{"as_of":"2026-08-22T20:17:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:903ef6a6dbca2bc195600d6ab2807cdc733ca2a6853f23d6c6cd7d60b3c91c29","coverage":[{"denominator":182,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":100,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T20:31:42.328780Z","state":"measured"},{"denominator":100,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":100,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-22T06:32:14.747728+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2508.10404/citation-record","integrity":"/paper/2508.10404/integrity","json":"/paper/2508.10404/citation-record.json","paper":"/paper/2508.10404"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2503.03601","last_updated":"2025-03-05T15:33:52Z","snapshot_observed_at":"2026-08-21T16:24:49.182177Z","submitted_at":"2025-03-05T15:33:52Z","title":"Feature-Level Insights into Artificial Text Detection with Sparse Autoencoders","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.03601","snapshot_observed_at":"2026-08-05T20:31:31.199445Z","title":"Feature-level insights into artificial text detection with sparse autoencoders","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:31.199445Z"},"links":{"cited_paper":"/paper/2503.03601","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:8de732190684216019a53c8f557bc786ac8b824a8edba36c5878ccbd1a984c71","observation_id":"b3d67068-1cc3-4e6f-8be0-7b572fade415","resolution":{"observed_at":"2026-08-05T20:31:31.199445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18878","last_updated":"2025-08-05T20:14:47Z","snapshot_observed_at":"2026-08-16T12:47:16.580519Z","submitted_at":"2025-03-24T16:54:26Z","title":"I Have Covered All the Bases Here: Interpreting Reasoning Features in Large Language Models via Sparse Autoencoders","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18878","snapshot_observed_at":"2026-08-05T20:31:31.253466Z","title":"Rogov, Elena Tutubalina, and Ivan Oseledets","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:31.253466Z"},"links":{"cited_paper":"/paper/2503.18878","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:b974dc3b9a151f0517807402a9f241f0c013dd6743ccb5b2d6a8e30ae9f8e3d8","observation_id":"7fe71ad6-57ad-4266-8612-7fd0530e0210","resolution":{"observed_at":"2026-08-05T20:31:31.253466Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.19278","last_updated":"2024-11-02T23:02:44Z","snapshot_observed_at":"2026-08-22T05:47:07.157294Z","submitted_at":"2024-10-25T03:21:14Z","title":"Applying sparse autoencoders to unlearn knowledge in language models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.19278","snapshot_observed_at":"2026-08-05T20:31:31.321750Z","title":"Applying sparse autoencoders to unlearn knowledge in language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:31.321750Z"},"links":{"cited_paper":"/paper/2410.19278","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:3831b7596f1458cfff3ec70456d6934f57b7ec88ac80bd506eb484a1e4727fa5","observation_id":"627938d6-e79e-4b04-9299-f5e9e42df1d5","resolution":{"observed_at":"2026-08-05T20:31:31.321750Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.11127","last_updated":"2025-03-14T06:43:19Z","snapshot_observed_at":"2026-08-16T12:50:07.836440Z","submitted_at":"2025-03-14T06:43:19Z","title":"Don't Forget It! Conditional Sparse Autoencoder Clamping Works for Unlearning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.11127","snapshot_observed_at":"2026-08-05T20:31:31.388754Z","title":"Don’t forget it! conditional sparse autoencoder clamping works for unlearning","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:31.388754Z"},"links":{"cited_paper":"/paper/2503.11127","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:508cea416722410e5c046c224f55012e6847909bb3504b19084e6467de1fd659","observation_id":"5d5b5438-d810-47fa-81f3-99b1a64fb6ed","resolution":{"observed_at":"2026-08-05T20:31:31.388754Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.11296","last_updated":"2025-05-22T23:03:47Z","snapshot_observed_at":"2026-08-15T11:34:36.001446Z","submitted_at":"2024-11-18T05:47:02Z","title":"Steering Language Model Refusal with Sparse Autoencoders","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.11296","snapshot_observed_at":"2026-08-05T20:31:31.454509Z","title":"Steering language model refusal with sparse autoencoders","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:31.454509Z"},"links":{"cited_paper":"/paper/2411.11296","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:3942c913864724d23f2bd5d02ce8d99159ff8c1c28fc5b3d82cf74110129abf0","observation_id":"77d84fa0-46e6-4bbc-826a-a011a1d5b69e","resolution":{"observed_at":"2026-08-05T20:31:31.454509Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:31.552312Z","title":"Scaling monosemanticity: Extracting interpretable features from large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:31.552312Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:bd05493953021eb83abbde0eee8249d08bb2af97d496adefbd646a10d89b447e","observation_id":"ba2f3f4b-2430-4bbd-8a35-ef1c2fac1daa","resolution":{"observed_at":"2026-08-05T20:31:31.552312Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:31.616113Z","title":"Understanding the decisions of large models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:31.616113Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:babf4e66733ebe9702cebca11f098e16dff99705aa126f159a61b39377e94cf9","observation_id":"7f76d637-2727-4dd4-bf88-41c468e1229b","resolution":{"observed_at":"2026-08-05T20:31:31.616113Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.21018","last_updated":"2024-06-05T16:35:49Z","snapshot_observed_at":"2026-08-20T06:11:16.431827Z","submitted_at":"2024-05-31T17:07:15Z","title":"Improved Techniques for Optimization-Based Jailbreaking on Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.21018","snapshot_observed_at":"2026-08-05T20:31:31.703450Z","title":"Improved techniques for optimization-based jailbreaking on large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:31.703450Z"},"links":{"cited_paper":"/paper/2405.21018","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:bed3f04375680528b5975795a27323e0e17b900cce809683d2d988b81d340495","observation_id":"6265bbc8-9c57-46f2-b42d-6d9d0eb65852","resolution":{"observed_at":"2026-08-05T20:31:31.703450Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.11755","last_updated":"2024-02-19T00:53:48Z","snapshot_observed_at":"2026-08-20T02:23:48.029371Z","submitted_at":"2024-02-19T00:53:48Z","title":"SPML: A DSL for Defending Language Models Against Prompt Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.11755","snapshot_observed_at":"2026-08-05T20:31:31.765489Z","title":"Spml: A dsl for defending language models against prompt attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:31.765489Z"},"links":{"cited_paper":"/paper/2402.11755","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:b0fb03e4e6b39f14b7258f8e73fdca3681384e39c5faba0bbd311409452a0925","observation_id":"e984a50b-2dfc-4d54-ab0a-fa2c943e4b45","resolution":{"observed_at":"2026-08-05T20:31:31.765489Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.04249","last_updated":"2024-02-27T04:43:08Z","snapshot_observed_at":"2026-08-16T09:07:20.265665Z","submitted_at":"2024-02-06T18:59:08Z","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.04249","snapshot_observed_at":"2026-08-05T20:31:31.837394Z","title":"Harmbench: A standardized evalua- tion framework for automated red teaming and robust refusal.arXiv preprint arXiv:2402.04249, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:31.837394Z"},"links":{"cited_paper":"/paper/2402.04249","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:81cba1ea668eb2cda6da1dc2f85982a5e78e51adea3bb29cce5cc8217e9017c2","observation_id":"f0f91128-20e3-4d51-bd0c-f1da26be06c8","resolution":{"observed_at":"2026-08-05T20:31:31.837394Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-05T20:31:31.913269Z","title":"Zico Kolter, and Matt Fredrikson","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:31.913269Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:d81f1e6fa97f4e8efa68399b12e78f5b8ae782d753a9035580d904d15cc6e76d","observation_id":"9ae6274f-493e-4d41-9408-b6a083ff8ea8","resolution":{"observed_at":"2026-08-05T20:31:31.913269Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1905.02175","last_updated":"2019-08-12T14:36:10Z","snapshot_observed_at":"2026-08-20T18:21:16.685532Z","submitted_at":"2019-05-06T17:45:05Z","title":"Adversarial Examples Are Not Bugs, They Are Features","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1905.02175","snapshot_observed_at":"2026-08-05T20:31:32.006974Z","title":"Adversarial examples are not bugs, they are features","venue":null,"work_id":null,"year":1905},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.006974Z"},"links":{"cited_paper":"/paper/1905.02175","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:66606469ef770253d2589e63a652f56ba026ffd38ad2af213a2db6ab6cd5a4ea","observation_id":"9c9886d1-7f7c-423b-8d0b-5e05f6d5512c","resolution":{"observed_at":"2026-08-05T20:31:32.006974Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:32.096752Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.096752Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:c4f20a82063d8911335634b36422e6e5c4ea9a6a526cfe462faa3163c7aa0965","observation_id":"6d688554-cd12-48cc-a878-7d4c7e750fad","resolution":{"observed_at":"2026-08-05T20:31:32.096752Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:32.154418Z","title":"Ddsa: