{"as_of":"2026-08-08T13:53:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:521a514431e5f6017cab142cdf82d5517952ec9872274e9609a22d402f6fb189","coverage":[{"denominator":39,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":39,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T05:59:28.771885Z","state":"measured"},{"denominator":39,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":39,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2509.04615/citation-record","integrity":"/paper/2509.04615/integrity","json":"/paper/2509.04615/citation-record.json","paper":"/paper/2509.04615"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-08-05T05:59:27.764800Z","title":"Jailbroken: How does llm safety training fail?, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:27.764800Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:8c3af6915958cd6d7748343995f4807488c474b4bf6e56634163dfd616af730d","observation_id":"d699f37f-a263-477c-99ca-1399f0870c93","resolution":{"observed_at":"2026-08-05T05:59:27.764800Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.14965","last_updated":"2024-03-27T04:38:44Z","snapshot_observed_at":"2026-08-07T01:32:47.981682Z","submitted_at":"2023-05-24T09:57:37Z","title":"Tricking LLMs into Disobedience: Formalizing, Analyzing, and Detecting Jailbreaks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.14965","snapshot_observed_at":"2026-08-05T05:59:27.810979Z","title":"Tricking llms into disobedience: Formalizing, analyzing, and detecting jailbreaks, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:27.810979Z"},"links":{"cited_paper":"/paper/2305.14965","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:3a0bcd87a55825a8e23d7bc6ef80687ed5aaa8f8e1dab1b7e917411a54cf0858","observation_id":"136d3e88-d9a6-4115-8fb7-a6fef4e511d6","resolution":{"observed_at":"2026-08-05T05:59:27.810979Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.05733","last_updated":"2023-02-11T15:57:44Z","snapshot_observed_at":"2026-07-06T14:50:49.200455Z","submitted_at":"2023-02-11T15:57:44Z","title":"Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.05733","snapshot_observed_at":"2026-08-05T05:59:27.941873Z","title":"Exploiting programmatic behavior of llms: Dual-use through standard security attacks, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:27.941873Z"},"links":{"cited_paper":"/paper/2302.05733","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:8aaa1b74af1e7b3979605e2870549df13e45de041c3061869d3ec216ce860074","observation_id":"7f0c4c94-9fea-4cec-b91e-ed6b9cb57b4e","resolution":{"observed_at":"2026-08-05T05:59:27.941873Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05499","last_updated":"2025-12-29T02:25:27Z","snapshot_observed_at":"2026-07-06T15:40:27.639368Z","submitted_at":"2023-06-08T18:43:11Z","title":"Prompt Injection attack against LLM-integrated Applications","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05499","snapshot_observed_at":"2026-08-05T05:59:28.044849Z","title":"Prompt injection attack against llm- integrated applications, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.044849Z"},"links":{"cited_paper":"/paper/2306.05499","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:182b0869f3813f4e2f1e8029b15e8461f8bcf3991b7008963c72b7b48ee8f1b2","observation_id":"f297b84b-23f3-4024-89bd-8efb53814954","resolution":{"observed_at":"2026-08-05T05:59:28.044849Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.12173","last_updated":"2023-05-05T14:26:17Z","snapshot_observed_at":"2026-07-06T14:55:08.682906Z","submitted_at":"2023-02-23T17:14:38Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.12173","snapshot_observed_at":"2026-08-05T05:59:28.139852Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.139852Z"},"links":{"cited_paper":"/paper/2302.12173","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:971e38627eddb76e750d560b355f6336255cf19c16492f00ba108c07157eed12","observation_id":"a206467c-f860-4403-8b1d-a41e70f2405d","resolution":{"observed_at":"2026-08-05T05:59:28.139852Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.04528","last_updated":"2024-07-16T07:29:49Z","snapshot_observed_at":"2026-08-07T20:45:44.253504Z","submitted_at":"2023-06-07T15:37:00Z","title":"PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.04528","snapshot_observed_at":"2026-08-05T05:59:28.243698Z","title":"Promptrobust: Towards evaluating the robustness of large language models on adversarial