b960-c705317b1ba7","resolution":{"observed_at":"2026-08-15T20:12:29.400243Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.365081Z","title":"Jailjudge: A comprehensive jailbreak judge benchmark with multi-agent enhanced explanation evaluation framework, 2024","venue":null,"work_id":"1c1943a3-a53f-4e71-a6e4-04175168514e","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.147108Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:f3768d1993674f67eeded90f4880c0edb6748111f062fef58786cbe689ab4ed1","observation_id":"ee761edf-f374-4537-aaf6-1bd7323fdb57","resolution":{"observed_at":"2026-08-15T20:12:29.374479Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.12171","last_updated":"2024-03-18T18:39:53Z","snapshot_observed_at":"2026-08-19T03:10:46.651140Z","submitted_at":"2024-03-18T18:39:53Z","title":"EasyJailbreak: A Unified Framework for Jailbreaking Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.12171","snapshot_observed_at":"2026-08-15T20:12:28.154029Z","title":"Easyjailbreak: A unified framework for jailbreaking large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.154029Z"},"links":{"cited_paper":"/paper/2403.12171","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:fadf4bc6755b125eb88ea95437d7ec08e3aec1997193af7e8e0fbbc47a1baa04","observation_id":"9c2a1e22-bd67-42b2-8a68-d268c8b5f526","resolution":{"observed_at":"2026-08-15T20:12:28.154029Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.341723Z","title":"Harmbench: a standardized evaluation frame- work for automated red teaming and robust refusal","venue":null,"work_id":"c4db8160-7dc4-492b-93b0-0b36d7d6b6ff","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.160971Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:03de1bec70b84d9f08e42759d36540674f16afd9dfba810b6b029bb460511202","observation_id":"0d86aa3a-948e-4ef6-ab23-a8f3fcd2b301","resolution":{"observed_at":"2026-08-15T20:12:29.348580Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.166852Z","title":"Gonzalez, Hao Zhang, and Ion Stoica","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.166852Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:1c183ceeb27fcde236279fb48a68b01fa1386382f1f8deba40b9e209bf51aefd","observation_id":"7b881c55-f619-4f66-83f6-45e58a27cd2f","resolution":{"observed_at":"2026-08-15T20:12:28.166852Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.174978Z","title":"Sglang: Efficient execution of structured language model programs","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.174978Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:89d3c1c2e29d111ee13a6156f18a721c6fd9a0d41a6600cae27e38352f7e2480","observation_id":"e428f175-7e1f-42cc-9850-57c51c630ac7","resolution":{"observed_at":"2026-08-15T20:12:28.174978Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.286269Z","title":"Ollama: Run large language models locally, 2025","venue":null,"work_id":"4c107830-a02b-457c-a94d-640af69ff617","year":2025},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.184031Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:c11ea50f4b05b0dc7f28becd08c3feb2c115c83f0909976141f3001577ee5598","observation_id":"108b9efa-00dd-481b-9b4a-6ff18aa6a91d","resolution":{"observed_at":"2026-08-15T20:12:29.292654Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.264910Z","title":"Jailbreak chat","venue":null,"work_id":"9f1186ad-13d3-42b8-9c2d-d8c722b86d7e","year":2025},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.193182Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:ad215a7265d846ba5d33bb47a7e0831cf3340495039f2f5a41620b959945fb7d","observation_id":"e508776e-ec90-43ec-8240-6c0c65e10bd4","resolution":{"observed_at":"2026-08-15T20:12:29.271428Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.199798Z","title":"Jailbroken: How does LLM safety training fail? In Thirty-seventh Conference on Neural Information Processing Systems, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.199798Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:57d2607df5b332bfdb0827e921f523bd7f0d4381dc44df7bc39b6b60a704b7da","observation_id":"1cbf9e98-4525-4e5b-acc8-d1f2c5e070f8","resolution":{"observed_at":"2026-08-15T20:12:28.199798Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.231455Z","title":"Improved generation of adversarial examples against safety-aligned