A defense against adversarial attacks using deep denoising sparse autoencoder","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.154418Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:6ec79799b0dc9eeb44247646e13e892a9ac469d6e84b4b10e48a012c06a0f34a","observation_id":"1bc2f18e-501a-4833-a2ea-6835864e9231","resolution":{"observed_at":"2026-08-05T20:31:32.154418Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.12522","last_updated":"2024-05-21T06:26:10Z","snapshot_observed_at":"2026-08-19T19:39:01.719195Z","submitted_at":"2024-05-21T06:26:10Z","title":"Sparse Autoencoders Enable Scalable and Reliable Circuit Identification in Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.12522","snapshot_observed_at":"2026-08-05T20:31:32.239962Z","title":"Sparse autoencoders enable scalable and reliable circuit identification in language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.239962Z"},"links":{"cited_paper":"/paper/2405.12522","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:de52901c4dda6b8863d4533ae5d1b3e7b81753a474b089342bcbb619096d0a93","observation_id":"ca38d9a1-9a9d-45f8-bcfc-7b880faf321e","resolution":{"observed_at":"2026-08-05T20:31:32.239962Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.08600","last_updated":"2023-10-04T13:17:38Z","snapshot_observed_at":"2026-08-21T17:39:12.921162Z","submitted_at":"2023-09-15T17:56:55Z","title":"Sparse Autoencoders Find Highly Interpretable Features in Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.08600","snapshot_observed_at":"2026-08-05T20:31:32.324026Z","title":"Sparse autoencoders find highly interpretable features in language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.324026Z"},"links":{"cited_paper":"/paper/2309.08600","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:a73add9e741a63900bb3baa295ef9337d25a5161c6e96557c1e54a440150c2ac","observation_id":"0a646562-beb4-455b-9b45-1a18b333f3f8","resolution":{"observed_at":"2026-08-05T20:31:32.324026Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.04093","last_updated":"2024-06-06T14:10:12Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-06-06T14:10:12Z","title":"Scaling and evaluating sparse autoencoders","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.04093","snapshot_observed_at":"2026-08-05T20:31:32.382109Z","title":"Scaling and evaluating sparse autoencoders","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.382109Z"},"links":{"cited_paper":"/paper/2406.04093","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:b72bb5bf56c7693eceb20a4a965faf929bfe46de6f195f87ef2745e928a8c7d0","observation_id":"c7f6c8a8-3d64-4da7-8f0d-c9205117bdcc","resolution":{"observed_at":"2026-08-05T20:31:32.382109Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.08200","last_updated":"2025-05-23T03:46:43Z","snapshot_observed_at":"2026-08-16T12:51:12.677247Z","submitted_at":"2025-03-11T09:08:07Z","title":"Route Sparse Autoencoder to Interpret Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.08200","snapshot_observed_at":"2026-08-05T20:31:32.471158Z","title":"Route sparse autoencoder to interpret large language models.arXiv preprint arXiv:2503.08200, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.471158Z"},"links":{"cited_paper":"/paper/2503.08200","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:23d3e34e6ba450346dde4283140aacef949eb14520236f5ac2f69bb934af21ff","observation_id":"b910cfd2-824c-4ba5-8039-15b0bb4b80b4","resolution":{"observed_at":"2026-08-05T20:31:32.471158Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.08366","last_updated":"2024-05-20T17:46:14Z","snapshot_observed_at":"2026-08-21T18:13:38.736563Z","submitted_at":"2024-05-14T07:07:13Z","title":"Towards Principled Evaluations of Sparse Autoencoders for Interpretability and Control","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.08366","snapshot_observed_at":"2026-08-05T20:31:32.540179Z","title":"Towards principled evaluations of sparse autoencoders for interpretability and control","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.540179Z"},"links":{"cited_paper":"/paper/2405.08366","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:1888f9e17ec97e5351d4465e77387a3fafe2e25968f12964e4a91c45180be7f7","observation_id":"71db0da8-18ab-4522-966b-281e91d32b94","resolution":{"observed_at":"2026-08-05T20:31:32.540179Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:32.604718Z","title":"Sparsegan: Sparse generative adversarial network for text generation","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.604718Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:f55265f9448337a9993a6b785a3c81fdd4a607f5d618f7e5206ca3710fac4dab","observation_id":"1dbafd58-6fab-4d99-bc2e-9860eb474bd6","resolution":{"observed_at":"2026-08-05T20:31:32.604718Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:32.667105Z","title":"Real-time segmentation of on-line handwritten arabic script","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.667105Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:0cf4cc11a967e0c0db12c358bde9303e5c0a013837c0b9b0b878ebf6f4a283a0","observation_id":"e25aa254-2579-4ce9-9ad3-283b9ebb2b99","resolution":{"observed_at":"2026-08-05T20:31:32.667105Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:32.758980Z","title":"Fast classification of handwritten on-line arabic characters","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.758980Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:b0a148dca5ecb42716a17ef4effa7aa0e533285f9a937cd38f95fabbc22ac104","observation_id":"39a7542f-c27b-409c-94ed-94f66272b653","resolution":{"observed_at":"2026-08-05T20:31:32.758980Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1804.09028","last_updated":"2018-04-24T13:40:09Z","snapshot_observed_at":"2026-08-14T19:22:33.311363Z","submitted_at":"2018-04-24T13:40:09Z","title":"Estimate and Replace: A Novel Approach to Integrating Deep Neural Networks with Existing Applications","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1804.09028","snapshot_observed_at":"2026-08-05T20:31:32.841903Z","title":"Estimate and replace: A novel approach to integrating deep neural networks with existing applications","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.841903Z"},"links":{"cited_paper":"/paper/1804.09028","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:f428787e1c3fc9df2d45d66c5fb68fd4c6925d8ebdc4e081f244313c71e8acdf","observation_id":"cf25f153-f647-4869-9713-2dd73cdb6e1b","resolution":{"observed_at":"2026-08-05T20:31:32.841903Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.01229","last_updated":"2025-03-02T12:27:07Z","snapshot_observed_at":"2026-08-16T13:55:59.846832Z","submitted_at":"2024-05-02T12:18:14Z","title":"Boosting Jailbreak Attack with Momentum","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.01229","snapshot_observed_at":"2026-08-05T20:31:32.922403Z","title":"Boosting jailbreak attack with momentum","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.922403Z"},"links":{"cited_paper":"/paper/2405.01229","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:d4f94380f27abc73ad84a721a3bbb998333f6374fa6616021088856b7766397a","observation_id":"c41a788d-39bb-4780-83d5-16f11f3d3ec6","resolution":{"observed_at":"2026-08-05T20:31:32.922403Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.09113","last_updated":"2025-02-12T02:00:12Z","snapshot_observed_at":"2026-08-16T13:52:36.277503Z","submitted_at":"2024-05-15T06:11:24Z","title":"Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimization","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.09113","snapshot_observed_at":"2026-08-05T20:31:32.991210Z","title":"Efficient llm jailbreak via adaptive dense-to-sparse constrained optimization","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:32.991210Z"},"links":{"cited_paper":"/paper/2405.09113","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:be0a3cc2d67ecfdf549aa0dbe194a9d7e34bda5677982ab9ad5a13f0b473d58c","observation_id":"5a2da513-690e-4b56-99c0-748ef52c5472","resolution":{"observed_at":"2026-08-05T20:31:32.991210Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09154","last_updated":"2025-03-03T09:37:27Z","snapshot_observed_at":"2026-08-18T17:39:47.459620Z","submitted_at":"2024-02-14T13:13:26Z","title":"Attacking Large Language Models with Projected Gradient Descent","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09154","snapshot_observed_at":"2026-08-05T20:31:33.071055Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.071055Z"},"links":{"cited_paper":"/paper/2402.09154","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:4a56c4e85119352d618af7100ede07328b5386fa251899c67518fa4a014914bd","observation_id":"abd52154-d50a-4659-b063-cc2bbd32eb46","resolution":{"observed_at":"2026-08-05T20:31:33.071055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-16T14:36:14.029419Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-05T20:31:33.151173Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.151173Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:b9ac23291fd388a788c50e5055e23a8e5ee34722da8ce80d38972888146578f1","observation_id":"98bbb770-7390-4731-8445-b13309036222","resolution":{"observed_at":"2026-08-05T20:31:33.151173Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09948","last_updated":"2025-05-29T14:49:44Z","snapshot_observed_at":"2026-08-19T13:26:30.846394Z","submitted_at":"2023-11-16T15:01:48Z","title":"Hijacking