{"as_of":"2026-08-16T00:01:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:63f958ae78c71b0a249da075f73fb804bd5877cf52a97c228d74d2f5b49865b7","coverage":[{"denominator":91,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":91,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-15T16:25:35.794271Z","state":"measured"},{"denominator":92,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":92,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-15T06:32:42.880941+00:00","state":"measured"},{"denominator":1,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-06-27T03:24:24.714121Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"arxiv_reference","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"arxiv_reference"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"cited_work":{"arxiv_id":"2509.08000","doi":"10.48550/arxiv.2509.08000","metadata_source":"arxiv_reference","pith_arxiv_id":"2509.08000","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AntiDote: Bi-level","venue":"ArXiv.org","work_id":"7d6e4861-2820-4faf-9483-cf8770bdbfbb","year":null},"citing_paper":{"arxiv_id":"2606.15980","last_updated":"2026-06-18T23:56:29Z","snapshot_observed_at":"2026-08-13T20:15:46.535466Z","submitted_at":"2026-06-14T19:07:22Z","title":"Do Activation Monitors Survive Model Updates? Benchmarking, Predicting, and Repairing Activation-Monitor Staleness","version":2},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-06-27T03:24:24.714121Z"},"links":{"cited_paper":"/paper/2509.08000","citing_paper":"/paper/2606.15980"},"observation_digest":"sha256:ec6d5579a1e441d92188bba516bd6480cc587fc0c882a7a14b5b3053a7ac4930","observation_id":"9d9a0935-e55e-49d7-b954-564f6fade08c","resolution":{"observed_at":"2026-06-27T03:30:26.978682Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2509.08000/citation-record","integrity":"/paper/2509.08000/integrity","json":"/paper/2509.08000/citation-record.json","paper":"/paper/2509.08000"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.382342Z","title":", \" * write output.state after.block = add.period write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.382342Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:0e8ae91da622845e13076ea984f9267ea7005e3ff0e048d92211939532d279f3","observation_id":"ad25e298-6573-45c4-85c6-f3496b163bae","resolution":{"observed_at":"2026-08-15T16:25:35.382342Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.387959Z","title":"write newline","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.387959Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:e6733f872c7fddb5fde1e4aa03db63b8aa93228dc90527f288413c8e0cdf03c6","observation_id":"aa8a2ef4-2be3-40f2-a0b0-5e1d45d5e73c","resolution":{"observed_at":"2026-08-15T16:25:35.387959Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04652","last_updated":"2025-01-21T10:12:05Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-07T16:52:49Z","title":"Yi: Open Foundation Models by 01.AI","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.04652","snapshot_observed_at":"2026-08-15T16:25:35.392417Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.392417Z"},"links":{"cited_paper":"/paper/2403.04652","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d4c44749cd8aad3ecba3100eb065127eda31bdcc22efb2348cf19ab2f24e1c3f","observation_id":"5cb1a105-d857-45f5-bd98-f79924b9a913","resolution":{"observed_at":"2026-08-15T16:25:35.392417Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.16867","last_updated":"2023-11-29T19:45:10Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-11-28T15:12:47Z","title":"The Falcon Series of Open Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.16867","snapshot_observed_at":"2026-08-15T16:25:35.397446Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.397446Z"},"links":{"cited_paper":"/paper/2311.16867","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:59e20888aea4c5d54d99c910b3beeddf941f1f3d7e60de6544b15a063a68bfe0","observation_id":"63e14614-66d4-4149-b35d-a0c099c42125","resolution":{"observed_at":"2026-08-15T16:25:35.397446Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.401443Z","title":"E.; Hubinger, E.; Bai, Y.; Bricken, T.; Maxwell, T.; Schiefer, N.; Sully, J.; Tamkin, A.; Lanham, T.; Nguyen, K.; Korbak, T.; Kaplan, J.; Ganguli, D.; Bowman, S","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.401443Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:5654b1569d45a44388af45ce38f08d06808597636a8790c63ade19be890dc5f2","observation_id":"00948fef-d163-4498-bb1e-14fb8d997059","resolution":{"observed_at":"2026-08-15T16:25:35.401443Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.11717","last_updated":"2024-10-30T18:57:07Z","snapshot_observed_at":"2026-08-15T09:21:47.572546Z","submitted_at":"2024-06-17T16:36:12Z","title":"Refusal in Language Models Is Mediated by a Single