{"as_of":"2026-08-07T23:11:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:8e01cf9431436cf3b74b50645b9a5b9f549b6ac162dbefc6af71ad7d9875def0","coverage":[{"denominator":28,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":28,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T19:46:27.712204Z","state":"measured"},{"denominator":28,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":28,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-07T06:34:17.273281+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2507.04673/citation-record","integrity":"/paper/2507.04673/integrity","json":"/paper/2507.04673/citation-record.json","paper":"/paper/2507.04673"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:25.135856Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.135856Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:92df0315b05e664db87060c0171c8057e119afc790584e3025dc7bb9cd3c52ec","observation_id":"cbe1ae7c-e1cd-4754-b783-12ba81f019ae","resolution":{"observed_at":"2026-08-06T19:46:25.135856Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05608","last_updated":"2025-01-19T16:23:38Z","snapshot_observed_at":"2026-07-06T16:45:24.070954Z","submitted_at":"2023-11-09T18:59:11Z","title":"FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05608","snapshot_observed_at":"2026-08-06T19:46:25.203611Z","title":"& Wang, X","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.203611Z"},"links":{"cited_paper":"/paper/2311.05608","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:5a834f2c3ec3975446cec324442e97d1141616b68adf109b9339d170f594586c","observation_id":"68b78950-31ea-4ae7-a11a-c446900e07a2","resolution":{"observed_at":"2026-08-06T19:46:25.203611Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.00523","last_updated":"2025-06-24T18:55:29Z","snapshot_observed_at":"2026-07-06T18:55:32.910650Z","submitted_at":"2024-08-01T12:54:46Z","title":"Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.00523","snapshot_observed_at":"2026-08-06T19:46:25.332759Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.332759Z"},"links":{"cited_paper":"/paper/2408.00523","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:3b6ade1f6e557068e5768ab09468d37e5239e71a51c7b70918365dad6c04c1bd","observation_id":"02c6bfce-8387-4b88-961f-51cdbc6e695a","resolution":{"observed_at":"2026-08-06T19:46:25.332759Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:30.246528Z","title":"& Lowe, R","venue":null,"work_id":"1a26c7d4-c796-4341-80ad-86fef46c59b8","year":2022},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.420968Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:066542890edc69f7414be07feb2b7cb7315f0a1ada73fb6b16afb2dbbca5961d","observation_id":"42e7b7f6-a4ff-454f-98b2-b7b0f6a236fd","resolution":{"observed_at":"2026-08-06T19:46:30.312037Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.11054","last_updated":"2025-03-11T03:06:17Z","snapshot_observed_at":"2026-08-07T18:15:02.415148Z","submitted_at":"2025-02-16T09:27:44Z","title":"Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.11054","snapshot_observed_at":"2026-08-06T19:46:25.503493Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.503493Z"},"links":{"cited_paper":"/paper/2502.11054","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:501f47110bc812954610cd5b6307bfd4de3ecda20598faf85579dddd852a40bb","observation_id":"39ef1738-b7ea-4156-ba56-a47d600122a4","resolution":{"observed_at":"2026-08-06T19:46:25.503493Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2202.03286","last_updated":"2022-02-07T15:22:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-02-07T15:22:17Z","title":"Red Teaming Language Models with Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.03286","snapshot_observed_at":"2026-08-06T19:46:25.612647Z","title":"& Kaplan, J","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.612647Z"},"links":{"cited_paper":"/paper/2202.03286","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:86f76e3a5f723c27f6ebf2be2a38641d6b6bf039dd3813b1fed7d288387e0081","observation_id":"a68bd5e6-34fd-4093-8a56-43f078dbbba9","resolution":{"observed_at":"2026-08-06T19:46:25.612647Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.07858","last_updated":"2022-11-22T19:12:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-08-23T23:37:14Z","title":"Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.07858","snapshot_observed_at":"2026-08-06T19:46:25.761176Z","title":"& Amodei, D","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