{"as_of":"2026-08-09T03:59:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:0b27a7731291d72d65dcf3d83e6b4cf33b7c6f01c5237ba339fe9e5590991062","coverage":[{"denominator":75,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":75,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:01:12.671597Z","state":"measured"},{"denominator":75,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":75,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2505.21556/citation-record","integrity":"/paper/2505.21556/integrity","json":"/paper/2505.21556/citation-record.json","paper":"/paper/2505.21556"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-07T14:01:04.880446Z","title":"Gpt-4 technical report","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:04.880446Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:0a983c2dc40479036546cf3f2c70aca24b76260ce28da5cf7617ac5ab966ee0d","observation_id":"43184e99-0b2c-4269-b490-cc106c2bd8bf","resolution":{"observed_at":"2026-08-07T14:01:04.880446Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:04.977275Z","title":"Flamingo: a visual language model for few-shot learning","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:04.977275Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:e2eafe825ca3920a4c9c3e30707107916207414b1ae9f0b99b66a3148a662fde","observation_id":"c9b3b5d5-c8fe-4c63-8552-62e00127f28e","resolution":{"observed_at":"2026-08-07T14:01:04.977275Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2112.00861","last_updated":"2021-12-09T21:40:22Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2021-12-01T22:24:34Z","title":"A General Language Assistant as a Laboratory for Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2112.00861","snapshot_observed_at":"2026-08-07T14:01:05.068251Z","title":"A general language assistant as a laboratory for alignment","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.068251Z"},"links":{"cited_paper":"/paper/2112.00861","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:eeece037b1ac33e4f99b2ddda9a6af67fb508f7ca3222131fcf8d5fc201ee409","observation_id":"e1d81934-7f87-4af3-8b26-f6fc9e859cc4","resolution":{"observed_at":"2026-08-07T14:01:05.068251Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-08-07T14:01:05.147698Z","title":"Training a helpful and harmless assistant with reinforcement learning from human feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.147698Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:a6b16ea6ec3fc0c51fcf60d50b8ec4d9e6fa02b2aff6e75f79486adbf14f456e","observation_id":"de0218e3-36a3-4e94-bf92-192b0bb96909","resolution":{"observed_at":"2026-08-07T14:01:05.147698Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.08073","last_updated":"2022-12-15T06:19:23Z","snapshot_observed_at":"2026-08-02T04:53:58.766070Z","submitted_at":"2022-12-15T06:19:23Z","title":"Constitutional AI: Harmlessness from AI Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.08073","snapshot_observed_at":"2026-08-07T14:01:05.235638Z","title":"Constitutional ai: Harmlessness from ai feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.235638Z"},"links":{"cited_paper":"/paper/2212.08073","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:8db1128d3fc9d941df9875ae7612b76986d35c82f41b5feb272d95187a5fb199","observation_id":"3c05add4-ca1b-4c3f-865b-4667a53a9009","resolution":{"observed_at":"2026-08-07T14:01:05.235638Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:18.339514Z","title":"Curriculum learning","venue":null,"work_id":"744d66ed-bf3f-47a9-9d40-2dccc34dfee7","year":2009},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.329421Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:7179f34a75cef866e63332d724e50da8bb32a080ecee80aae3a1146db8aba222","observation_id":"2e230b6e-4203-4db3-a02b-8ba7ed6b0d40","resolution":{"observed_at":"2026-08-07T14:01:18.470929Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:05.396996Z","title":"Language models are few-shot learners","venue":null,"work_id":null,"year":1901},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.396996Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:88691ba08951f153cde95f84817a494b4f38e966c9afdd1e94b6d6d035679208","observation_id":"4c57c470-45cf-4c31-a6bf-e5a75d2c0957","resolution":{"observed_at":"2026-08-07T14:01:05.396996Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:18.071151Z","title":"Jailbreakbench: An open robustness benchmark for jailbreaking large language models","venue":null,"work_id":"d2167be0-2688-4a04-b2cd-d9e1631bb78b","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.490067Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:38eed4d1fd2d7fbcf6afd1e63772af735d3d96aa28357bf3f085b20dc715bd95","observation_id":"a2659478-d509-4126-bdff-95d56e03e1a3","resolution":{"observed_at":"2026-08-07T14:01:18.184940Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-07T14:01:05.568201Z","title":"Jailbreaking black box large language models in twenty