prompts, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.243698Z"},"links":{"cited_paper":"/paper/2306.04528","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:c6df740c0cdd695acee82566dfbdad217feb528a5c97f591af8b903f98fd9f9b","observation_id":"7b63df69-81fe-40e7-a062-bae3a724ff7f","resolution":{"observed_at":"2026-08-05T05:59:28.243698Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.04237","last_updated":"2023-05-29T17:06:45Z","snapshot_observed_at":"2026-08-07T08:05:23.646592Z","submitted_at":"2023-02-08T18:07:31Z","title":"Black Box Adversarial Prompting for Foundation Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.04237","snapshot_observed_at":"2026-08-05T05:59:28.348384Z","title":"Black box adversarial prompting for foundation models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.348384Z"},"links":{"cited_paper":"/paper/2302.04237","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:51fd10d465438c42f61d42b0d845b3a439d6f155ed8a1bb22b3bb934ff07732d","observation_id":"920fb974-f6f7-4760-8b40-0a8b9717d708","resolution":{"observed_at":"2026-08-05T05:59:28.348384Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.552055Z","title":"A prompting-based approach for adversarial example generation and robustness enhancement,","venue":null,"work_id":"dc43e8a4-eadc-4bf3-b2fb-083b352265e1","year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.437962Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:09584f6eec5574680602b7dc3a4b4111b563ee9add04f11d15a728682fc3837c","observation_id":"ddf146e1-f23e-4c65-82b4-f542fbedbb27","resolution":{"observed_at":"2026-08-05T05:59:29.555851Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2401.12242","last_updated":"2024-01-20T04:53:35Z","snapshot_observed_at":"2026-08-03T13:20:53.690687Z","submitted_at":"2024-01-20T04:53:35Z","title":"BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.12242","snapshot_observed_at":"2026-08-05T05:59:28.656669Z","title":"Badchain: Backdoor chain-of-thought prompting for large language models, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.656669Z"},"links":{"cited_paper":"/paper/2401.12242","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:8d687ad5b9b41515be06f8ff9d77f480a8116619e7ebeca700fc1a6fb96bbeee","observation_id":"bb8d0d41-f8b3-4413-999a-3e438355bff2","resolution":{"observed_at":"2026-08-05T05:59:28.656669Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.539614Z","title":"Preemptive answer \"attacks\" on chain-of-thought reasoning,","venue":null,"work_id":"c6f5b8cb-23ee-40c7-b2e2-b326e003aaf4","year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.660854Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:d1fe0103791fb275f05b6ef9164a4d290e637f553d1651a6e3478d60af6dc69d","observation_id":"f2d41310-3d0c-4ca4-b2ec-0ba12563f06f","resolution":{"observed_at":"2026-08-05T05:59:29.543605Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09433","last_updated":"2024-08-15T19:51:07Z","snapshot_observed_at":"2026-07-06T16:48:16.671370Z","submitted_at":"2023-11-15T23:07:40Z","title":"Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09433","snapshot_observed_at":"2026-08-05T05:59:28.669109Z","title":"Trojan activation attack: Red-teaming large language models using activation steering for safety-alignment, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.669109Z"},"links":{"cited_paper":"/paper/2311.09433","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:e15225f0651baf57d2ea6db21722b56a0d28aa18ae6a3b1a4b4d8c0a6a945069","observation_id":"4166b559-ecfe-405c-863f-59b3cf19d032","resolution":{"observed_at":"2026-08-05T05:59:28.669109Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.09097","last_updated":"2024-12-17T04:34:32Z","snapshot_observed_at":"2026-07-06T19:32:02.130965Z","submitted_at":"2024-10-09T01:35:38Z","title":"Recent advancements in LLM Red-Teaming: Techniques, Defenses, and Ethical Considerations","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.09097","snapshot_observed_at":"2026-08-05T05:59:28.673407Z","title":"Recent advancements in llm red-teaming: Techniques, defenses, and ethical considerations, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.673407Z"},"links":{"cited_paper":"/paper/2410.09097","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:8320d3234d5945a19e10af16c58a89791970ddd788636e39728f73bb8800c6ca","observation_id":"31c492b0-4cdc-4a9f-8ee3-0cb730eaf08d","resolution":{"observed_at":"2026-08-05T05:59:28.673407Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.13459","last_updated":"2025-05-29T14:42:38Z","snapshot_observed_at":"2026-08-04T11:15:46.100317Z","submitted_at":"2024-02-21T01:30:03Z","title":"Learning