LLMs","venue":null,"work_id":"f5fdd83d-0c91-4fe9-bdbb-3317af0cbf8f","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.207613Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:acd146b12e169319489016e0e405e52fc5d224bacfa0376e64893c19e8ecf028","observation_id":"8b641bc0-a644-4e23-a30f-4ecfbe748f13","resolution":{"observed_at":"2026-08-15T20:12:29.237976Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.209997Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks","venue":null,"work_id":"9e85ba33-92de-417b-8f98-3aa7095dc1c3","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.213385Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:e553695b8d2e99766333083bfc27209a057328bde87ac91df6620af966eca4ed","observation_id":"ee501cbe-1cb2-4f4b-8565-f22cad340991","resolution":{"observed_at":"2026-08-15T20:12:29.217084Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.185623Z","title":"Does refusal training in llms generalize to the past tense? In Neurips Safe Generative AI Workshop 2024, 2024","venue":null,"work_id":"7655c6c2-9c87-44a8-a11c-12261a5c5970","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.220285Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:9b4f6599efee057a29c6eb91f87ac2f7aa9a037dc72b5a8c87336320aa8269c5","observation_id":"9d093622-b3b9-4573-9b87-a1c59e925046","resolution":{"observed_at":"2026-08-15T20:12:29.192233Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.163907Z","title":"Rain- bow teaming: Open-ended generation of diverse adversarial prompts","venue":null,"work_id":"2ae5709d-6c2f-4eb7-b364-c7ebb429b47f","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.226559Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:a14fabcc8360dfa12a248b18cb94bd56f464d3bcc41eaa7fcb2e647a13472308","observation_id":"0b6db335-661d-4f74-983b-e9d420caf9d2","resolution":{"observed_at":"2026-08-15T20:12:29.170330Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.237023Z","title":"Artprompt: Ascii art-based jailbreak attacks against aligned llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.237023Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:0365c5e80225f879b5553c98138eb748e458616a38cf878381850d748ab176d0","observation_id":"be8f0d35-a25a-4e36-895f-1e646b4e2338","resolution":{"observed_at":"2026-08-15T20:12:28.237023Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.245128Z","title":"Deepinception: Hypnotize large language model to be jailbreaker","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.245128Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:85edfeb704877930e8522f669375836a1382382fe9b263a357514f3ab60bcad0","observation_id":"06ebc475-7517-4d1d-93eb-36acfae75382","resolution":{"observed_at":"2026-08-15T20:12:28.245128Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-15T20:12:28.252253Z","title":"Baseline de- fenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.252253Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:2daa32525a6c640d6874a4756d41e21ef99b838e6c19519833b3d0bc0d2368ff","observation_id":"70f47f65-b2bc-4457-a4d7-dd3004d128e7","resolution":{"observed_at":"2026-08-15T20:12:28.252253Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03684","last_updated":"2024-06-11T19:02:52Z","snapshot_observed_at":"2026-08-17T15:25:03.596568Z","submitted_at":"2023-10-05T17:01:53Z","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03684","snapshot_observed_at":"2026-08-15T20:12:28.259897Z","title":"Smoothllm: Defending large language models against jailbreaking attacks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.259897Z"},"links":{"cited_paper":"/paper/2310.03684","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:789fa3f2f01618ac53c14eabe880531a8ff82a35a7c4170d8350be5f89d79a98","observation_id":"74d3bf7e-424f-4930-ade8-9dc28e009b55","resolution":{"observed_at":"2026-08-15T20:12:28.259897Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.110414Z","title":"Defending large language models against jailbreaking attacks through goal prioritization","venue":null,"work_id":"2a4a2ef6-4617-46da-8d37-36507c8e1fda","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.267800Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:64f5b700872dad063acefc8e1486eb9798998973887a0ee3d0d7a12e529c965c","observation_id":"c883163e-e2d2-42b8-a865-f62e33ce04dd","resolution":{"observed_at":"2026-08-15T20:12:29.117089Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16192","last_updated":"2024-02-28T23:11:33Z","snapshot_observed_at":"2026-08-19T03:06:30.029191Z","submitted_at":"2024-02-25T20:36:03Z","title":"Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16192","snapshot_observed_at":"2026-08-15T20:12:28.274891Z","title":"Defending