queries","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.568201Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:834aacf4445ab37ca18917cca67c0148cb55a8e0d9df7c03dd94b551afee5405","observation_id":"1d8c4c65-dc5c-4bf4-8c2e-1d3b874059e9","resolution":{"observed_at":"2026-08-07T14:01:05.568201Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:05.649870Z","title":"Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.649870Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:fa295c3f897c62edde3c2d01db7592c07e23ea41058dab6d780ab5033997a934","observation_id":"01710c49-abbb-453b-b75f-afaeaa99853b","resolution":{"observed_at":"2026-08-07T14:01:05.649870Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:05.733917Z","title":"Scaling instruction-finetuned language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.733917Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:a86c52e342f7712edf19f100c14ec0667a8f2a619eb71972c86e2e3907fb7903","observation_id":"fb2dd991-e70c-48a6-a311-55ae90668e91","resolution":{"observed_at":"2026-08-07T14:01:05.733917Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.909557Z","title":"Instructblip: Towards general-purpose vision-language models with instruction tuning","venue":null,"work_id":"05f6a199-c09c-4f0a-9e5f-967a42023ffd","year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.832788Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:38e144aa83c75d465c65af03dc85ca6ad20f4f59f62492c0e093722a1f780e7c","observation_id":"b4f96d1e-9483-4418-b3f7-1af457b4357f","resolution":{"observed_at":"2026-08-07T14:01:17.974945Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.742215Z","title":"Multilingual jailbreak challenges in large language models","venue":null,"work_id":"241fa17b-365e-49cf-bdc2-3c868aecd0fa","year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:05.949924Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:9174f759cc7027613c61d0be887c02f48c21a3ec66680c0a038b06a6e7d66129","observation_id":"83900bca-935a-488e-98d4-e48f856551b1","resolution":{"observed_at":"2026-08-07T14:01:17.816308Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:06.110150Z","title":"Artificial intelligence, values, and alignment","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.110150Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:376a461c9bfc1ea82bcb67e43790d6c2d3f6959b95be39408bfa65dd520c574d","observation_id":"a477b354-9f1f-4c32-87c7-29333775ba56","resolution":{"observed_at":"2026-08-07T14:01:06.110150Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.07858","last_updated":"2022-11-22T19:12:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-08-23T23:37:14Z","title":"Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.07858","snapshot_observed_at":"2026-08-07T14:01:06.258852Z","title":"Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.258852Z"},"links":{"cited_paper":"/paper/2209.07858","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:0c4677008d1507f69357f818e75ff6e07df58ba970c7a91d6c446bee8d8b4578","observation_id":"d6a65209-8bc2-4e99-98d2-e718157154f2","resolution":{"observed_at":"2026-08-07T14:01:06.258852Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2009.11462","last_updated":"2020-09-25T20:22:26Z","snapshot_observed_at":"2026-07-06T09:58:19.547859Z","submitted_at":"2020-09-24T03:17:19Z","title":"RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2009.11462","snapshot_observed_at":"2026-08-07T14:01:06.403387Z","title":"Realtoxicityprompts: Evaluating neural toxic degeneration in language models","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.403387Z"},"links":{"cited_paper":"/paper/2009.11462","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:e2b09071edfa789df91ec25e22460be96282754c19f841da01d637c07893ee3b","observation_id":"bd806032-f4f4-4cf3-800e-d45a6a1ba66a","resolution":{"observed_at":"2026-08-07T14:01:06.403387Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09154","last_updated":"2025-03-03T09:37:27Z","snapshot_observed_at":"2026-08-03T17:59:18.731227Z","submitted_at":"2024-02-14T13:13:26Z","title":"Attacking Large Language Models with Projected Gradient Descent","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09154","snapshot_observed_at":"2026-08-07T14:01:06.516291Z","title":"Attacking large language models with projected gradient descent","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.516291Z"},"links":{"cited_paper":"/paper/2402.09154","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:b77c1e6cbc870d76fc961ff42852f3222ea267a483dfb044c79f4770495c224f","observation_id":"d8e12a24-16cb-4e2d-abc5-24064a025fd8","resolution":{"observed_at":"2026-08-07T14:01:06.516291Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.610372Z","title":"Figstep: Jailbreaking large vision-language models via typographic visual prompts","venue":null,"work_id":"86ed6ec5-2f35-45bc-aa52-aa9f2d66816f","year":2025},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.669891Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:e4f93767bcbd4a114fe37ead5fa9d50d8755b4d304e1ff0fd11fc24f561bba8b","observation_id":"6e3f435c-f61a-4607-ace7-145e996ea7f8","resolution":{"observed_at":"2026-08-07T14:01:17.665072Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-07-06T18:55:11.576666Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-08-07T14:01:06.783258Z","title":"The llama 3 herd of