Large Language Models via Adversarial In-Context Learning","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09948","snapshot_observed_at":"2026-08-05T20:31:33.221051Z","title":"Hijacking large language models via adversarial in-context learning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.221051Z"},"links":{"cited_paper":"/paper/2311.09948","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:ef99bc36c36be27dd82553fab204f0370e5f2f43a79739dbd63749c8a11eafdb","observation_id":"c46d0d5a-1d65-40fa-b1f0-f571846445f8","resolution":{"observed_at":"2026-08-05T20:31:33.221051Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.15911","last_updated":"2024-02-24T21:27:13Z","snapshot_observed_at":"2026-08-20T15:49:43.570647Z","submitted_at":"2024-02-24T21:27:13Z","title":"PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Rails","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.15911","snapshot_observed_at":"2026-08-05T20:31:33.306997Z","title":"Prp: Propagating universal perturbations to attack large language model guard-rails","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.306997Z"},"links":{"cited_paper":"/paper/2402.15911","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:1164d2df27b685b5eda707d4cfb2dcfaa8e8606ba095e343a47229afb684feae","observation_id":"c8da5bc0-1678-4e7d-a684-7202620ad8c0","resolution":{"observed_at":"2026-08-05T20:31:33.306997Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16006","last_updated":"2024-06-04T02:59:58Z","snapshot_observed_at":"2026-08-19T18:43:11.162602Z","submitted_at":"2024-02-25T06:46:27Z","title":"ASETF: A Novel Method for Jailbreak Attack on LLMs through Translate Suffix Embeddings","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16006","snapshot_observed_at":"2026-08-05T20:31:33.378159Z","title":"Asetf: A novel method for jailbreak attack on llms through translate suffix embeddings","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.378159Z"},"links":{"cited_paper":"/paper/2402.16006","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:37c9c893b172b61049ef930e571f56712855b2301d235d594609c5744281aacc","observation_id":"bc76b078-c515-4956-b91d-b93bed59d299","resolution":{"observed_at":"2026-08-05T20:31:33.378159Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04957","last_updated":"2024-03-07T23:46:20Z","snapshot_observed_at":"2026-08-18T14:37:14.606602Z","submitted_at":"2024-03-07T23:46:20Z","title":"Automatic and Universal Prompt Injection Attacks against Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.04957","snapshot_observed_at":"2026-08-05T20:31:33.469643Z","title":"Automatic and universal prompt injection attacks against large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.469643Z"},"links":{"cited_paper":"/paper/2403.04957","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:6e9e79d8b3465d7b6e96f98f4a23170f9d552b331c8d6d25c7152a1d02f151ec","observation_id":"eb2ddbd0-6ab7-48b3-8a03-042e64e1955d","resolution":{"observed_at":"2026-08-05T20:31:33.469643Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.20778","last_updated":"2024-11-01T09:53:53Z","snapshot_observed_at":"2026-08-19T15:05:31.224982Z","submitted_at":"2024-05-28T06:10:12Z","title":"Improved Generation of Adversarial Examples Against Safety-aligned LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.20778","snapshot_observed_at":"2026-08-05T20:31:33.554453Z","title":"Improved generation of adversarial examples against safety-aligned llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.554453Z"},"links":{"cited_paper":"/paper/2405.20778","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:71070c11c57284cb7f6b612574fe6200a77745bb9a773b6d4e1d022de36b5d46","observation_id":"db1489f2-1e86-47c7-baba-c5cc027fd0c3","resolution":{"observed_at":"2026-08-05T20:31:33.554453Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.17256","last_updated":"2025-07-23T18:43:18Z","snapshot_observed_at":"2026-08-20T09:22:08.869784Z","submitted_at":"2024-01-30T18:48:37Z","title":"Weak-to-Strong Jailbreaking on Large Language Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.17256","snapshot_observed_at":"2026-08-05T20:31:33.631918Z","title":"Weak-to-strong jailbreaking on large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.631918Z"},"links":{"cited_paper":"/paper/2401.17256","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:4ef08509a6d6651319f0e35a73dc8ac917c6c354bf181ed672214689c4ba5434","observation_id":"cd0431ae-c85a-46f5-878f-6dcce83602e6","resolution":{"observed_at":"2026-08-05T20:31:33.631918Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.04127","last_updated":"2024-02-23T07:32:27Z","snapshot_observed_at":"2026-08-18T17:46:16.057703Z","submitted_at":"2023-12-07T08:29:58Z","title":"Analyzing the Inherent Response Tendency of LLMs: Real-World Instructions-Driven Jailbreak","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.04127","snapshot_observed_at":"2026-08-05T20:31:33.736025Z","title":"Analyzing the inher- ent response tendency of llms: Real-world instructions-driven jailbreak","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.736025Z"},"links":{"cited_paper":"/paper/2312.04127","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:eb06a3f9687f4c53d4472937e4bf594818a5667f2366a549da93ea1ebdbca216","observation_id":"2861fd44-e50f-4d4a-8c03-1ae8259f8c1b","resolution":{"observed_at":"2026-08-05T20:31:33.736025Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.16369","last_updated":"2025-07-02T07:27:32Z","snapshot_observed_at":"2026-08-20T06:51:52.577742Z","submitted_at":"2024-04-25T07:15:23Z","title":"Don't Say No: Jailbreaking LLM by Suppressing Refusal","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.16369","snapshot_observed_at":"2026-08-05T20:31:33.756873Z","title":"Don’t say no: Jailbreaking llm by suppressing refusal","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.756873Z"},"links":{"cited_paper":"/paper/2404.16369","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:99895395e7098530489bfa1440f854fd0e070a84a76e477cd243740f1e3309db","observation_id":"17b10907-dc4b-451b-b535-e0841e28f91e","resolution":{"observed_at":"2026-08-05T20:31:33.756873Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.13068","last_updated":"2026-04-18T08:25:50Z","snapshot_observed_at":"2026-08-16T01:57:57.079327Z","submitted_at":"2024-05-20T17:17:55Z","title":"Uncovering Logit Suppression Vulnerabilities in LLM Safety Alignment","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.13068","snapshot_observed_at":"2026-08-05T20:31:33.814112Z","title":"Lockpicking llms: A logit-based jailbreak using token-level manipulation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.814112Z"},"links":{"cited_paper":"/paper/2405.13068","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:465049a701ff3209ba5c3442336be34096e0938dd82ede7f0edf1244b95c6142","observation_id":"36244384-4873-47b0-b7d7-bad4ca7beacb","resolution":{"observed_at":"2026-08-05T20:31:33.814112Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.04782","last_updated":"2023-12-08T01:41:36Z","snapshot_observed_at":"2026-08-21T13:12:47.844857Z","submitted_at":"2023-12-08T01:41:36Z","title":"Make Them Spill the Beans! Coercive Knowledge Extraction from (Production) LLMs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.04782","snapshot_observed_at":"2026-08-05T20:31:33.859800Z","title":"Make them spill the beans! coercive knowledge extraction from (production) llms","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.859800Z"},"links":{"cited_paper":"/paper/2312.04782","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:1ea107dfca75e9ae2e4761abfb2d94016fb905245905bbdfd84f027188aadab5","observation_id":"c7a5a669-88f3-429a-8668-8c7d187bf6ea","resolution":{"observed_at":"2026-08-05T20:31:33.859800Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.08679","last_updated":"2024-06-07T00:13:08Z","snapshot_observed_at":"2026-08-20T07:42:33.888647Z","submitted_at":"2024-02-13T18:58:48Z","title":"COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.08679","snapshot_observed_at":"2026-08-05T20:31:33.972622Z","title":"Cold-attack: Jailbreaking llms with stealthiness and controllability","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:33.972622Z"},"links":{"cited_paper":"/paper/2402.08679","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:3f5c8eb71ee977ecfbf92103d989e1d589c25139073ad19b0da67cb84336a9eb","observation_id":"512e92fe-7ea0-4a83-b1d9-7f13210766df","resolution":{"observed_at":"2026-08-05T20:31:33.972622Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.15570","last_updated":"2024-02-23T19:12:53Z","snapshot_observed_at":"2026-08-16T14:15:48.297123Z","submitted_at":"2024-02-23T19:12:53Z","title":"Fast