.761176Z"},"links":{"cited_paper":"/paper/2209.07858","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:d9ef81fa8b347da8c959070f15b9891689d3aff9e26ac7f069b3dd0aa1fd39d5","observation_id":"6433a5ab-e4ec-4c88-93f2-acf3754ec031","resolution":{"observed_at":"2026-08-06T19:46:25.761176Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-06T19:46:25.870469Z","title":"Z., & Fredrikson, M","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.870469Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:484dbf4a0c7a82d12191f652b249e13efa9ae54e2988cb8db92096e3f381cf6f","observation_id":"3d0799c7-1f3f-4ff7-b50c-591d077226c6","resolution":{"observed_at":"2026-08-06T19:46:25.870469Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:30.072901Z","title":null,"venue":null,"work_id":"53a9a3fb-b0c3-441f-98ea-8cb1bcfa4b88","year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:25.984097Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:256ac7b287de62b50d8dd2dd182337b398bce51c32edea80d866bde529cc21a7","observation_id":"7fd45238-5c2f-435e-842e-0f93b792de74","resolution":{"observed_at":"2026-08-06T19:46:30.169777Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:29.858851Z","title":null,"venue":null,"work_id":"3f7ca015-f4e7-4970-abd1-4634c8ebe981","year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.136525Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:5eb04bd08574ed1981efbaf36c2fc1a4b170bd0571a6ccd9658067594b754d57","observation_id":"c72c4f5c-94a3-4041-b26b-747ee4884a48","resolution":{"observed_at":"2026-08-06T19:46:29.946114Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2409.19149","last_updated":"2025-06-10T19:36:10Z","snapshot_observed_at":"2026-08-03T04:45:18.519490Z","submitted_at":"2024-09-27T21:23:46Z","title":"Multimodal Pragmatic Jailbreak on Text-to-image Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.19149","snapshot_observed_at":"2026-08-06T19:46:26.221727Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.221727Z"},"links":{"cited_paper":"/paper/2409.19149","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:14b1125858129ea9ed529f71745b885aa09f66310f82abef10c2712e62b71e2a","observation_id":"129cc2a2-71a6-4f6e-9f65-da89169c3590","resolution":{"observed_at":"2026-08-06T19:46:26.221727Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-08-06T19:46:26.337360Z","title":"& Kaplan, J","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.337360Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:4a7e76617ccec75fb958537d28329f387f75517eae6eab6ed8a2cd71d277c28b","observation_id":"86029344-f94f-4cc8-958d-392e967e577e","resolution":{"observed_at":"2026-08-06T19:46:26.337360Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:29.686237Z","title":"F., Leike, J., Brown, T., Martic, M., Legg, S., & Amodei, D","venue":null,"work_id":"53f7dc3e-d2d8-4cd7-825a-aa9c260da230","year":2017},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.401264Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:06f443c24e399f87a338865df2bef2a2ecdf12227911dc90df3e49d00dea255b","observation_id":"5b2c57e0-11c6-4d76-903a-19dec5ccff73","resolution":{"observed_at":"2026-08-06T19:46:29.747993Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-08-06T19:46:26.491295Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.491295Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:0a5aa4b5cc075b97b301587d2bdf762716e98c9de2e0de28996cae7d6ed1583c","observation_id":"0d2a6696-a20a-4316-9611-5342157ccb23","resolution":{"observed_at":"2026-08-06T19:46:26.491295Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.11753","last_updated":"2024-06-07T17:35:17Z","snapshot_observed_at":"2026-07-06T17:31:58.268105Z","submitted_at":"2024-02-19T00:43:31Z","title":"ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.11753","snapshot_observed_at":"2026-08-06T19:46:26.685840Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.685840Z"},"links":{"cited_paper":"/paper/2402.11753","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:d50692bf1a5815e07d2c1623e4cab002490f93eb7bc76719874c583f95862e4a","observation_id":"e6418170-4cf4-49d2-b7f2-4d1e2b9b094d","resolution":{"observed_at":"2026-08-06T19:46:26.685840Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.03869","last_updated":"2025-06-03T17:32:00Z","snapshot_observed_at":"2026-07-06T19:28:08.374354Z","submitted_at":"2024-10-04T19:04:43Z","title":"Chain-of-Jailbreak Attack for Image Generation Models via Editing Step by