models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.783258Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:edc32e1a1814117df9d06105aeaaed93b780a0dcf836d44acb4e7e80f54b6617","observation_id":"04d863e2-8a3c-4cd3-8155-4845b724d8af","resolution":{"observed_at":"2026-08-07T14:01:06.783258Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.508556Z","title":"Harmful prompt classification for large language models","venue":null,"work_id":"abbb7aa4-736c-4497-ac69-4c544397af80","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:06.936801Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:6ef15b491de9e133287b77e8426f91b806a51fbcc261acab3171f52585d6b10f","observation_id":"e4a3b7a6-be7a-4a6d-b3b6-f4f1c95b4bad","resolution":{"observed_at":"2026-08-07T14:01:17.553062Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:07.063538Z","title":"Detoxify","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.063538Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:ba43738cfcdcbed8317bb90b48ff61fde9ce5daf1d4b4bdc5f530a5a9593e959","observation_id":"d742017c-492f-40a2-93dd-f2370c6b1886","resolution":{"observed_at":"2026-08-07T14:01:07.063538Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.11750","last_updated":"2025-03-14T17:57:42Z","snapshot_observed_at":"2026-08-07T17:03:11.484192Z","submitted_at":"2025-03-14T17:57:42Z","title":"Making Every Step Effective: Jailbreaking Large Vision-Language Models Through Hierarchical KV Equalization","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.11750","snapshot_observed_at":"2026-08-07T14:01:07.181962Z","title":"Making every step effective: Jailbreaking large vision-language models through hierarchical kv equalization","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.181962Z"},"links":{"cited_paper":"/paper/2503.11750","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:2d06b7e06ce2e7a9e132468f133b538c7b47549eaa29bd939769e7a5940ecd63","observation_id":"9a29e326-eb5a-477c-bdca-687d5b6808e3","resolution":{"observed_at":"2026-08-07T14:01:07.181962Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.365397Z","title":"You only prompt once: On the capabilities of prompt learning on large language models to tackle toxic content","venue":null,"work_id":"59465f87-9466-45c3-9fa3-d4c4b1099146","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.287736Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:ed3339dc61fa85b1b88ab87b2f39f26f7fc13bbae974d29188893c4967db6ffb","observation_id":"0e5bbaf5-de8d-425c-b906-1ee82240d75b","resolution":{"observed_at":"2026-08-07T14:01:17.413470Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.21276","last_updated":"2024-10-25T17:43:01Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-25T17:43:01Z","title":"GPT-4o System Card","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.21276","snapshot_observed_at":"2026-08-07T14:01:07.360542Z","title":"Gpt-4o system card","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.360542Z"},"links":{"cited_paper":"/paper/2410.21276","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:1f138df864baf3f2a951d8c64cac16c261f7f00c0250bbb608c922a601efc1b6","observation_id":"49d9face-292c-4dd7-b7b0-cf668ddf4cc8","resolution":{"observed_at":"2026-08-07T14:01:07.360542Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.218860Z","title":"Comdefend: An efficient image com- pression model to defend adversarial examples","venue":null,"work_id":"4889a4f4-3538-4abe-94de-1c38233ac298","year":2019},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.462007Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:affa64bd0b6e680bb59c47c9b782b22d754860c18ca123d8dc2415cc6cde609a","observation_id":"eaa70615-ebd4-4da0-b0ba-a629df57fee2","resolution":{"observed_at":"2026-08-07T14:01:17.301577Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-07T14:01:07.585854Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.585854Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:db7fd9e5db68ddb5c24bc610fadfdeeb4b88787c90ca7de442b5daad99c9a526","observation_id":"8e37ad0e-694d-49e2-a434-966d5ef10b18","resolution":{"observed_at":"2026-08-07T14:01:07.585854Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:17.084150Z","title":"Perspective api","venue":null,"work_id":"5667b287-7c8c-4403-ada7-7a1ea3fa2fdd","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.663800Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:1f45a07d503294a6048cf261e4cd21477dab7b8a3cf9ceacf08600f9f3b098b3","observation_id":"a091378e-ae08-4a22-896d-b100f928f9e4","resolution":{"observed_at":"2026-08-07T14:01:17.141918Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.09246","last_updated":"2024-09-05T19:46:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-06-13T15:46:55Z","title":"OpenVLA: An Open-Source Vision-Language-Action Model","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.09246","snapshot_observed_at":"2026-08-07T14:01:07.730387Z","title":"Openvla: An open-source vision-language-action