Adversarial Attacks on Language Models In One GPU Minute","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.15570","snapshot_observed_at":"2026-08-05T20:31:34.060079Z","title":"Fast adversarial attacks on language models in one gpu minute","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:34.060079Z"},"links":{"cited_paper":"/paper/2402.15570","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:2a8a690852f7bc522c74de68705c9512d01f2431e8d5e56928e92f11f3c0d6b6","observation_id":"395708b6-947e-43d8-b952-e562b4ba357a","resolution":{"observed_at":"2026-08-05T20:31:34.060079Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.02151","last_updated":"2025-04-17T18:55:45Z","snapshot_observed_at":"2026-08-16T14:04:12.947538Z","submitted_at":"2024-04-02T17:58:27Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02151","snapshot_observed_at":"2026-08-05T20:31:34.192244Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:34.192244Z"},"links":{"cited_paper":"/paper/2404.02151","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:65e62569128339467d0d913a5f2deda57d148b66cde2a96f92e4edcce0bc83bd","observation_id":"5593cdcc-082e-4ea9-a8d5-680a15548693","resolution":{"observed_at":"2026-08-05T20:31:34.192244Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.02949","last_updated":"2023-10-04T16:39:31Z","snapshot_observed_at":"2026-08-20T07:51:07.896144Z","submitted_at":"2023-10-04T16:39:31Z","title":"Shadow Alignment: The Ease of Subverting Safely-Aligned Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.02949","snapshot_observed_at":"2026-08-05T20:31:34.960696Z","title":"Shadow alignment: The ease of subverting safely-aligned language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:34.960696Z"},"links":{"cited_paper":"/paper/2310.02949","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:40dd33f58e01d6636841d85f1a4d4827e0ee0894642055d00f09f68aa8cf6489","observation_id":"e7c2c932-e692-4384-ad68-e40230d919db","resolution":{"observed_at":"2026-08-05T20:31:34.960696Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03693","last_updated":"2023-10-05T17:12:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-05T17:12:17Z","title":"Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03693","snapshot_observed_at":"2026-08-05T20:31:36.139445Z","title":"Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:36.139445Z"},"links":{"cited_paper":"/paper/2310.03693","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:1d1c874046159a7ddcf871f1877bee834721a90fc9ecafbda3c95c0d4abfac2a","observation_id":"ba196737-b187-4781-964d-195ff8a829bd","resolution":{"observed_at":"2026-08-05T20:31:36.139445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.20624","last_updated":"2024-05-22T08:39:46Z","snapshot_observed_at":"2026-08-18T10:16:07.566802Z","submitted_at":"2023-10-31T16:55:06Z","title":"LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70B","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.20624","snapshot_observed_at":"2026-08-05T20:31:36.299965Z","title":"Lora fine-tuning efficiently undoes safety training in llama 2-chat 70b","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:36.299965Z"},"links":{"cited_paper":"/paper/2310.20624","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:d7b6470f1daf2327409d4106ada9d4379c270055aa8e8e98900d188712049820","observation_id":"42d9129f-7bb4-4215-ae7b-53ab8a841f8e","resolution":{"observed_at":"2026-08-05T20:31:36.299965Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05553","last_updated":"2024-04-05T23:30:56Z","snapshot_observed_at":"2026-08-16T14:44:34.691540Z","submitted_at":"2023-11-09T17:54:59Z","title":"Removing RLHF Protections in GPT-4 via Fine-Tuning","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05553","snapshot_observed_at":"2026-08-05T20:31:36.407857Z","title":"Removing rlhf protections in gpt-4 via fine-tuning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:36.407857Z"},"links":{"cited_paper":"/paper/2311.05553","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:dac4b86a62109c40e55f42bb265bcd777457d8e2961959d8e1eaaa039e77daf4","observation_id":"e2fffb31-5954-4016-ac38-f43310662a1b","resolution":{"observed_at":"2026-08-05T20:31:36.407857Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.18540","last_updated":"2025-02-28T14:49:25Z","snapshot_observed_at":"2026-08-16T18:13:17.322388Z","submitted_at":"2024-05-28T19:16:17Z","title":"Learning diverse attacks on large language models for robust red-teaming and safety tuning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.18540","snapshot_observed_at":"2026-08-05T20:31:36.553261Z","title":"Learning diverse attacks on large language models for robust red-teaming and safety tuning","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:36.553261Z"},"links":{"cited_paper":"/paper/2405.18540","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:b0379ec7b50464cd12c67f3d48e984b877250d44d5ad48870bc37158aa5e2c2a","observation_id":"eec2fb5a-a4f3-44fc-835b-60ebb1957c71","resolution":{"observed_at":"2026-08-05T20:31:36.553261Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.14302","last_updated":"2024-08-04T17:48:33Z","snapshot_observed_at":"2026-08-19T21:26:17.450116Z","submitted_at":"2023-12-21T21:22:41Z","title":"Exploiting Novel GPT-4 APIs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.14302","snapshot_observed_at":"2026-08-05T20:31:36.707987Z","title":"Exploiting novel gpt-4 apis","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:36.707987Z"},"links":{"cited_paper":"/paper/2312.14302","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:1d0d4d72f9eab16e03fd9348a54407fdf289042b489a53f36453c9be9f67758a","observation_id":"d72aad72-62ff-46d8-b916-81bc4d105fe5","resolution":{"observed_at":"2026-08-05T20:31:36.707987Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.10248","last_updated":"2024-10-10T13:20:13Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-08-20T12:21:05Z","title":"Steering Language Models With Activation Engineering","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.10248","snapshot_observed_at":"2026-08-05T20:31:36.921320Z","title":"Vazquez, Ulisse Mini, and Monte MacDiarmid","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:36.921320Z"},"links":{"cited_paper":"/paper/2308.10248","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:ddfb3847eed6b6c86224c9ae8da4a062c8bbb9b8dd51f6b7fb8198bf3ff5ee4c","observation_id":"5ff7773a-6323-4b3c-bce2-1b0df8d3a687","resolution":{"observed_at":"2026-08-05T20:31:36.921320Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09433","last_updated":"2024-08-15T19:51:07Z","snapshot_observed_at":"2026-08-18T18:57:02.935657Z","submitted_at":"2023-11-15T23:07:40Z","title":"Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09433","snapshot_observed_at":"2026-08-05T20:31:37.044270Z","title":"Trojan activation attack: Red-teaming large language models using activation steering for safety-alignment","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:37.044270Z"},"links":{"cited_paper":"/paper/2311.09433","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:ddf4b46314912ec76a63ba3f9f9f7726678818d36d110fd3546c2df07a5b344e","observation_id":"180e7a9a-bfa9-40af-a697-a47145e9befa","resolution":{"observed_at":"2026-08-05T20:31:37.044270Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09063","last_updated":"2025-04-16T15:15:56Z","snapshot_observed_at":"2026-08-19T03:17:45.396518Z","submitted_at":"2024-02-14T10:20:03Z","title":"Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09063","snapshot_observed_at":"2026-08-05T20:31:37.155433Z","title":"Soft prompt threats: Attacking safety alignment and unlearning in open-source llms through the embedding space","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:37.155433Z"},"links":{"cited_paper":"/paper/2402.09063","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:3ea0281d2061eec2c670cff3e909466bc39cf9618cd0f9e01726b76f789bcf15","observation_id":"25011324-4e75-4273-8cdd-0c3901a57082","resolution":{"observed_at":"2026-08-05T20:31:37.155433Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04445","last_updated":"2023-10-21T17:59:41Z","snapshot_observed_at":"2026-08-16T14:55:39.819973Z","submitted_at":"2023-10-02T23:29:23Z","title":"LoFT: Local Proxy Fine-tuning For Improving Transferability Of Adversarial Attacks Against Large Language Model","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04445","snapshot_observed_at":"2026-08-05T20:31:37.285221Z","title":"Loft: Local proxy fine-tuning for improving transfer- ability of adversarial attacks against large language model","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:37.285221Z"},"links":{"cited_paper":"/paper/2310.04445","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:18937e4a46293c720ea3cd590e9bc21a2b1cc3ae9c0f7c8b3756fc925cb897a7","observation_id":"725280ed-c100-4917-8f79-e5c55895d556","resolution":{"observed_at":"2026-08-05T20:31:37.285221Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.07064","last_updated":"2024-10-06T23:53:34Z","snapshot_observed_at":"2026-08-17T03:24:55.348753Z","submitted_at":"2023-11-13T04:08:49Z","title":"Prompts have evil