to Poison Large Language Models for Downstream Manipulation","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.13459","snapshot_observed_at":"2026-08-05T05:59:28.677245Z","title":"Learning to poison large language models during instruction tuning, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.677245Z"},"links":{"cited_paper":"/paper/2402.13459","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:258dc0b5c6e5f88576f7c6c1ddd2639e3faf5b5a6b4ec90115d76c06992db6d4","observation_id":"ac8b7e90-5ad0-47ad-9fc9-ef0b23088d0b","resolution":{"observed_at":"2026-08-05T05:59:28.677245Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.02946","last_updated":"2025-07-17T01:19:42Z","snapshot_observed_at":"2026-07-06T18:57:18.298332Z","submitted_at":"2024-08-06T04:14:29Z","title":"Scaling Trends for Data Poisoning in LLMs","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.02946","snapshot_observed_at":"2026-08-05T05:59:28.681100Z","title":"Data poisoning in llms: Jailbreak-tuning and scaling laws, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.681100Z"},"links":{"cited_paper":"/paper/2408.02946","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:1bf5274e7f1f61bfab982e7825a2105d43e9748fc64b604ae4002889fdf3c7b0","observation_id":"ce3add1f-4311-42ca-981e-7ac8553dd870","resolution":{"observed_at":"2026-08-05T05:59:28.681100Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.527148Z","title":"Jailbroken: How does llm safety training fail? In Advances in Neural Information Processing Systems ,","venue":null,"work_id":"316d50a6-ce83-4616-b4c3-3b72db8fcc33","year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.684816Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:56ae02185e738d04023fb544ac78e39c52a1acbbed0605be664afd96f403a2b6","observation_id":"f18dd2eb-61be-4e89-ba1b-557fb7d014ed","resolution":{"observed_at":"2026-08-05T05:59:29.531127Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-05T05:59:28.692055Z","title":"Universal and transferable adversarial attacks on aligned language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.692055Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:b30ae71a44b4a627dffa10d735753bcf05c40e3d145ab99334f05954f8612ee7","observation_id":"3b752784-8a50-4f11-b528-eb4749a35695","resolution":{"observed_at":"2026-08-05T05:59:28.692055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.501111Z","title":"0xk1h0 - github: Jailbreak prompts collection","venue":null,"work_id":"7bdf6cd0-4588-4519-8c4f-502eaa9384e7","year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.696383Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:5d51a832b0f2e4795af981e81219db3fc9ca9c1dc38a21e6afb90a0777d50f6c","observation_id":"b419bb81-c754-4df2-939f-e073e4280b32","resolution":{"observed_at":"2026-08-05T05:59:29.504988Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.488106Z","title":"Llm jailbreak | mitre atlas ™","venue":null,"work_id":"8deaab25-6444-47d7-8b8f-3fe7023c6381","year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.700046Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:0c8a0082acb90dd87e14e8f5b755d99a973ed35a44b8d94c29c9fc3c8b2002ff","observation_id":"ea66c2d9-bbe0-46a2-b415-16fa02f1b69f","resolution":{"observed_at":"2026-08-05T05:59:29.492141Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:28.703514Z","title":"Novel jailbreak technique via typoglycemia, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.703514Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:d44824ab69512de9c0b1080d8211b17477f6060f944c837f09d05fa01ee96aa0","observation_id":"d2b95ec7-0475-4df8-b32d-ec2fb5e6ee97","resolution":{"observed_at":"2026-08-05T05:59:28.703514Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.474586Z","title":"Masterkey: Automated jailbreak across multiple large language model chatbots","venue":null,"work_id":"c591cb13-cc6f-4a1d-a65d-99cd2405803a","year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.706953Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:0ffd146f322d9ae4b84ffc55d9c7a6a1f81ffafcdad2ee2aee3544b7b391da3a","observation_id":"12091326-8877-4c50-babf-be51316f30e1","resolution":{"observed_at":"2026-08-05T05:59:29.478533Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:28.715705Z","title":"Exploiting programmatic behavior of llms: Dual-use through standard security attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.715705Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:c1020f07767fbce2da95d3b780f2495621637df9fc3be57d3451ef1ce7cd9b6d","observation_id":"bdc5b373-fe80-4ca4-8e9f-42aee80eec37","resolution":{"observed_at":"2026-08-05T05:59:28.715705Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.462047Z","title":"Prompt injection attacks in various llms, 2023","venue":null,"work_id":"2aa42249-dfb3-4fb6-afa5-797b5723be48","year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.719336Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:b8dbdab9cc232f2a6e4a0f0244ecb2673dad60070d0dc772307a29b85d94dcd2","observation_id":"79d0d90e-e627-4d71-9c5f-4264af60fdc4","resolution":{"observed_at":"2026-08-05T05:59:29.465961Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.448734Z","title":"Prompt injection attack on gpt-4, March 2023","venue":null,"work_id":"1d8a1278-a12c-4604-9b69-71780cf988d4","year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.722934Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:c0dcd8a9b177632a3f687746a19f4173351245fd12503288d381c84826a0426b","observation_id":"6cf41b30-5d43-4d9c-8cf3-abccc6a0b67a","resolution":{"observed_at":"2026-08-05T05:59:29.452580Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.08715","last_updated":"2023-10-25T07:30:51Z","snapshot_observed_at":"2026-07-06T15:54:58.589775Z","submitted_at":"2023-07-16T01:07:15Z","title":"MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.08715","snapshot_observed_at":"2026-08-05T05:59:28.711730Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.711730Z"},"links":{"cited_paper":"/paper/2307.08715","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:cba66112ee474cf693c8959ec7c71cede501ec067c72a10eb85e8de51c8fd82a","observation_id":"21332e49-ab08-4b7c-a50d-302f69aa472d","resolution":{"observed_at":"2026-08-05T05:59:28.711730Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.435728Z","title":"Trojtext: Test-time invisible textual trojan insertion","venue":null,"work_id":"c596fa92-f6d8-4cc2-ae0a-12fbf2a1a413","year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.730849Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:b1a1081e4d6a9ce3aa1db0d8a8904ed5cc9e7b5a6fd2f05662f7586dbd33b72b","observation_id":"4fdcb0c3-9dff-4d51-9fb0-7ac8a5d4e349","resolution":{"observed_at":"2026-08-05T05:59:29.439908Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:28.737973Z","title":"Trojan activation attack: Red-teaming large language models using activation steering for safety-alignment","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.737973Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:7d98aae0770e2b3f46f7c35c726d0d504043c37eab2f19e6f4d4d95ca7655d9b","observation_id":"0463aaac-9cd0-4aae-a5bc-d727c3db5cf0","resolution":{"observed_at":"2026-08-05T05:59:28.737973Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09433","last_updated":"2024-08-15T19:51:07Z","snapshot_observed_at":"2026-07-06T16:48:16.671370Z","submitted_at":"2023-11-15T23:07:40Z","title":"Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09433","snapshot_observed_at":"2026-08-05T05:59:28.741450Z","title":"Trojan activation attack: Red-teaming large language models using activation steering for safety-alignment","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.741450Z"},"links":{"cited_paper":"/paper/2311.09433","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:a53d84805b0d85ffe94818db4d9b4d9dbccf89279a269953f1e5f5f38b08d083","observation_id":"c70146f0-2fba-4554-9a18-c148d61dcb7e","resolution":{"observed_at":"2026-08-05T05:59:28.741450Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2410.13334","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:28.940857Z","title":"Do llms have political correctness? analyzing ethical biases and jailbreak vulnerabilities in ai systems, 2024","venue":null,"work_id":"2c83c6a1-a8f0-49b1-aa26-0dab9735c781","year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.749477Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:6a7f603ca334f3aa0ee27fba901d528981287dad159a47d29f6e1843330fa1d1","observation_id":"b2d45d7c-98b6-4e49-a293-59861480529f","resolution":{"observed_at":"2026-08-05T05:59:28.947863Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.02242","last_updated":"2023-08-22T02:34:19Z","snapshot_observed_at":"2026-07-06T14:58:33.391195Z","submitted_at":"2023-03-03T22:19:22Z","title":"TrojText: Test-time Invisible Textual Trojan