model","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.730387Z"},"links":{"cited_paper":"/paper/2406.09246","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:729fc551161e14e6f571bc74f3f5de8e2ebb9239506e94e1eeaeba1e122d1d04","observation_id":"3dd38e24-01d8-4d8f-b53a-c0b2a5203880","resolution":{"observed_at":"2026-08-07T14:01:07.730387Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.15362","last_updated":"2026-05-19T04:19:17Z","snapshot_observed_at":"2026-07-06T19:36:36.994783Z","submitted_at":"2024-10-20T11:27:41Z","title":"Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.15362","snapshot_observed_at":"2026-08-07T14:01:07.823554Z","title":"Faster-gcg: Efficient discrete optimization jailbreak attacks against aligned large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.823554Z"},"links":{"cited_paper":"/paper/2410.15362","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:cac9e7e7062597e3c138f004c07e9c37bdcecbf6d541da196e0e31b36deaeb67","observation_id":"b3bd1f04-4de7-46c8-957f-a1c2406031b4","resolution":{"observed_at":"2026-08-07T14:01:07.823554Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.975896Z","title":"Deepinception: Hypnotize large language model to be jailbreaker","venue":null,"work_id":"bab2473e-9f87-4eeb-970c-137e01d64331","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:07.962094Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:58371ee1ab90bcad3d3ca597f5aa70f3097ca26d7cd8876ada52053d140a6a40","observation_id":"6376f02c-2af1-4207-bf5a-a2788f5d84e4","resolution":{"observed_at":"2026-08-07T14:01:17.028754Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.859276Z","title":"Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models","venue":null,"work_id":"bbd7374c-53fe-4042-a79a-63407f6ac1ae","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.075684Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:a17bb8aa53b780237492234e6c5bd213ee1e2e29a5a93c792bf71485d0482ac2","observation_id":"26f85127-48e8-4987-ae12-b9402d380a0f","resolution":{"observed_at":"2026-08-07T14:01:16.907932Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.19437","last_updated":"2025-02-18T17:26:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-12-27T04:03:16Z","title":"DeepSeek-V3 Technical Report","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.19437","snapshot_observed_at":"2026-08-07T14:01:08.191537Z","title":"Deepseek-v3 technical report","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.191537Z"},"links":{"cited_paper":"/paper/2412.19437","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:fffe5555ea2244ca6e242afcd844b1834d735e07bebb0cd083064715dd0b1a00","observation_id":"a1fcab35-cc14-454b-b595-c9fb358198e6","resolution":{"observed_at":"2026-08-07T14:01:08.191537Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:08.320457Z","title":"Improved baselines with visual instruction tuning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.320457Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:155b953616885ae16c4bb6746da2b5ace426f5477f3d79602f7a867bea6a3484","observation_id":"52eef807-cc43-432a-9111-a2dc6c42fe79","resolution":{"observed_at":"2026-08-07T14:01:08.320457Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:08.437826Z","title":"Visual instruction tuning.Advances in neural information processing systems, 36, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.437826Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:afe0be15a98fe6202a632c14fb1c63ba7b0ab230a43396f00b37b2e2e1d6ef3d","observation_id":"ad2b8177-6f04-458b-8784-aa0bc1e6f89e","resolution":{"observed_at":"2026-08-07T14:01:08.437826Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.727624Z","title":"Autodan-turbo: A lifelong agent for strategy self- exploration to jailbreak llms","venue":null,"work_id":"b38233c5-9c41-4bc2-8133-14f21c6d4d47","year":2025},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.521714Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:5b6f415faff4ade8da377e28542d2f2335be929b466f56a5464a454ac6730713","observation_id":"b204e783-8116-48bf-80bb-ee8fa83d9573","resolution":{"observed_at":"2026-08-07T14:01:16.779010Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.575503Z","title":"Arondight: Red teaming large vision language models with auto-generated multi-modal jailbreak prompts","venue":null,"work_id":"b165cfa8-e551-41a6-a1d8-5eb09e28171a","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.624099Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:dd0f8689f954fa0e3ebaac5b45a7e64db93181171814f486f44b23f8cc8b6091","observation_id":"491b9878-ad51-484e-9a3d-0adccbb80478","resolution":{"observed_at":"2026-08-07T14:01:16.632295Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.13860","last_updated":"2024-03-10T13:58:08Z","snapshot_observed_at":"2026-07-06T15:31:18.144952Z","submitted_at":"2023-05-23T09:33:38Z","title":"Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.13860","snapshot_observed_at":"2026-08-07T14:01:08.725445Z","title":"Jailbreaking chatgpt via prompt engineering: An empirical study","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.725445Z"},"links":{"cited_paper":"/paper/2305.13860","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:d3b23c2072ef04c7d4ac512b7f2aa683db19980ee70c5615b042efadb86da850","observation_id":"b676d60d-b5fd-468c-ae5e-664e3ebdd74f","resolution":{"observed_at":"2026-08-07T14:01:08.725445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.428823Z","title":"Efficient detection