twins","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.07064","snapshot_observed_at":"2026-08-05T20:31:37.394563Z","title":"McCabe, Tanay Wakhare, Yejin Kim, H","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:37.394563Z"},"links":{"cited_paper":"/paper/2311.07064","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:2275108f08364100515ffd53ee877172c7e3817ca1895ced05de1de486201a60","observation_id":"98dbcbb2-387b-49ad-99aa-53fe56fca48d","resolution":{"observed_at":"2026-08-05T20:31:37.394563Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09674","last_updated":"2024-02-15T02:54:49Z","snapshot_observed_at":"2026-08-16T14:18:26.882413Z","submitted_at":"2024-02-15T02:54:49Z","title":"PAL: Proxy-Guided Black-Box Attack on Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09674","snapshot_observed_at":"2026-08-05T20:31:37.579293Z","title":"Pal: Proxy-guided black-box attack on large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:37.579293Z"},"links":{"cited_paper":"/paper/2402.09674","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:84b25deb725dcc797a80e9aac67899acafece019123c803e9d501ab73ba5263e","observation_id":"8cd7a346-7dde-45fc-bf34-b6b32029aa32","resolution":{"observed_at":"2026-08-05T20:31:37.579293Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.16873","last_updated":"2025-06-02T18:59:01Z","snapshot_observed_at":"2026-08-16T13:59:04.683003Z","submitted_at":"2024-04-21T22:18:13Z","title":"AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.16873","snapshot_observed_at":"2026-08-05T20:31:37.738668Z","title":"Advprompter: Fast adaptive adversarial prompting for llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:37.738668Z"},"links":{"cited_paper":"/paper/2404.16873","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:11387378973ec7a3f03dd2e5ac1c023e7f7805b7467e5665c2d0822b3f902bd0","observation_id":"662af245-6dca-4328-98e9-2e7229c2d120","resolution":{"observed_at":"2026-08-05T20:31:37.738668Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.12038","last_updated":"2024-11-30T08:52:29Z","snapshot_observed_at":"2026-08-16T13:59:50.088003Z","submitted_at":"2024-04-18T09:46:25Z","title":"Uncovering Safety Risks of Large Language Models through Concept Activation Vector","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.12038","snapshot_observed_at":"2026-08-05T20:31:37.875871Z","title":"Uncovering safety risks of large language models through concept activation vector","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:37.875871Z"},"links":{"cited_paper":"/paper/2404.12038","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:5a299108a24f32a11ca6475a5d1ddea23bdf07dcc0df136b212bfce3559a783a","observation_id":"50128bf5-2104-432c-8ff7-0d38647da5fd","resolution":{"observed_at":"2026-08-05T20:31:37.875871Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.16432","last_updated":"2024-04-09T13:05:49Z","snapshot_observed_at":"2026-08-16T14:06:49.863346Z","submitted_at":"2024-03-25T05:27:35Z","title":"$\\textit{LinkPrompt}$: Natural and Universal Adversarial Attacks on Prompt-based Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.16432","snapshot_observed_at":"2026-08-05T20:31:37.935832Z","title":"arXiv preprint arXiv:2403.16432, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:37.935832Z"},"links":{"cited_paper":"/paper/2403.16432","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:7132be08679c183fb7d6192021a4283dec670675eb98ac5357a454e21fa8ed31","observation_id":"b2f845f7-2d66-4cbd-ab40-9e84ce9c8173","resolution":{"observed_at":"2026-08-05T20:31:37.935832Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.02446","last_updated":"2024-01-27T22:54:52Z","snapshot_observed_at":"2026-08-13T01:25:06.346704Z","submitted_at":"2023-10-03T21:30:56Z","title":"Low-Resource Languages Jailbreak GPT-4","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.02446","snapshot_observed_at":"2026-08-05T20:31:38.034933Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:38.034933Z"},"links":{"cited_paper":"/paper/2310.02446","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:9df4a7e42767490dc1fcb10f4edb2cb4a2a6246f827d82b276b6cd504aacd3dd","observation_id":"fd092592-9b9a-45b2-b9c7-b628184385d1","resolution":{"observed_at":"2026-08-05T20:31:38.034933Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06474","last_updated":"2024-03-04T04:03:54Z","snapshot_observed_at":"2026-08-20T04:04:43.980873Z","submitted_at":"2023-10-10T09:44:06Z","title":"Multilingual Jailbreak Challenges in Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06474","snapshot_observed_at":"2026-08-05T20:31:38.142157Z","title":"Multilingual jailbreak challenges in large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:38.142157Z"},"links":{"cited_paper":"/paper/2310.06474","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:8ec3f9ffd2b1850034669dce1271751410d7d8aaef7b107bfdf7ced4974b1330","observation_id":"cee7763d-f474-4e9d-a874-767b13499608","resolution":{"observed_at":"2026-08-05T20:31:38.142157Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09827","last_updated":"2024-02-29T08:20:07Z","snapshot_observed_at":"2026-08-16T14:42:42.652229Z","submitted_at":"2023-11-16T11:52:22Z","title":"Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinking","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09827","snapshot_observed_at":"2026-08-05T20:31:38.266606Z","title":"Cognitive overload: Jailbreaking large language models with overloaded logical thinking","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:38.266606Z"},"links":{"cited_paper":"/paper/2311.09827","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:8b4f662ab87ee0f385996ddc43024d663b7491a24c335ed90c46f22240be9b0a","observation_id":"700de88b-473c-478c-af8f-f9dd1003bb73","resolution":{"observed_at":"2026-08-05T20:31:38.266606Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.16765","last_updated":"2024-01-30T06:04:04Z","snapshot_observed_at":"2026-08-16T14:23:22.820825Z","submitted_at":"2024-01-30T06:04:04Z","title":"A Cross-Language Investigation into Jailbreak Attacks in Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.16765","snapshot_observed_at":"2026-08-05T20:31:38.472071Z","title":"A cross-language investigation into jailbreak attacks in large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:38.472071Z"},"links":{"cited_paper":"/paper/2401.16765","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:13adbcac5d654d9c04874e63cc5f3236e05f41dded14a225e78ad653020cdbfc","observation_id":"94077c99-5a47-4e5b-b033-1f4b3e82c09f","resolution":{"observed_at":"2026-08-05T20:31:38.472071Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.11969","last_updated":"2025-04-17T18:36:08Z","snapshot_observed_at":"2026-08-20T20:37:30.633701Z","submitted_at":"2024-07-16T17:59:55Z","title":"Does Refusal Training in LLMs Generalize to the Past Tense?","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.11969","snapshot_observed_at":"2026-08-05T20:31:38.588823Z","title":"Does refusal training in llms generalize to the past tense? arXiv preprint arXiv:2407.11969, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:38.588823Z"},"links":{"cited_paper":"/paper/2407.11969","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:7d5c7b213b37647de915e5bcbad98a2a3d6eaf32282de2bcd6350cc054706ddf","observation_id":"33cb0b08-c7f5-4146-80e5-df085cd44bc1","resolution":{"observed_at":"2026-08-05T20:31:38.588823Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-08-16T13:08:51.920120Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-05T20:31:38.691439Z","title":"Pappas, and Eric Wong","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:38.691439Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:ad1ca9c089778aa2426995ec607f220c84f2469a57dd2806dc019282effa216f","observation_id":"c8a82589-fba1-4a2d-a4f7-8ccec9762110","resolution":{"observed_at":"2026-08-05T20:31:38.691439Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.02119","last_updated":"2024-10-31T15:57:42Z","snapshot_observed_at":"2026-08-18T18:32:32.343266Z","submitted_at":"2023-12-04T18:49:23Z","title":"Tree of Attacks: Jailbreaking Black-Box LLMs Automatically","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.02119","snapshot_observed_at":"2026-08-05T20:31:38.748228Z","title":"Tree of attacks: Jailbreaking black-box llms automatically","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:38.748228Z"},"links":{"cited_paper":"/paper/2312.02119","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:47ffdb1bec8e59c5c2e1cac76700547cc214c42f13741a95502ffc6a84c5973a","observation_id":"5338dce9-2623-4bc2-bb50-8d8089c4cec1","resolution":{"observed_at":"2026-08-05T20:31:38.748228Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.08424","last_updated":"2024-09-30T14:25:39Z","snapshot_observed_at":"2026-08-18T03:04:46.346329Z","submitted_at":"2024-03-13T11:16:43Z","title":"Distract Large Language Models for Automatic Jailbreak Attack","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.08424","snapshot_observed_at":"2026-08-05T20:31:38.816400Z","title":"Distract large language models for automatic jailbreak