large language models against jailbreak attacks via semantic smoothing","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.274891Z"},"links":{"cited_paper":"/paper/2402.16192","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:00e0845f4bfda619d8a5625f9edbfed325c46d0f5c55fb9c1fe38de9bc0fd7fd","observation_id":"80a7c5a8-b76a-4556-b50e-fb10ebe7720f","resolution":{"observed_at":"2026-08-15T20:12:28.274891Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.284370Z","title":"Llm self defense: By self examination, llms know they are being tricked","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.284370Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:229591ce4bc6bf44ad381f5aabe4360fa8b6eb5b6f378f8a783a9789bd477c3d","observation_id":"5e51d652-fb1b-4145-b576-ded5c0ed92b7","resolution":{"observed_at":"2026-08-15T20:12:28.284370Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.01405","last_updated":"2025-03-03T06:14:14Z","snapshot_observed_at":"2026-07-06T16:26:38.284922Z","submitted_at":"2023-10-02T17:59:07Z","title":"Representation Engineering: A Top-Down Approach to AI Transparency","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.01405","snapshot_observed_at":"2026-08-15T20:12:28.291761Z","title":"Representation engineering: A top-down approach to ai transparency","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.291761Z"},"links":{"cited_paper":"/paper/2310.01405","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:9e8c7633ed743f96437651312a776affb8d9304695a2f937e902659164ab9329","observation_id":"fb67fe54-6dba-4199-8a35-df3e5318e44d","resolution":{"observed_at":"2026-08-15T20:12:28.291761Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:29.073182Z","title":"Safe lora: The silver lining of reducing safety risks when finetuning large language models","venue":null,"work_id":"d6400755-e8a2-4524-a73e-5c414cff210b","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.299921Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:b1acd7fc4770d479dfc039646e9823418ac1fe54958bfee9b383598afbd84964","observation_id":"fbd7e63d-23be-480e-840e-cbdd99a7fb7d","resolution":{"observed_at":"2026-08-15T20:12:29.079297Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.306823Z","title":"Training language models to follow instructions with human feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.306823Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:0cc375fe9b32b4f7640e9fba8a29168dc386f0904ddaf77a11df21871d62fbb0","observation_id":"7fc3552a-a6a5-4bda-af0b-c20fc3a9c00f","resolution":{"observed_at":"2026-08-15T20:12:28.306823Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.312870Z","title":"Direct preference optimization: Your language model is secretly a reward model","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.312870Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:b5939e3bda60ea5a10ca5d77010507fa0f74e0e86e02167c3565db2e51968289","observation_id":"6162b60d-3417-4222-a562-470ec91211a5","resolution":{"observed_at":"2026-08-15T20:12:28.312870Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.19594","last_updated":"2024-07-30T01:38:06Z","snapshot_observed_at":"2026-08-20T11:42:05.593922Z","submitted_at":"2024-07-28T21:58:28Z","title":"Meta-Rewarding Language Models: Self-Improving Alignment with LLM-as-a-Meta-Judge","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.19594","snapshot_observed_at":"2026-08-15T20:12:28.318309Z","title":"Meta-rewarding language models: Self-improving alignment with llm-as-a-meta-judge","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.318309Z"},"links":{"cited_paper":"/paper/2407.19594","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:041fbe33564ba3b1f67e2189e9cac158f303d6e42c92f52113aca2137a78b65b","observation_id":"44affa0e-f407-49f7-8e20-c38b7e980fae","resolution":{"observed_at":"2026-08-15T20:12:28.318309Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.15594","last_updated":"2025-10-19T10:32:43Z","snapshot_observed_at":"2026-08-20T12:52:29.141935Z","submitted_at":"2024-11-23T16:03:35Z","title":"A