Step","version":2},"cited_work":{"arxiv_id":"2410.03869","doi":null,"metadata_source":"pith","pith_arxiv_id":"2410.03869","snapshot_observed_at":"2026-08-06T19:46:28.631936Z","title":"Chain-of-Jailbreak Attack for Image Generation Models via Editing Step by Step","venue":"cs.CL","work_id":"3841591b-77d8-42e0-bd29-587182cabcd0","year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.766578Z"},"links":{"cited_paper":"/paper/2410.03869","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:5d58ae0a2bfb336f20030d0c20d474f54a06108da6aaa63c730b83f60ef6369a","observation_id":"2b6982bd-78ac-4b73-aa55-315d166a41e4","resolution":{"observed_at":"2026-08-06T19:46:28.715500Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2503.17987","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:28.953355Z","title":null,"venue":null,"work_id":"cdd2ff4a-1216-4ba0-9544-11142958beb2","year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.858023Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:f79552178ede3faa11ddbe1fbc2f147d65c25ccd45ddc6ef97dc310f9aaab471","observation_id":"e4dedf08-ce85-4eb0-92da-562fef96fbe0","resolution":{"observed_at":"2026-08-06T19:46:29.028272Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.10047","last_updated":"2025-06-11T09:09:12Z","snapshot_observed_at":"2026-08-07T04:43:52.945667Z","submitted_at":"2025-06-11T09:09:12Z","title":"GenBreak: Red Teaming Text-to-Image Generators Using Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.10047","snapshot_observed_at":"2026-08-06T19:46:26.940175Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.940175Z"},"links":{"cited_paper":"/paper/2506.10047","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:ebb495809cfdcfd4ddadc80b8c1d8fc8a7437b296192ebf0a7c01f82a8d6977d","observation_id":"5128f266-0187-4ed2-974e-3b94f5a72697","resolution":{"observed_at":"2026-08-06T19:46:26.940175Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.04931","last_updated":"2025-06-27T10:07:29Z","snapshot_observed_at":"2026-07-06T20:18:31.039569Z","submitted_at":"2025-01-09T02:47:01Z","title":"Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.04931","snapshot_observed_at":"2026-08-06T19:46:26.999796Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:26.999796Z"},"links":{"cited_paper":"/paper/2501.04931","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:2207db047d0e49c823857edf4d4bb7038898f994a830bba33c6a468b0d4f18c1","observation_id":"0a5cbd56-88a6-4c88-8df7-b6e574ac8c03","resolution":{"observed_at":"2026-08-06T19:46:26.999796Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.13896","last_updated":"2024-12-15T05:13:26Z","snapshot_observed_at":"2026-08-05T09:12:58.303003Z","submitted_at":"2024-08-25T17:33:40Z","title":"HTS-Attack: Heuristic Token Search for Jailbreaking Text-to-Image Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.13896","snapshot_observed_at":"2026-08-06T19:46:27.054948Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.054948Z"},"links":{"cited_paper":"/paper/2408.13896","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:49f3f9fdfee02ebde037a714ff782667953bc0dfd0daa76f9c4ab3f1b5dd75b7","observation_id":"a6b983d6-49ab-4cdd-967c-1d567a4bd97d","resolution":{"observed_at":"2026-08-06T19:46:27.054948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.12082","last_updated":"2023-11-10T19:15:20Z","snapshot_observed_at":"2026-07-06T15:29:57.940337Z","submitted_at":"2023-05-20T03:41:45Z","title":"SneakyPrompt: Jailbreaking Text-to-image Generative Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.12082","snapshot_observed_at":"2026-08-06T19:46:27.138588Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.138588Z"},"links":{"cited_paper":"/paper/2305.12082","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:609e5f70a76a6f6973f532bd4735fecc8c4c7a72310db81670bf339f4b76ae0d","observation_id":"3e668489-c586-4ce6-84b2-c3e279662485","resolution":{"observed_at":"2026-08-06T19:46:27.138588Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2505.19610","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:28.344444Z","title":null,"venue":null,"work_id":"bea8822b-24e4-4b83-b611-dbc44f6017f0","year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.219717Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:27dd3de693df2725095a7ad5ed19aa9b2b2b785bd7dc8ac922253a80b2290cb5","observation_id":"634b7aab-52c0-4de4-91af-93bce1a07b10","resolution":{"observed_at":"2026-08-06T19:46:28.438341Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.03489","last_updated":"2024-10-23T13:38:29Z","snapshot_observed_at":"2026-07-06T19:27:42.862745Z","submitted_at":"2024-10-04T14:59:39Z","title":"Gradient-based