Direction","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.11717","snapshot_observed_at":"2026-08-15T16:25:35.405667Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.405667Z"},"links":{"cited_paper":"/paper/2406.11717","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:13089604b138dd19a1b0cae555d9f978990ba104fb0eb5d7fdb78b25073258f4","observation_id":"8f4c4d3c-4ac2-414d-a932-56dd9d53052f","resolution":{"observed_at":"2026-08-15T16:25:35.405667Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.409950Z","title":"Do Anything Now","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.409950Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:9abbf4729a1e6ed288f38152be1bda7d2c4d10a9d65d8830cbc7de6199366ced","observation_id":"af39a24f-0b0c-427b-9445-15d5df9c7f85","resolution":{"observed_at":"2026-08-15T16:25:35.409950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.413726Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.413726Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:4efe7101d4cd7537594282cfa2605877dc208ab82e35bef757fbd16370bd27f1","observation_id":"a601b59f-ea31-4e22-a836-625c583ea314","resolution":{"observed_at":"2026-08-15T16:25:35.413726Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.418714Z","title":"A.; and Hill, E","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.418714Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:bf046f3ccb05de8c8d54ecf30a2f97f381e5a0bc2dcabeb4f7f55e1c63bd6476","observation_id":"da90c372-54be-4d7a-a2d3-25ba07ff3003","resolution":{"observed_at":"2026-08-15T16:25:35.418714Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.423138Z","title":null,"venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.423138Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:f0cfe98aa86fa97dd5480315bb33a1beecdf54780fc4b2c3e51adf3402d3a3fb","observation_id":"19928a12-01f7-45d0-af60-33a7fee39670","resolution":{"observed_at":"2026-08-15T16:25:35.423138Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.429822Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.429822Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:a6e120f8c86f8497591f21f007dd926e5e7741cc01e2d9ca118003aee5bdee33","observation_id":"9179db64-dab0-43ef-b687-c3e2d825e606","resolution":{"observed_at":"2026-08-15T16:25:35.429822Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.438338Z","title":"J.; and Wong, E","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.438338Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:04ba440012c4677449a32909910c56d0bdda086f3d417a137f9815b91f9ded2e","observation_id":"37912514-015c-4863-89a5-7890860e2bbb","resolution":{"observed_at":"2026-08-15T16:25:35.438338Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05209","last_updated":"2025-07-24T21:34:54Z","snapshot_observed_at":"2026-08-09T22:40:17.102835Z","submitted_at":"2025-02-03T18:59:16Z","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05209","snapshot_observed_at":"2026-08-15T16:25:35.442838Z","title":"E.; Gandikota, R.; Ewart, A.; Rosati, D.; Wu, Z.; et al","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.442838Z"},"links":{"cited_paper":"/paper/2502.05209","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:56ed48112be0b47f99716e9e3c1a6c03f83bbe8b39d257268e0dd6a3d3df6421","observation_id":"d4017d78-8c14-4e7f-a732-46170f55fb0a","resolution":{"observed_at":"2026-08-15T16:25:35.442838Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.447097Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.447097Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:1a161e9f913cef9537d843aa4337db6f540f99fe5d1968152bce651ad36584b4","observation_id":"4859decf-14a6-450c-af55-fa9e40cf246a","resolution":{"observed_at":"2026-08-15T16:25:35.447097Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2110.14168","last_updated":"2021-11-18T00:23:45Z","snapshot_observed_at":"2026-08-14T02:43:01.480086Z","submitted_at":"2021-10-27T04:49:45Z","title":"Training Verifiers to Solve Math Word Problems","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2110.14168","snapshot_observed_at":"2026-08-15T16:25:35.450756Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.450756Z"},"links":{"cited_paper":"/paper/2110.14168","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:27a11730e98143c48fdd30618642bcfe8cfde4328d2afa826ded1926b58df5f0","observation_id":"3d6f2e35-02f0-4520-9bab-70d7fe82028a","resolution":{"observed_at":"2026-08-15T16:25:35.450756Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2006.16362","last_updated":"2021-05-20T14:48:30Z","snapshot_observed_at":"2026-08-09T06:13:20.021836Z","submitted_at":"2020-06-29T20:28:52Z","title":"Multi-Head Attention: Collaborate Instead of Concatenate","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2006.16362","snapshot_observed_at":"2026-08-15T16:25:35.454813Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.454813Z"},"links":{"cited_paper":"/paper/2006.16362","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:5df597d5e7a3d1e961d61852d32898996ac731a2f065dffe6e696b495f671208","observation_id":"c9f372f3-b706-4e65-b29e-3c151c9d96a2","resolution":{"observed_at":"2026-08-15T16:25:35.454813Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.19437","last_updated":"2025-02-18T17:26:38Z","snapshot_observed_at":"2026-08-15T17:27:11.980940Z","submitted_at":"2024-12-27T04:03:16Z","title":"DeepSeek-V3 