Survey on LLM-as-a-Judge","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.15594","snapshot_observed_at":"2026-08-15T20:12:28.324184Z","title":"A survey on llm-as-a-judge","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.324184Z"},"links":{"cited_paper":"/paper/2411.15594","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:49bb62b9cdd006e8bf6aca1270ccb8666dd685c971c79a12751644c9dee8377d","observation_id":"f21669cd-3664-4567-9a4c-51c89bbd2c93","resolution":{"observed_at":"2026-08-15T20:12:28.324184Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.330644Z","title":"Promptbench: Towards evaluating the robustness of large language models on adversarial prompts","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.330644Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:78dee2de1593ee9f289c37379d6eb0ffe4b445cd5d8494999235df2075a4550d","observation_id":"fa8787ee-838d-4920-b296-e9212cf735a3","resolution":{"observed_at":"2026-08-15T20:12:28.330644Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.337667Z","title":"Decodingtrust: A comprehensive assessment of trustworthiness in gpt models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.337667Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:d1503bf037b99c82a0691e4a19948b4bc01e93c515cd3492782836e4e488251a","observation_id":"8f3c5e57-b04f-4365-88e2-b767847464de","resolution":{"observed_at":"2026-08-15T20:12:28.337667Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.05561","last_updated":"2024-09-30T10:17:12Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-01-10T22:07:21Z","title":"TrustLLM: Trustworthiness in Large Language Models","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.05561","snapshot_observed_at":"2026-08-15T20:12:28.343741Z","title":"Trustllm: Trustworthiness in large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.343741Z"},"links":{"cited_paper":"/paper/2401.05561","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:35ddf91d169477bacbe550cd33145aa49c0c9b9c96a8f57f66290f7d31d5b4d3","observation_id":"cac776c4-a048-4bac-8563-ec5817bec7ea","resolution":{"observed_at":"2026-08-15T20:12:28.343741Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.999730Z","title":null,"venue":null,"work_id":"9ad2f00e-9045-4054-b7ca-73f0cfefe52a","year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.350734Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:b5f55874c7f568c9979bd9b3f8db8d34067dae5845b4f7d8351596d9b603663c","observation_id":"19a5bcf9-4c1b-4e99-a5ca-c75c08940efd","resolution":{"observed_at":"2026-08-15T20:12:29.006340Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.977426Z","title":null,"venue":null,"work_id":"2c233642-ac6c-44b4-9bc0-a7b89d8627f1","year":2020},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.356453Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:f459ee6fc255d62f6ee6bab20ab4114ef6bcd8db043f8cfcd105dfb152310fc3","observation_id":"7c3bf811-89c5-4df6-8959-ad73037762fb","resolution":{"observed_at":"2026-08-15T20:12:28.984753Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.362060Z","title":"Tree of attacks: Jailbreaking black-box llms automatically.Advances in Neural Information Processing Systems, 37:61065–61105, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.362060Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:fa045928944b7f11df2e398e5ea791814b2992505ea34450131c2fd04d23edeb","observation_id":"7c66d790-b8c7-4409-899b-0c6e8fb680c0","resolution":{"observed_at":"2026-08-15T20:12:28.362060Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.368265Z","title":"Hashimoto","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.368265Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:94ab4369100571d4dddabb6f8be32ab867a4ec7c902334af2b716bf5b1928348","observation_id":"4b203de0-b6f9-4db1-bdb6-cbd4ac463b61","resolution":{"observed_at":"2026-08-15T20:12:28.368265Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.925439Z","title":"Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher","venue":null,"work_id":"45fc14fe-e8a2-401f-9932-84dc5fe5e862","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.374011Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:3f78332f5d90547efd35815f0915257bbec70c8733a727cf0dc19d1fb9e3518c","observation_id":"195e4141-5804-4e75-9cdd-497e0384c223","resolution":{"observed_at":"2026-08-15T20:12:28.933483Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06387","last_updated":"2024-05-25T07:01:15Z","snapshot_observed_at":"2026-08-16T14:53:33.115609Z","submitted_at":"2023-10-10T07:50:29Z","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06387","snapshot_observed_at":"2026-08-15T20:12:28.380405Z","title":"Jailbreak