attack","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:38.816400Z"},"links":{"cited_paper":"/paper/2403.08424","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:e5a333b9c25eb85bb60ef6d2daa2ab14c120a38c2f97017711fade722e9b57b8","observation_id":"0cb88860-73dd-47a7-a440-dae0fdc7137d","resolution":{"observed_at":"2026-08-05T20:31:38.816400Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.13077","last_updated":"2024-10-15T22:50:58Z","snapshot_observed_at":"2026-08-16T13:51:07.270906Z","submitted_at":"2024-05-21T03:16:35Z","title":"GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.13077","snapshot_observed_at":"2026-08-05T20:31:38.916981Z","title":"Gpt-4 jailbreaks itself with near-perfect success using self-explanation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:38.916981Z"},"links":{"cited_paper":"/paper/2405.13077","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:03da5e9d0dc8993a2c75c69a27090aa2bdd775ddd47131537e2053a6e40ac3ea","observation_id":"988661c8-3b8b-4dae-b34b-8ba76988e131","resolution":{"observed_at":"2026-08-05T20:31:38.916981Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09177","last_updated":"2024-10-02T10:43:07Z","snapshot_observed_at":"2026-08-16T14:18:39.495919Z","submitted_at":"2024-02-14T13:45:19Z","title":"Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09177","snapshot_observed_at":"2026-08-05T20:31:39.012270Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:39.012270Z"},"links":{"cited_paper":"/paper/2402.09177","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:94a0dd9715f3effed00505f48ab69c144ec41437546a2028fd02c642d4739f36","observation_id":"d301f50f-4848-491b-b0b0-448c66818f48","resolution":{"observed_at":"2026-08-05T20:31:39.012270Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.13926","last_updated":"2024-02-21T16:46:36Z","snapshot_observed_at":"2026-08-20T15:45:01.471639Z","submitted_at":"2024-02-21T16:46:36Z","title":"Large Language Models are Vulnerable to Bait-and-Switch Attacks for Generating Harmful Content","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.13926","snapshot_observed_at":"2026-08-05T20:31:39.106420Z","title":"Large language models are vulnerable to bait-and-switch attacks for generating harmful content","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:39.106420Z"},"links":{"cited_paper":"/paper/2402.13926","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:13fbbd715d41d196b3a79eb862b458fee8cfd3b328f83e5af10d96aeed6d723d","observation_id":"db9352be-3e94-4c12-a714-e05670708b7b","resolution":{"observed_at":"2026-08-05T20:31:39.106420Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.15690","last_updated":"2024-02-24T02:27:55Z","snapshot_observed_at":"2026-08-16T14:15:44.679715Z","submitted_at":"2024-02-24T02:27:55Z","title":"Foot In The Door: Understanding Large Language Model Jailbreaking via Cognitive Psychology","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.15690","snapshot_observed_at":"2026-08-05T20:31:39.185931Z","title":"Foot in the door: Understanding large language model jailbreaking via cognitive psychology","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:39.185931Z"},"links":{"cited_paper":"/paper/2402.15690","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:024643e9b8c7a93de61fde9a81df6b728b2c4e77736d4acd361e9dcf6238168b","observation_id":"b6572016-2ca6-486f-b7cd-6ddbf51ce786","resolution":{"observed_at":"2026-08-05T20:31:39.185931Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.17262","last_updated":"2024-10-30T05:43:51Z","snapshot_observed_at":"2026-08-16T14:15:01.775818Z","submitted_at":"2024-02-27T07:11:59Z","title":"Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.17262","snapshot_observed_at":"2026-08-05T20:31:39.270858Z","title":"Speak out of turn: Safety vulnerability of large language models in multi-turn dialogue","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:39.270858Z"},"links":{"cited_paper":"/paper/2402.17262","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:ceb0527ae081d262bb823955ceb1f084a6bcedceaebdfb6d3e1c7fc80e2fc616","observation_id":"f9832347-69c1-485d-b07d-92509c29f29d","resolution":{"observed_at":"2026-08-05T20:31:39.270858Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.01833","last_updated":"2025-02-26T13:41:41Z","snapshot_observed_at":"2026-08-21T00:19:01.514656Z","submitted_at":"2024-04-02T10:45:49Z","title":"Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.01833","snapshot_observed_at":"2026-08-05T20:31:39.383251Z","title":"Great, now write an article about that: The crescendo multi-turn llm jailbreak attack","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:39.383251Z"},"links":{"cited_paper":"/paper/2404.01833","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:00fdf3d02991dd45b3286c1e3ee0bfeff5afdf95dde17d8c5bd09f395f6f25d6","observation_id":"cbadbbac-3e64-4778-90c7-60019d30923c","resolution":{"observed_at":"2026-08-05T20:31:39.383251Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.05610","last_updated":"2024-05-09T08:15:21Z","snapshot_observed_at":"2026-08-21T10:01:54.846870Z","submitted_at":"2024-05-09T08:15:21Z","title":"Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.05610","snapshot_observed_at":"2026-08-05T20:31:39.494024Z","title":"Chain of attack: a semantic-driven contextual multi-turn attacker for llm","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:39.494024Z"},"links":{"cited_paper":"/paper/2405.05610","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:73814a7ddcd6cd19147e6fe9eb4c72f370b8b08421c317b4c95f44fd50b55630","observation_id":"ddc25817-9bbc-4f3c-9f6c-b6894256d338","resolution":{"observed_at":"2026-08-05T20:31:39.494024Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.06373","last_updated":"2024-01-23T22:46:12Z","snapshot_observed_at":"2026-08-20T15:39:34.196904Z","submitted_at":"2024-01-12T16:13:24Z","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.06373","snapshot_observed_at":"2026-08-05T20:31:39.578072Z","title":"How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:39.578072Z"},"links":{"cited_paper":"/paper/2401.06373","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:45593fea494e39b399fa4f07462dc0d375593ee0dd8c483bd90f777d004dec0f","observation_id":"a1cd6c39-faad-47d4-9419-a2595bb633ec","resolution":{"observed_at":"2026-08-05T20:31:39.578072Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.06463","last_updated":"2024-03-26T04:23:12Z","snapshot_observed_at":"2026-08-19T19:09:36.928554Z","submitted_at":"2023-08-12T04:05:57Z","title":"GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.06463","snapshot_observed_at":"2026-08-05T20:31:39.676177Z","title":"Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:39.676177Z"},"links":{"cited_paper":"/paper/2308.06463","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:fe9443916b15dbf9c0b65a0acd1ffac736fc3a3de840699fe7623b832e88218b","observation_id":"7a546f1b-868d-443b-9131-adc1338483e6","resolution":{"observed_at":"2026-08-05T20:31:39.676177Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:39.753248Z","title":"Jailbreaking proprietary large language models using word substitution cipher","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:39.753248Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:63a10a1a23316f14a367f42f00625b50180632fbe6f627fac597ab3256278db9","observation_id":"994455b5-e1c7-40d3-a964-8916c933abce","resolution":{"observed_at":"2026-08-05T20:31:39.753248Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.01294","last_updated":"2025-05-10T19:38:13Z","snapshot_observed_at":"2026-08-16T13:13:29.158111Z","submitted_at":"2024-10-02T07:40:56Z","title":"Endless Jailbreaks with Bijection Learning","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.01294","snapshot_observed_at":"2026-08-05T20:31:39.837061Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:39.837061Z"},"links":{"cited_paper":"/paper/2410.01294","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:67588087df5b18e96d1b49747f9a93840ce6e873a2914855c2e7459c6718324f","observation_id":"d3394ec4-0e10-4687-bc61-bf5b581bd413","resolution":{"observed_at":"2026-08-05T20:31:39.837061Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.11753","last_updated":"2024-06-07T17:35:17Z","snapshot_observed_at":"2026-08-17T13:43:32.178696Z","submitted_at":"2024-02-19T00:43:31Z","title":"ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.11753","snapshot_observed_at":"2026-08-05T20:31:39.978896Z","title":"Artprompt: Ascii art-based jailbreak attacks against aligned llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:39.978896Z"},"links":{"cited_paper":"/paper/2402.11753","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:19d782f436c68bbcfdd639a6230fd1b451e55abeb273d2d4361074a20ace2bab","observation_id":"78b3b375-eb49-4fd2-8927-49c564fdca30","resolution":{"observed_at":"2026-08-05T20:31:39.978896Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.20653","last_updated":"2025-06-17T03:03:45Z","snapshot_observed_at":"2026-08-19T03:10:54.063244Z","submitted_at":"2024-05-31T07:41:03Z","title":"Mind the Inconspicuous: Revealing the Hidden Weakness in Aligned LLMs' Refusal Boundaries","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.20653","snapshot_observed_at":"2026-08-05T20:31:40.072419Z","title":"Enhancing jailbreak attack against large language