Jailbreak Images for Multimodal Fusion Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.03489","snapshot_observed_at":"2026-08-06T19:46:27.317130Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.317130Z"},"links":{"cited_paper":"/paper/2410.03489","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:b1361ce096632e633be513a7cae3e36cd0994f2602af3e32b1cca47b617f6194","observation_id":"b2067cff-6d94-47f2-8e03-bcdfb55f1ec1","resolution":{"observed_at":"2026-08-06T19:46:27.317130Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.08567","last_updated":"2024-06-03T14:15:03Z","snapshot_observed_at":"2026-07-06T17:29:34.813390Z","submitted_at":"2024-02-13T16:06:17Z","title":"Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.08567","snapshot_observed_at":"2026-08-06T19:46:27.368912Z","title":"& Lin, M","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.368912Z"},"links":{"cited_paper":"/paper/2402.08567","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:9e45dac7a24efeb6376ff5458571026f28d5d54bd94eaa6031d5a1a7af6f5a3d","observation_id":"6a6c5220-9606-4a96-be45-78998596fd50","resolution":{"observed_at":"2026-08-06T19:46:27.368912Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.14847","last_updated":"2025-06-02T01:51:09Z","snapshot_observed_at":"2026-08-07T18:01:00.658329Z","submitted_at":"2025-02-20T18:55:39Z","title":"Red-Teaming LLM Multi-Agent Systems via Communication Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.14847","snapshot_observed_at":"2026-08-06T19:46:27.451948Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.451948Z"},"links":{"cited_paper":"/paper/2502.14847","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:090b87e9a25d397db988f387cef3c0db87bfb85fa07d7d662b78a45dc7b29621","observation_id":"f4e24e59-c187-4a25-b386-c1458f598470","resolution":{"observed_at":"2026-08-06T19:46:27.451948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-06T19:46:27.536570Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.536570Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:9795e3ae08d60da043438fd2349bef4fce235da2de4329728a0c39526fb2ee1e","observation_id":"ed12d4c6-a0e6-4378-b560-30a9911f5ae0","resolution":{"observed_at":"2026-08-06T19:46:27.536570Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.14333","last_updated":"2023-07-26T17:51:02Z","snapshot_observed_at":"2026-07-06T15:58:55.330444Z","submitted_at":"2023-07-26T17:51:02Z","title":"Consideration Set Sampling to Analyze Undecided Respondents","version":1},"cited_work":{"arxiv_id":"2307.14333","doi":null,"metadata_source":"pith","pith_arxiv_id":"2307.14333","snapshot_observed_at":"2026-08-06T19:46:27.865214Z","title":"Consideration Set Sampling to Analyze Undecided Respondents","venue":"stat.ME","work_id":"7e87b95f-38c3-4d12-af42-0c95b04fcfab","year":2023},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.623901Z"},"links":{"cited_paper":"/paper/2307.14333","citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:a2b5bf895d44e2f38fb7197fce8c724166737edcda80425ffa511d7ae52995e6","observation_id":"3e0cb174-ef09-44f7-a443-6fab71e75112","resolution":{"observed_at":"2026-08-06T19:46:27.921011Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T19:46:29.395325Z","title":null,"venue":null,"work_id":"48d03f84-fb49-4c1e-9008-6419f4326ff2","year":2022},"citing_paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-06T19:46:27.712204Z"},"links":{"citing_paper":"/paper/2507.04673"},"observation_digest":"sha256:ef2be66ffcd676364a68642f54372e1cabb41d9c7c21c346766333f1b15dfdf0","observation_id":"0cf1581b-227e-41b4-9945-b6c7ee04bc4a","resolution":{"observed_at":"2026-08-06T19:46:29.529563Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2507.04673","last_updated":"2026-07-11T20:48:21Z","latest_version":2,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-06T19:40:14.478360Z","submitted_at":"2025-07-07T05:35:21Z","title":"Trojan Horse Prompting: Jailbreaking Conversational Multimodal Models by Forging Assistant Message"},"reference_resolution":{"displayed":28,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":22,"verified_exact":4,"verified_fuzzy":2},"total_outbound_references":28},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"thesis":"As of 7 August 2026, this Paper Citation Record lists 28 of 28 outbound references and 0 inbound Pith citation observations for arXiv:2507.04673."}