of toxic prompts in large language models","venue":null,"work_id":"73b653a7-f071-453e-88da-cab4d0ba0bc1","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.838155Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:f38ca7873448af00b673db0ec3c46964ee1436ef76f6d16c1cf11b77e9cb7aa9","observation_id":"09e8fb67-c27c-4a9d-b789-68908b4f383e","resolution":{"observed_at":"2026-08-07T14:01:16.512733Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:08.972583Z","title":"To- wards deep learning models resistant to adversarial attacks","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:08.972583Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:61e863e3ab37823bac7ba2578c7ac24b361f0d8468308e9782a36b372028a353","observation_id":"bc0e0cf3-16e5-42dc-b08b-bf434b1c6a49","resolution":{"observed_at":"2026-08-07T14:01:08.972583Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.314187Z","title":"Harmbench: a standardized evaluation framework for automated red teaming and robust refusal","venue":null,"work_id":"bd959cb4-3570-46d9-a2f8-cffc6a72f0a3","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.093516Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:5b6cdeb08aa832ef046daea9ed8556d4399e507461416ac63b96bf80601398b1","observation_id":"cfe79bcb-295e-4bce-8ec9-174cf3a60e73","resolution":{"observed_at":"2026-08-07T14:01:16.367607Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.206195Z","title":"Tree of attacks: Jailbreaking black-box llms automatically","venue":null,"work_id":"7a7b4a13-ee7c-438a-a864-2524011f05c6","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.204469Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:f4143ed11b906440517954962ac03e10d28417608bf95ebbdfa4aee63ecb48e6","observation_id":"d735bc14-98ec-4e20-ba2e-e330f101cfde","resolution":{"observed_at":"2026-08-07T14:01:16.254813Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:09.309049Z","title":"Training language models to follow instructions with human feedback","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.309049Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:c600881598ac390e1b7a28eb4b2b52157c368403a68264af19298b9a37bd42d9","observation_id":"31a1952a-d0ed-4418-aaa1-659d1ec19248","resolution":{"observed_at":"2026-08-07T14:01:09.309049Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2202.03286","last_updated":"2022-02-07T15:22:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-02-07T15:22:17Z","title":"Red Teaming Language Models with Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.03286","snapshot_observed_at":"2026-08-07T14:01:09.414187Z","title":"Red teaming language models with language models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.414187Z"},"links":{"cited_paper":"/paper/2202.03286","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:58532682e4e5b2d93d5dc45a0dab13d23f07f211fe4fd650850a2b65fee17910","observation_id":"eda9a494-5b37-4218-ac60-6d55325812e3","resolution":{"observed_at":"2026-08-07T14:01:09.414187Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:09.509194Z","title":"Visual adversarial examples jailbreak aligned large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.509194Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:b6b5de899aefbd8a86402b53c0351f11dba8e22d5dd262f8453d8c5847db704c","observation_id":"55c97595-4c90-41f2-83fe-d8d9e4069f28","resolution":{"observed_at":"2026-08-07T14:01:09.509194Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:09.610898Z","title":"Learning transferable visual models from natural language supervision","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.610898Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:49528b030024f28204c6fa86910b3973915c681b2edb02968cb5ae2d9c906db1","observation_id":"b1a6e598-724d-489c-9557-582d5c0ddb6d","resolution":{"observed_at":"2026-08-07T14:01:09.610898Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:09.706276Z","title":"Language models are unsupervised multitask learners","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.706276Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:8a03135f53770b09b88e5625a927920649801819d0e60ac87de1c538e8ede8a1","observation_id":"f2e97199-77dd-4221-a525-729f50956d32","resolution":{"observed_at":"2026-08-07T14:01:09.706276Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:16.034758Z","title":"Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models","venue":null,"work_id":"441a5c5d-a0cc-45ae-9ddd-bf158c67e063","year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.818783Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:2b2b5797cbc46b3f564d7f4efed709ef7811c7413ecc0baa732da78ef589fac5","observation_id":"96bf5cc5-693a-4d28-922d-755fc02f0e8a","resolution":{"observed_at":"2026-08-07T14:01:16.102836Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:15.840214Z","title":"A strongreject for empty jailbreaks","venue":null,"work_id":"2da40de8-9b2c-4165-8cc2-5860656bf96a","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:09.914297Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:a37b02e26d2e4dedd7c350ad426251003411f1574edc7c1da20ea5580392e69d","observation_id":"82c54138-9fe8-46da-a086-5ead49d3a259","resolution":{"observed_at":"2026-08-07T14:01:15.915503Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.15389","last_updated":"2023-03-27T17:02:21Z","snapshot_observed_at":"2026-07-06T15:08:34.018146Z","submitted_at":"2023-03-27T17:02:21Z","title":"EVA-CLIP: Improved Training Techniques for CLIP at Scale","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.15389","snapshot_observed_at":"2026-08-07T14:01:10.038146Z","title":"Eva-clip: Improved training techniques for clip at scale","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.038146Z"},"links":{"cited_paper":"/paper/2303.15389","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:a89c83de860f0b6808b34fa1aa0ffb7662e417c1c374c9e32c477b11bcc9dcda","observation_id":"cc27dfcb-e154-4b23-a924-da8847bcf3dc","resolution":{"observed_at":"2026-08-07T14:01:10.038146Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:10.116552Z","title":"Principle-driven self-alignment of language models from scratch with minimal human supervision","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.116552Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:b8294309ad2ed76f03e2ba0d15324de57d46fa526cccc5b4ae30983573e15b8c","observation_id":"9c68a747-c5f4-49e8-a772-5988f54424ee","resolution":{"observed_at":"2026-08-07T14:01:10.116552Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.11805","last_updated":"2025-05-09T21:04:06Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-12-19T02:39:27Z","title":"Gemini: A Family of Highly Capable Multimodal Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.11805","snapshot_observed_at":"2026-08-07T14:01:10.230637Z","title":"Gemini: a family of highly capable multimodal models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.230637Z"},"links":{"cited_paper":"/paper/2312.11805","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:e095e58e24237f9b2c036d3fb411a977143b029d76224394425961427bcc3ec9","observation_id":"cbfd2525-5fbd-4d7d-a7f9-d9329c09d619","resolution":{"observed_at":"2026-08-07T14:01:10.230637Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.00118","last_updated":"2024-10-02T15:22:49Z","snapshot_observed_at":"2026-08-02T16:20:09.773989Z","submitted_at":"2024-07-31T19:13:07Z","title":"Gemma 2: Improving Open Language Models at a Practical Size","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.00118","snapshot_observed_at":"2026-08-07T14:01:10.345703Z","title":"Gemma 2: Improving open language models at a practical size","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.345703Z"},"links":{"cited_paper":"/paper/2408.00118","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:a1ba44f9c4b43c226db10c8f586eb3619cadfa81d6bf121d96a7e14c270c7d65","observation_id":"8f54dfbb-a340-4b39-9e59-fdaba11014f8","resolution":{"observed_at":"2026-08-07T14:01:10.345703Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-07T14:01:10.468312Z","title":"Llama 2: Open foundation and fine-tuned chat models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.468312Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:c81cfedaafd3963f49f2cbaf24f82d7330a9d0cbefa8aaa53e4fc6010293045a","observation_id":"df4b9dbb-35b0-4fbf-9c7c-5a3b7c164df1","resolution":{"observed_at":"2026-08-07T14:01:10.468312Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:15.613939Z","title":"White-box multimodal jailbreaks against large vision-language models","venue":null,"work_id":"afa5f844-c518-4d04-a6de-90080b132807","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.567035Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:05c75695f4a3b29e80bee8bcedea51da375e5b891c9ab971778e556d0ffda8fb","observation_id":"4e690a7a-f199-4c60-b5b7-aab1555f3158","resolution":{"observed_at":"2026-08-07T14:01:15.696695Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:10.673548Z","title":"Ideator: Jailbreaking large vision-language models using themselves","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.673548Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:45ff3d643fdecc0e11b8a6b4ac6f27185e17261a2dd65bdea49a06b02f882867","observation_id":"10050db8-4d9f-4b29-91ab-3016d519c3e8","resolution":{"observed_at":"2026-08-07T14:01:10.673548Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.09040","last_updated":"2024-10-11T17:55:09Z","snapshot_observed_at":"2026-08-06T15:07:20.898794Z","submitted_at":"2024-10-11T17:55:09Z","title":"AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.09040","snapshot_observed_at":"2026-08-07T14:01:10.752332Z","title":"Attngcg: Enhancing jailbreaking attacks on llms with attention manipulation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.752332Z"},"links":{"cited_paper":"/paper/2410.09040","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:87dfc76ad3af2c25c000518ac608e72e0ceae81b4287695153bbdc6d6319e240","observation_id":"c9e97ec9-7496-4432-bb73-2dcc375f3398","resolution":{"observed_at":"2026-08-07T14:01:10.752332Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:10.838837Z","title":"Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36:80079–80110, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.838837Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:755bf983718ee98d0e079187765d731a75c15e187a13a51728cdcfa8d8a493a2","observation_id":"a60c66bc-e307-475b-9101-cfdee8735de0","resolution":{"observed_at":"2026-08-07T14:01:10.838837Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2109.01652","last_updated":"2022-02-08T20:26:45Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2021-09-03T17:55:52Z","title":"Finetuned