models through silent tokens","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:40.072419Z"},"links":{"cited_paper":"/paper/2405.20653","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:818be2dfabf2f991b0de1a0e2e286b3c03d36f66e16e7e69db2e500809b5adb3","observation_id":"fa6d8ef1-779b-4e8f-956b-f105db6f570c","resolution":{"observed_at":"2026-08-05T20:31:40.072419Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.01288","last_updated":"2024-10-30T12:08:42Z","snapshot_observed_at":"2026-08-16T18:08:17.585364Z","submitted_at":"2024-06-03T12:59:17Z","title":"Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.01288","snapshot_observed_at":"2026-08-05T20:31:40.174290Z","title":"Improved few-shot jailbreaking can circumvent aligned language models and their defenses","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:40.174290Z"},"links":{"cited_paper":"/paper/2406.01288","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:ab2e079b66383c9e02a8ff6e8abf6e08a7b24da5d6f98bbcf7c7ba1a2f1dcc86","observation_id":"21da2a50-cc45-46b1-bf0a-ac8480d8d34d","resolution":{"observed_at":"2026-08-05T20:31:40.174290Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.19668","last_updated":"2024-05-30T03:38:31Z","snapshot_observed_at":"2026-08-19T04:30:54.171938Z","submitted_at":"2024-05-30T03:38:31Z","title":"AutoBreach: Universal and Adaptive Jailbreaking with Efficient Wordplay-Guided Optimization","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.19668","snapshot_observed_at":"2026-08-05T20:31:40.261208Z","title":"Autobreach: Universal and adaptive jailbreaking with efficient wordplay-guided optimization","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:40.261208Z"},"links":{"cited_paper":"/paper/2405.19668","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:0a96854d5b4d3a1a5a8f1933f4bfbca1540a0aeb25c586d16ed4f337f23cab3d","observation_id":"1b717d4d-1dc1-44c4-9960-8658c2b0d429","resolution":{"observed_at":"2026-08-05T20:31:40.261208Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09091","last_updated":"2024-02-16T10:24:04Z","snapshot_observed_at":"2026-08-19T17:48:15.727395Z","submitted_at":"2024-02-14T11:11:51Z","title":"Play Guessing Game with LLM: Indirect Jailbreak Attack with Implicit Clues","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09091","snapshot_observed_at":"2026-08-05T20:31:40.373214Z","title":"Play guessing game with llm: Indirect jailbreak attack with implicit clues","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:40.373214Z"},"links":{"cited_paper":"/paper/2402.09091","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:bda323f1dbde5855b2a57e092b7b0a300f6b8a75cd94641e2750c140ede4933d","observation_id":"3ecd295a-6107-4aa3-9682-247e5b5f1aa8","resolution":{"observed_at":"2026-08-05T20:31:40.373214Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16914","last_updated":"2024-11-11T23:08:20Z","snapshot_observed_at":"2026-08-16T14:15:30.913660Z","submitted_at":"2024-02-25T17:43:29Z","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16914","snapshot_observed_at":"2026-08-05T20:31:40.480555Z","title":"Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:40.480555Z"},"links":{"cited_paper":"/paper/2402.16914","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:62bb41e8caa740b19879aa9f8e6c8b0d62c482dd083289b90087900f48fff53c","observation_id":"79ee3035-118a-407b-8085-916f7b3b6269","resolution":{"observed_at":"2026-08-05T20:31:40.480555Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.18104","last_updated":"2024-06-10T11:20:43Z","snapshot_observed_at":"2026-08-16T18:08:19.232075Z","submitted_at":"2024-02-28T06:50:14Z","title":"Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.18104","snapshot_observed_at":"2026-08-05T20:31:40.561131Z","title":"Making them ask and answer: Jailbreaking large language models in few queries via disguise and reconstruction","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:40.561131Z"},"links":{"cited_paper":"/paper/2402.18104","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:2f559a0aee9b47e606a9e30ffcaebc3b6cfbb0d60f6cc55816c6b3786ddefa7e","observation_id":"14348ef6-23eb-4fc7-95c7-32497fdfcd76","resolution":{"observed_at":"2026-08-05T20:31:40.561131Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.07865","last_updated":"2024-09-14T11:41:49Z","snapshot_observed_at":"2026-08-19T14:09:00.398644Z","submitted_at":"2024-03-12T17:55:38Z","title":"CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.07865","snapshot_observed_at":"2026-08-05T20:31:40.641624Z","title":"Codeattack: Revealing safety generalization challenges of large language models via code completion","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:40.641624Z"},"links":{"cited_paper":"/paper/2403.07865","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:9b914941c4b6abb0e85ec32cd534e07c7bc4fd2b1affb5b29b06683ae6508e49","observation_id":"4996865d-87dd-432e-bb2b-4d92ae4f1f62","resolution":{"observed_at":"2026-08-05T20:31:40.641624Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16717","last_updated":"2024-02-26T16:35:59Z","snapshot_observed_at":"2026-08-20T07:56:32.352535Z","submitted_at":"2024-02-26T16:35:59Z","title":"CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16717","snapshot_observed_at":"2026-08-05T20:31:40.726264Z","title":"Codechameleon: Personalized encryption framework for jailbreaking large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:40.726264Z"},"links":{"cited_paper":"/paper/2402.16717","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:0625011c6d97f5999d7a5cd05ad9132988b9718655fae3b7ff3e9863797441e1","observation_id":"7ec4bc9c-2de1-4dc3-b8e1-8a9345ed3384","resolution":{"observed_at":"2026-08-05T20:31:40.726264Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.08268","last_updated":"2024-04-07T03:04:10Z","snapshot_observed_at":"2026-08-16T14:43:23.466774Z","submitted_at":"2023-11-14T16:02:16Z","title":"A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.08268","snapshot_observed_at":"2026-08-05T20:31:40.813666Z","title":"A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:40.813666Z"},"links":{"cited_paper":"/paper/2311.08268","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:8ede842aa10668ac4912736d8754f818c3f2bf68fa51d45b1092408655988020","observation_id":"1eccfcfc-c96a-4ec0-9160-2dc7dcd13a09","resolution":{"observed_at":"2026-08-05T20:31:40.813666Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.03191","last_updated":"2024-11-28T13:43:50Z","snapshot_observed_at":"2026-08-18T06:50:23.685098Z","submitted_at":"2023-11-06T15:29:30Z","title":"DeepInception: Hypnotize Large Language Model to Be Jailbreaker","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.03191","snapshot_observed_at":"2026-08-05T20:31:40.900099Z","title":"Deepin- ception: Hypnotize large language model to be jailbreaker","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:40.900099Z"},"links":{"cited_paper":"/paper/2311.03191","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:6137508e8f9ff2ee326328c645511db83ead546d966bc95a4682db6dca56b3f9","observation_id":"75e46ad7-42c9-47ad-9012-227974bb1b5c","resolution":{"observed_at":"2026-08-05T20:31:40.900099Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.16205","last_updated":"2025-06-18T02:41:56Z","snapshot_observed_at":"2026-08-20T14:42:28.552459Z","submitted_at":"2024-07-23T06:14:41Z","title":"LLMs can be Dangerous Reasoners: Analyzing-based Jailbreak Attack on Large Language Models","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.16205","snapshot_observed_at":"2026-08-05T20:31:41.015324Z","title":"Fig- ure it out: Analyzing-based jailbreak attack on large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:41.015324Z"},"links":{"cited_paper":"/paper/2407.16205","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:0f64120cae34582bf56bc4f5cd18ab5aaa5af816f2585cfa21012ddd0504f752","observation_id":"5062fa6e-774e-4d32-9460-93e018b24fd0","resolution":{"observed_at":"2026-08-05T20:31:41.015324Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.05733","last_updated":"2023-02-11T15:57:44Z","snapshot_observed_at":"2026-08-20T02:30:00.157794Z","submitted_at":"2023-02-11T15:57:44Z","title":"Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.05733","snapshot_observed_at":"2026-08-05T20:31:41.107700Z","title":"Exploiting programmatic behavior of llms: Dual-use through standard secu- rity attacks","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:41.107700Z"},"links":{"cited_paper":"/paper/2302.05733","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:e9bc2a2e1268ed9b50efb666df0300c866199270c30c3b4de411f668c20660c2","observation_id":"503994c0-873c-4d01-bc23-7d6f96f3ef5c","resolution":{"observed_at":"2026-08-05T20:31:41.107700Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:41.204266Z","title":"Harris, and Marcel Carlsson","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:41.204266Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:fcff2ef9375ff45f33910a1e767a0e91dfe84390ba14d93ed05c008a93c954a5","observation_id":"b527fb2d-3981-4b5b-8a4a-fea67a2d4492","resolution":{"observed_at":"2026-08-05T20:31:41.204266Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.04849","last_updated":"2024-04-16T22:34:46Z","snapshot_observed_at":"2026-08-16T14:03:02.123654Z","submitted_at":"2024-04-07T07:42:12Z","title":"Hidden