Insertion","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.02242","snapshot_observed_at":"2026-08-05T05:59:28.734338Z","title":"arXiv:2303.02242","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.734338Z"},"links":{"cited_paper":"/paper/2303.02242","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:fdcb0e03dddff704f0313a2173bc4ffb46f13123174123f624f0585b6a2dc7d7","observation_id":"daeb5318-2729-4486-a055-f242a92723be","resolution":{"observed_at":"2026-08-05T05:59:28.734338Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.01424","last_updated":"2024-06-18T09:14:34Z","snapshot_observed_at":"2026-08-07T05:21:57.866448Z","submitted_at":"2023-09-27T15:15:23Z","title":"Identifying and Mitigating Privacy Risks Stemming from Language Models: A Survey","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.01424","snapshot_observed_at":"2026-08-05T05:59:28.757303Z","title":"Identifying and mitigating privacy risks stemming from language models: A survey, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.757303Z"},"links":{"cited_paper":"/paper/2310.01424","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:22ff277bcd5606c23fae04b11d7de9fd80c80b9e9b86d8eee086e41716587091","observation_id":"7cf2896e-0630-4c0a-9b3d-3b63fd7d33a7","resolution":{"observed_at":"2026-08-05T05:59:28.757303Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.422271Z","title":"Reinforcement learning- driven LLM agent for automated attacks on LLMs","venue":null,"work_id":"3a4db020-07a9-4b9e-a25d-225110c942e9","year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.761065Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:a29cd0a6fffb2d1edfa90ed00c7772c1fb8a3b74023e2a48d16c6262e2f14076","observation_id":"56142a18-7a70-4c6b-8a25-c55c14c2c887","resolution":{"observed_at":"2026-08-05T05:59:29.426604Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.01469","last_updated":"2024-08-04T16:26:14Z","snapshot_observed_at":"2026-08-06T01:14:15.953789Z","submitted_at":"2023-10-02T17:01:56Z","title":"LLM Lies: Hallucinations are not Bugs, but Features as Adversarial Examples","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.01469","snapshot_observed_at":"2026-08-05T05:59:28.745638Z","title":"Llm lies: Hallucinations are not bugs, but features as adversarial examples, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.745638Z"},"links":{"cited_paper":"/paper/2310.01469","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:317c4367f06b85225b45686904e76967293bca589f1621e1ac16d50fcac6c88d","observation_id":"0848b3bf-217d-4a88-a68c-a14b3f7ecd1b","resolution":{"observed_at":"2026-08-05T05:59:28.745638Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13660","last_updated":"2024-04-21T13:31:16Z","snapshot_observed_at":"2026-08-07T00:36:29.121411Z","submitted_at":"2024-04-21T13:31:16Z","title":"Trojan Detection in Large Language Models: Insights from The Trojan Detection Challenge","version":1},"cited_work":{"arxiv_id":"2404.13660","doi":null,"metadata_source":"pith","pith_arxiv_id":"2404.13660","snapshot_observed_at":"2026-08-05T05:59:28.821789Z","title":"Trojan Detection in Large Language Models: Insights from The Trojan Detection Challenge","venue":"cs.CL","work_id":"62a51fcd-e52a-4039-8d73-93aef8cd42a6","year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.768243Z"},"links":{"cited_paper":"/paper/2404.13660","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:315d39da7b2090d4ec247ae1d2aaa372ae22fa4ad98815a697ed2ca29fd4fbcb","observation_id":"69d64cda-7a28-4ee3-92a3-7ff35bf5818c","resolution":{"observed_at":"2026-08-05T05:59:28.827636Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.02027","last_updated":"2024-07-02T07:49:48Z","snapshot_observed_at":"2026-08-08T12:06:23.672442Z","submitted_at":"2024-07-02T07:49:48Z","title":"Privacy Risks of General-Purpose AI Systems: A Foundation for Investigating Practitioner Perspectives","version":1},"cited_work":{"arxiv_id":"2407.02027","doi":null,"metadata_source":"pith","pith_arxiv_id":"2407.02027","snapshot_observed_at":"2026-08-05T05:59:28.871326Z","title":"Privacy Risks of General-Purpose AI Systems: A Foundation for Investigating Practitioner Perspectives","venue":"cs.CY","work_id":"e6fc7e2f-98b5-4940-9ead-91bfb7a9abc9","year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.752957Z"},"links":{"cited_paper":"/paper/2407.02027","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:c1f09a82390c08da6ba9311523e1cfb04341ecc5c511e17920033009e1e0d5cd","observation_id":"30070107-183b-4479-be43-53eb2f806334","resolution":{"observed_at":"2026-08-05T05:59:28.876110Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2306.06815","last_updated":"2023-10-31T00:33:53Z","snapshot_observed_at":"2026-08-03T12:46:15.681566Z","submitted_at":"2023-06-12T01:22:39Z","title":"TrojLLM: A Black-box Trojan Prompt Attack on Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.06815","snapshot_observed_at":"2026-08-05T05:59:28.764525Z","title":"Trojllm: A black-box trojan prompt attack on large language models, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.764525Z"},"links":{"cited_paper":"/paper/2306.06815","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:c901973ef1f5b906a8209fa9d3d6160c985e49df43d82e771633dfc89bdb06d1","observation_id":"47d134dd-4084-4a4e-96d4-d344fda06a2a","resolution":{"observed_at":"2026-08-05T05:59:28.764525Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.16119","last_updated":"2024-03-03T00:12:16Z","snapshot_observed_at":"2026-07-06T16:53:18.275859Z","submitted_at":"2023-10-24T18:18:11Z","title":"Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.16119","snapshot_observed_at":"2026-08-05T05:59:28.771885Z","title":"Ignore this title and hackaprompt: Exposing systemic vulnerabilities of llms through a global scale prompt hacking competition, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.771885Z"},"links":{"cited_paper":"/paper/2311.16119","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:d4d9020f17dd67e5a74bb3e53f7f6c27d533ca345d9a7af40d6c8dfc9a514d93","observation_id":"e12e604a-c60c-47cb-9b38-7618463c417f","resolution":{"observed_at":"2026-08-05T05:59:28.771885Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2203.10714","last_updated":"2022-03-21T03:21:32Z","snapshot_observed_at":"2026-07-06T12:50:04.562634Z","submitted_at":"2022-03-21T03:21:32Z","title":"A Prompting-based Approach for Adversarial Example Generation and Robustness Enhancement","version":1},"cited_work":{"arxiv_id":"2203.10714","doi":null,"metadata_source":"pith","pith_arxiv_id":"2203.10714","snapshot_observed_at":"2026-08-05T05:59:29.310263Z","title":"A Prompting-based Approach for Adversarial Example Generation and Robustness Enhancement","venue":"cs.CL","work_id":"980eeec5-6436-4ed8-bde0-b68ccd9aa395","year":2022},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":2022,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.571988Z"},"links":{"cited_paper":"/paper/2203.10714","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:bf43e26b028fe7be879d5ba28cee7bc5a69349d6c54473f2a3d2e0af216f19e3","observation_id":"1a3834ad-20da-4726-a80a-0dce4755644f","resolution":{"observed_at":"2026-08-05T05:59:29.314470Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:59:29.513667Z","title":null,"venue":null,"work_id":"9483d04d-60a3-4b43-8ed0-c48c344ae943","year":2023},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":2023,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.688583Z"},"links":{"citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:3c18198a506d4beba4bc4eb57d131705aeceff569cd7daac1141e1e973cf8eb0","observation_id":"5b3fb305-7b4d-4a36-a6fd-9e796798e7d7","resolution":{"observed_at":"2026-08-05T05:59:29.517816Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.20902","last_updated":"2024-05-31T15:15:04Z","snapshot_observed_at":"2026-08-07T18:34:20.223126Z","submitted_at":"2024-05-31T15:15:04Z","title":"Preemptive Answer \"Attacks\" on Chain-of-Thought Reasoning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.20902","snapshot_observed_at":"2026-08-05T05:59:28.665142Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-05T05:59:28.665142Z"},"links":{"cited_paper":"/paper/2405.20902","citing_paper":"/paper/2509.04615"},"observation_digest":"sha256:d013da551ee1e91775cfaf2a7f3b8616add00aadde8c05a40aab2d8c9b6d683f","observation_id":"6e3a9bb8-c7aa-43d2-85e9-c7a7d309a71e","resolution":{"observed_at":"2026-08-05T05:59:28.665142Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2509.04615","last_updated":"2025-09-04T18:59:07Z","latest_version":1,"primary_category":"cs.CL","snapshot_observed_at":"2026-08-08T07:38:10.301418Z","submitted_at":"2025-09-04T18:59:07Z","title":"Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs"},"reference_resolution":{"displayed":39,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":25,"verified_exact":4,"verified_fuzzy":10},"total_outbound_references":39},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 8 August 2026, this Paper Citation Record lists 39 of 39 outbound references and 0 inbound Pith citation observations for arXiv:2509.04615."}