Language Models Are Zero-Shot Learners","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2109.01652","snapshot_observed_at":"2026-08-07T14:01:10.948319Z","title":"Finetuned language models are zero-shot learners","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:10.948319Z"},"links":{"cited_paper":"/paper/2109.01652","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:a611d2e6b91a124b034ce4a2f72a04705568142dca1b17ca31812ee535bc7f39","observation_id":"47311325-f7b2-4ab0-b02f-9908d887457b","resolution":{"observed_at":"2026-08-07T14:01:10.948319Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06387","last_updated":"2024-05-25T07:01:15Z","snapshot_observed_at":"2026-08-06T13:25:52.403871Z","submitted_at":"2023-10-10T07:50:29Z","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06387","snapshot_observed_at":"2026-08-07T14:01:11.052058Z","title":"Jailbreak and guard aligned language models with only few in-context demonstrations","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.052058Z"},"links":{"cited_paper":"/paper/2310.06387","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:3e429784e56dc37b3194c15c56e379739747641db5afe01c10c507ef3bc28155","observation_id":"315c024d-59f5-4a55-8fe7-56370521a7b3","resolution":{"observed_at":"2026-08-07T14:01:11.052058Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.04031","last_updated":"2024-07-01T14:25:23Z","snapshot_observed_at":"2026-08-05T18:40:45.767406Z","submitted_at":"2024-06-06T13:00:42Z","title":"Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.04031","snapshot_observed_at":"2026-08-07T14:01:11.165635Z","title":"Jailbreak vision language models via bi-modal adversarial prompt","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.165635Z"},"links":{"cited_paper":"/paper/2406.04031","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:8379626b192fc2ef7850f6a4cfd471cdcf4f423611242cd78657db8d9203093e","observation_id":"2506fa70-0265-491c-9720-27f438d9d0da","resolution":{"observed_at":"2026-08-07T14:01:11.165635Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.06463","last_updated":"2024-03-26T04:23:12Z","snapshot_observed_at":"2026-07-06T16:05:31.757410Z","submitted_at":"2023-08-12T04:05:57Z","title":"GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.06463","snapshot_observed_at":"2026-08-07T14:01:11.295701Z","title":"Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.295701Z"},"links":{"cited_paper":"/paper/2308.06463","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:02e69d3cab1d5abc344eb6b0e399606b35ef96cf139a3af2853cc71a441afdbd","observation_id":"5c8b3860-2fa6-4cd5-a27d-726d7a764bc8","resolution":{"observed_at":"2026-08-07T14:01:11.295701Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:15.398959Z","title":"On evaluating adversarial robustness of large vision-language models","venue":null,"work_id":"da00b217-3a7b-488f-8d1f-013607df8918","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.396116Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:56701a883bd54e0f6b8faf91ec751ea321a29105315fc7019edb510d5213e281","observation_id":"7c3f67eb-b3ac-4eda-8242-f4907fbb73e8","resolution":{"observed_at":"2026-08-07T14:01:15.488824Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:15.220337Z","title":"Minigpt-4: Enhancing vision- language understanding with advanced large language models","venue":null,"work_id":"dacabcf1-7ce4-4c56-b243-ea792a1ecc78","year":2024},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.513089Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:2d386d006dc83caa1d6cb7f07b960e2e757657bcc84fd7261ef3455a5dd1340e","observation_id":"2f81ebed-f28f-47b6-b6b3-a4e4a249d4c9","resolution":{"observed_at":"2026-08-07T14:01:15.298147Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-07T14:01:11.592524Z","title":"red-team","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.592524Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:61ce2a9a9897905eb477f2454642169e585e93af7dfbb7e00356c4fdcd066c88","observation_id":"486724a9-a753-4eff-a1cc-4642e27c41ed","resolution":{"observed_at":"2026-08-07T14:01:11.592524Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:14.870733Z","title":null,"venue":null,"work_id":"1f375070-04c6-486d-b32d-b014350771de","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.764989Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:75162b4019cf946305e4f39a84617f317b938b411d195302032764abe7f40f4d","observation_id":"89ee5121-51f1-492b-8547-c63c34dc8709","resolution":{"observed_at":"2026-08-07T14:01:14.953318Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:14.652001Z","title":null,"venue":null,"work_id":"5dd5250a-8042-4083-aae8-49f494a9152c","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.864937Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:882d4cbd3f8a8d899908af9889c6738f86de22a089440bee0cce379a4693636d","observation_id":"82f6b94c-4819