You Malicious Goal Into Benign Narratives: Jailbreak Large Language Models through Logic Chain Injection","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.04849","snapshot_observed_at":"2026-08-05T20:31:41.267214Z","title":"Hidden you malicious goal into benign narratives: Jail- break large language models through logic chain injection","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:41.267214Z"},"links":{"cited_paper":"/paper/2404.04849","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:ff98a8fad7e22cc0e0374185fb1424abde5fd3b86764665f7d2e7fd337f8c7d2","observation_id":"f9b37606-de90-4af1-a6e7-3428a4bc4d79","resolution":{"observed_at":"2026-08-05T20:31:41.267214Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.03825","last_updated":"2024-05-15T12:06:31Z","snapshot_observed_at":"2026-08-16T09:32:10.049300Z","submitted_at":"2023-08-07T16:55:20Z","title":"\"Do Anything Now\": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.03825","snapshot_observed_at":"2026-08-05T20:31:41.373394Z","title":"do anything now","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:41.373394Z"},"links":{"cited_paper":"/paper/2308.03825","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:d9cb97a72010ddd2eba2081e5adf5d6e76fdf8000a15bff425d8f2bb6303dcc0","observation_id":"a35bf87d-fa26-4e8b-bd01-a5cef0f76913","resolution":{"observed_at":"2026-08-05T20:31:41.373394Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.13860","last_updated":"2024-03-10T13:58:08Z","snapshot_observed_at":"2026-08-19T22:25:04.062400Z","submitted_at":"2023-05-23T09:33:38Z","title":"Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.13860","snapshot_observed_at":"2026-08-05T20:31:41.449950Z","title":"Jailbreaking chatgpt via prompt engineering: An empirical study","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:41.449950Z"},"links":{"cited_paper":"/paper/2305.13860","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:816a4381e22064c0ff54d5ae646d3d678b3c09eb088b0c09595a1617b8854936","observation_id":"9741435e-9d62-4bda-8b93-9ddb7eaf1513","resolution":{"observed_at":"2026-08-05T20:31:41.449950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06387","last_updated":"2024-05-25T07:01:15Z","snapshot_observed_at":"2026-08-16T14:53:33.115609Z","submitted_at":"2023-10-10T07:50:29Z","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06387","snapshot_observed_at":"2026-08-05T20:31:41.559678Z","title":"Jailbreak and guard aligned language models with only few in-context demonstrations","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":92,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:41.559678Z"},"links":{"cited_paper":"/paper/2310.06387","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:eaa4488743863532be36a735599687eeadcb02a5970ef154a0fb57063ae24c2f","observation_id":"3e071d78-c297-4a80-8084-43d8cac74c4f","resolution":{"observed_at":"2026-08-05T20:31:41.559678Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:41.666187Z","title":"Masterkey: Automated jailbreaking of large language model chatbots","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:41.666187Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:ab4f76598ad43a969aae99c5fb0311552b7165bf60a20d387bdcf20604b69df7","observation_id":"203f472a-cddb-40ee-9ce1-98549ebf1a3e","resolution":{"observed_at":"2026-08-05T20:31:41.666187Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.03348","last_updated":"2023-11-24T12:50:31Z","snapshot_observed_at":"2026-08-16T14:45:33.781904Z","submitted_at":"2023-11-06T18:55:18Z","title":"Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.03348","snapshot_observed_at":"2026-08-05T20:31:41.745657Z","title":"Scalable and transferable black-box jailbreaks for language models via persona modulation","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:41.745657Z"},"links":{"cited_paper":"/paper/2311.03348","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:0dc9b25da24df9e8636a4cd024b830507423c72b8e90f7a4e4234b66cae01642","observation_id":"1a625e3c-4afa-4f3b-b1e3-eb81901693df","resolution":{"observed_at":"2026-08-05T20:31:41.745657Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:41.840089Z","title":"Guard: Role-playing to generate natural-language jailbreakings to test guideline adherence of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:41.840089Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:34970b7f47ebcbcd54d353795d1ffcbb5dedb9df74fadb30f5cc062fce32aacb","observation_id":"3a686db4-7f0f-4504-8970-4b21fbfc98b9","resolution":{"observed_at":"2026-08-05T20:31:41.840089Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.15140","last_updated":"2023-12-14T06:22:51Z","snapshot_observed_at":"2026-08-16T14:49:38.783564Z","submitted_at":"2023-10-23T17:46:07Z","title":"AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.15140","snapshot_observed_at":"2026-08-05T20:31:41.927775Z","title":"Autodan: Interpretable gradient-based adversarial attacks on large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":96,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:41.927775Z"},"links":{"cited_paper":"/paper/2310.15140","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:1d0e67994c752dd7a819f396325de91c1f5839a7a42d9121c2be49e41e5bda49","observation_id":"7b336e46-60e1-46ee-b303-d1a7e4301c73","resolution":{"observed_at":"2026-08-05T20:31:41.927775Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T20:31:42.032201Z","title":"All in how you ask for it: Simple black-box method for jailbreak attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":97,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:42.032201Z"},"links":{"citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:899e0746e7935d48e3d4c8357c8bd0fe8ff18a4b5347d60bd1b871f33255c8fb","observation_id":"0d6fe14f-9446-49ad-91f7-75c0948f0528","resolution":{"observed_at":"2026-08-05T20:31:42.032201Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.01446","last_updated":"2024-08-05T11:34:10Z","snapshot_observed_at":"2026-08-16T15:03:33.817088Z","submitted_at":"2023-09-04T08:54:20Z","title":"Open Sesame! Universal Black Box Jailbreaking of Large Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.01446","snapshot_observed_at":"2026-08-05T20:31:42.141679Z","title":"Open sesame! universal black box jailbreaking of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":98,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:42.141679Z"},"links":{"cited_paper":"/paper/2309.01446","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:e563856be672d66f7c49fb990b9e9ca14be3ee6a589cd7835820e08ff8b8ac02","observation_id":"a3f44fa2-acd8-4f49-8551-f7f32084e4ed","resolution":{"observed_at":"2026-08-05T20:31:42.141679Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.10253","last_updated":"2024-06-27T16:01:27Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-09-19T02:19:48Z","title":"GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.10253","snapshot_observed_at":"2026-08-05T20:31:42.237749Z","title":"Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":99,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:42.237749Z"},"links":{"cited_paper":"/paper/2309.10253","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:441cc4f2f8e0af3189ba4dfd82194d32b28d8417a7d55672065232d948f13f73","observation_id":"ee7830ba-e151-4cca-829e-887234174a10","resolution":{"observed_at":"2026-08-05T20:31:42.237749Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.17444","last_updated":"2023-05-27T11:00:15Z","snapshot_observed_at":"2026-08-16T15:29:04.089527Z","submitted_at":"2023-05-27T11:00:15Z","title":"Query-Efficient Black-Box Red Teaming via Bayesian Optimization","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.17444","snapshot_observed_at":"2026-08-05T20:31:42.328780Z","title":"Query-efficient black-box red teaming via bayesian optimization","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","version":1},"reference_index":100,"source":"pdf_text","source_observed_at":"2026-08-05T20:31:42.328780Z"},"links":{"cited_paper":"/paper/2305.17444","citing_paper":"/paper/2508.10404"},"observation_digest":"sha256:d51b3e34f9e6638ac7ee087e3cd68009ef9428542cfd96a10b4a0c1763297509","observation_id":"1fdf52f4-855e-4da7-b519-afef192658e4","resolution":{"observed_at":"2026-08-05T20:31:42.328780Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2508.10404","last_updated":"2025-08-14T07:12:44Z","latest_version":1,"primary_category":"cs.CL","snapshot_observed_at":"2026-08-21T08:08:18.531548Z","submitted_at":"2025-08-14T07:12:44Z","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation"},"reference_resolution":{"displayed":100,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":100,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":182},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-22T06:32:14.747728+00:00","source":"crossref"},{"observed_at":"2026-08-22T06:32:06.552537+00:00","source":"retraction_watch"}],"thesis":"As of 22 August 2026, this Paper Citation Record lists 100 of 182 outbound references and 0 inbound Pith citation observations for arXiv:2508.10404."}