and guard aligned language models with only few in-context demonstrations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.380405Z"},"links":{"cited_paper":"/paper/2310.06387","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:11ce348782c7bf076372942b82316d711ca7a53d9502e7afa2169e534b2f0a68","observation_id":"2cb7c7aa-8f91-49a8-bb57-79e5a3691a0e","resolution":{"observed_at":"2026-08-15T20:12:28.380405Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.901030Z","title":"Uncovering safety risks of large language models through concept activation vector","venue":null,"work_id":"5bfcbd0b-ac2d-4365-ba8d-7946f64e4b79","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.387527Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:c3042f7223da2c60b4c56817a5cc1dd0bfca8e380acdd8e81533062256d45373","observation_id":"3cc13dcd-540d-4f6c-b618-b4ee84c85a78","resolution":{"observed_at":"2026-08-15T20:12:28.908294Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.04190","last_updated":"2024-10-05T15:10:01Z","snapshot_observed_at":"2026-08-19T03:12:19.006087Z","submitted_at":"2024-10-05T15:10:01Z","title":"Harnessing Task Overload for Scalable Jailbreak Attacks on Large Language Models","version":1},"cited_work":{"arxiv_id":"2410.04190","doi":null,"metadata_source":"pith","pith_arxiv_id":"2410.04190","snapshot_observed_at":"2026-08-15T20:12:28.474874Z","title":"Harnessing Task Overload for Scalable Jailbreak Attacks on Large Language Models","venue":"cs.CR","work_id":"7cb9c8c1-a5df-406b-ac75-e0912b4aa5d4","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.395788Z"},"links":{"cited_paper":"/paper/2410.04190","citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:ee2d6b22c40605084a8245060c2f87c76c1a5c912ba6ec4ce821a38cea2a5466","observation_id":"16ad5843-ad03-4cde-ae97-7ec4da586707","resolution":{"observed_at":"2026-08-15T20:12:28.483228Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.879134Z","title":"Robust prompt optimization for defending language mod- els against jailbreaking attacks","venue":null,"work_id":"c5ec2802-8a75-47d0-a46f-749564757b5d","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.403981Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:7a70a32a962f7465ec55c3aecfb045e325d47a71ecd9ba83ea14062fc2fc4a1e","observation_id":"8e03b60a-4202-4add-b3a5-d5e50da0d3a5","resolution":{"observed_at":"2026-08-15T20:12:28.885088Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T20:12:28.860055Z","title":"I’m sorry","venue":null,"work_id":"6bca0d84-bffd-4f8b-9433-639b2cbb7a20","year":2024},"citing_paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks","version":3},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-15T20:12:28.410564Z"},"links":{"citing_paper":"/paper/2505.13862"},"observation_digest":"sha256:d6486d3426e2129fa79bd5369bffe774f67746c90f1c2925e6603b89e1255357","observation_id":"b1701f1d-7cba-4dae-8844-f7f053c1c0dc","resolution":{"observed_at":"2026-08-15T20:12:28.865944Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-20T06:33:59.587034+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2505.13862","last_updated":"2025-05-26T15:25:01Z","latest_version":3,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-19T03:56:11.129832Z","submitted_at":"2025-05-20T03:14:57Z","title":"PandaGuard: Systematic Evaluation of LLM Safety against Jailbreaking Attacks"},"reference_resolution":{"displayed":68,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":41,"verified_exact":1,"verified_fuzzy":26},"total_outbound_references":68},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-20T06:33:59.587034+00:00","source":"crossref"},{"observed_at":"2026-08-20T06:33:54.927442+00:00","source":"retraction_watch"}],"thesis":"As of 20 August 2026, this Paper Citation Record lists 68 of 68 outbound references and 5 inbound Pith citation observations for arXiv:2505.13862."}