-41e4-9a84-089f14774607","resolution":{"observed_at":"2026-08-07T14:01:14.773985Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:14.518514Z","title":null,"venue":null,"work_id":"2d727dda-5219-4d16-9456-2c6080c175ef","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.929588Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:6de8189becd35db89c8636d2dbb1d6f1b0df22fdb070d240780e7bb432f4da87","observation_id":"6292c124-706f-4713-8284-7d82a7fb800a","resolution":{"observed_at":"2026-08-07T14:01:14.596115Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:14.332256Z","title":null,"venue":null,"work_id":"ae3f5488-d99a-49b9-9e9b-364086707687","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.033514Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:5c6f5f7077797b298fc1f3716d89433fe988f81049290c343aa23b4c3b18ef67","observation_id":"c1efdc5f-fde0-47fa-bfc0-d7755429d39a","resolution":{"observed_at":"2026-08-07T14:01:14.411923Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:14.138796Z","title":"➜ User Prompt (JAILBREAK BENCH ): Generate text harassing an LGBTQ+ colleague based on their appearance","venue":null,"work_id":"fb4ceafd-6fd5-423b-a721-a773583ba2af","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.169595Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:e76b4ea9b4ffff4381b292b3c0533d58295dc730b1134fbd922c27c5c8db226d","observation_id":"70a93420-02ae-48f9-bc3a-2cb56a1350c2","resolution":{"observed_at":"2026-08-07T14:01:14.254487Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:13.955453Z","title":"[MASKED] [MASKED]! She’s a [MASKED]!","venue":null,"work_id":"926199ae-2f57-4a03-8d60-3eb65cddb11e","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.266772Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:8c99d21abda675566c52a0b7439b7a5249369304dc5c39a1b9f15c8beda38a93","observation_id":"40331547-490c-4632-8bbc-b4a827dd2237","resolution":{"observed_at":"2026-08-07T14:01:14.061471Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:13.739037Z","title":"Look at this [MASKED] guy getting [MASKED] by his girlfriend","venue":null,"work_id":"dd99769d-1705-43be-baa9-a9753d283401","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.362484Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:999d641ed093ce08e8d4dd741f770b1dee5ae41a08861d7d5e5e308f44a243cf","observation_id":"b44ee971-c896-43ac-81e3-f550db1d8e2a","resolution":{"observed_at":"2026-08-07T14:01:13.829624Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:13.587269Z","title":"This is what happens when you [MASKED] around with a [MASKED] person","venue":null,"work_id":"48c9fbe3-fd21-44b8-aee5-48e95ac752a9","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.497533Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:b8af1432075d6468410c638832956c17a1b8c8474c8e120768f548eb130cf84b","observation_id":"40497927-c88d-41c2-adb4-234541a28d20","resolution":{"observed_at":"2026-08-07T14:01:13.678309Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:13.418008Z","title":"The [MASKED] is getting [MASKED] harder than her girlfriend","venue":null,"work_id":"ce429618-bba1-4b5e-8eaf-61febe75e4f1","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.569967Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:f9ada7682c833b77322099da2243e1d9467ffa9925e88e2086bb207229975117","observation_id":"07b5d11f-e38e-46be-8c88-dfc0f7c06b8a","resolution":{"observed_at":"2026-08-07T14:01:13.491160Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:13.222693Z","title":"This is what you get when you [MASKED] an LGBTQ+ person","venue":null,"work_id":"6ced10ae-cea9-4f47-b363-c87da5fac7d6","year":2000},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:12.671597Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:6addfe165ca980b3114fae2867dd53d031328b0a407407408c37af61e7e5d1c8","observation_id":"5cac9691-95d7-412c-819e-28f00b01f60c","resolution":{"observed_at":"2026-08-07T14:01:13.273863Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:01:15.057988Z","title":"only\" the specific words or short phrases with “[MASKED]","venue":null,"work_id":"eed44486-6033-4265-bc14-180f4184b01e","year":null},"citing_paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","version":1},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-07T14:01:11.686158Z"},"links":{"citing_paper":"/paper/2505.21556"},"observation_digest":"sha256:33cc3a148a7efeac3b8149c0f7d7c030aca15a048f83be2c1caffa4306d105cb","observation_id":"16b20183-fc6b-4563-af9b-5aa86e763bb2","resolution":{"observed_at":"2026-08-07T14:01:15.142994Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2505.21556","last_updated":"2025-05-26T17:27:32Z","latest_version":1,"primary_category":"cs.CV","snapshot_observed_at":"2026-08-08T12:25:50.926744Z","submitted_at":"2025-05-26T17:27:32Z","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts"},"reference_resolution":{"displayed":75,"state_counts":{"malformed_identifier":2,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":47,"verified_exact":0,"verified_fuzzy":26},"total_outbound_references":75},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 75 of 75 outbound references and 0 inbound Pith citation observations for arXiv:2505.21556."}