Technical Report","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.19437","snapshot_observed_at":"2026-08-15T16:25:35.459056Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.459056Z"},"links":{"cited_paper":"/paper/2412.19437","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:94b58731cb5a0a80879d5f74aea06e619447384932d43ad6658f2d6d67828434","observation_id":"029c671a-408e-49ce-810b-7cc95ca2f8b1","resolution":{"observed_at":"2026-08-15T16:25:35.459056Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.463314Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.463314Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:bfd18acd43422378c008211e08ea39bde7f72d35dde6dee5965f347a8e7b0391","observation_id":"e86dd41e-677f-408d-91a9-fb22a54ff9e6","resolution":{"observed_at":"2026-08-15T16:25:35.463314Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.466791Z","title":"C.; Allen, E","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.466791Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:f905d1d381bc8de48b6c310694ba95277fee91adeff083e810d888ee704ddc8f","observation_id":"3647b421-971a-4cfb-9afb-4c2ce60a1fb3","resolution":{"observed_at":"2026-08-15T16:25:35.466791Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.470899Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.470899Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:abb57d19507da07fc27692d62c60ede52175cd018560e4e26bf5b3900108c041","observation_id":"40ca8320-99af-4c93-ae36-9989f479325e","resolution":{"observed_at":"2026-08-15T16:25:35.470899Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.242134Z","title":null,"venue":null,"work_id":"667a51c0-b134-4a30-a1d3-0a1fb84c59e8","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.475467Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:dd8959a991bf3ff4ec42185fc214d35787ee3f18de5b2977f2b7710c39380210","observation_id":"c35178b1-326b-458b-af3d-87ab63237d04","resolution":{"observed_at":"2026-08-15T16:25:37.246678Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.227467Z","title":null,"venue":null,"work_id":"1d3dd58c-e4ce-47be-8c52-f14541cf77b1","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.479137Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:7daefd2f7aa9bade33c1f3aafca0d96821b685fe8dc6b86d61a009d1100f6525","observation_id":"45c5d733-ba60-419d-916d-8e2335e4d032","resolution":{"observed_at":"2026-08-15T16:25:37.231653Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05608","last_updated":"2025-01-19T16:23:38Z","snapshot_observed_at":"2026-08-13T15:57:44.715549Z","submitted_at":"2023-11-09T18:59:11Z","title":"FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05608","snapshot_observed_at":"2026-08-15T16:25:35.482899Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.482899Z"},"links":{"cited_paper":"/paper/2311.05608","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:f0375fad352b95a9f4e8ee695916a96dec267bdd108ed2b7106931bae1ca483f","observation_id":"4c40d6e0-a570-4127-b746-4696d7e71c9f","resolution":{"observed_at":"2026-08-15T16:25:35.482899Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-08-13T17:20:44.002518Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-08-15T16:25:35.486772Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.486772Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:c4964d766a4106d6e682035c55318d49befbd6272e6deb97527f1a204256ff8f","observation_id":"9009f364-c983-445c-afc9-abd99ed4df17","resolution":{"observed_at":"2026-08-15T16:25:35.486772Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.212914Z","title":null,"venue":null,"work_id":"b37072b0-234d-468a-8d69-2884dc22a41d","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.491734Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:788f1a4550de23798c2c127ac99135b81316f55499e4202c37f88cab6ea7614b","observation_id":"31fbdf9e-ce32-419c-bb86-c8bc84d5287a","resolution":{"observed_at":"2026-08-15T16:25:37.218168Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.01886","last_updated":"2024-05-03T07:14:07Z","snapshot_observed_at":"2026-08-13T00:15:38.307006Z","submitted_at":"2024-05-03T07:14:07Z","title":"Aloe: A Family of Fine-tuned Open Healthcare LLMs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.01886","snapshot_observed_at":"2026-08-15T16:25:35.495639Z","title":"K.; Lopez-Cuena, E.; Bayarri-Planas, J.; Tormos, A.; Hinjos, D.; Perez, P","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.495639Z"},"links":{"cited_paper":"/paper/2405.01886","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:241330ee567a115330495d4b8747b59670e90ba9b4f964a6da504102613c24c4","observation_id":"4114cf85-cd5d-4040-aece-c1df0a48ff81","resolution":{"observed_at":"2026-08-15T16:25:35.495639Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2009.03300","last_updated":"2021-01-12T18:57:11Z","snapshot_observed_at":"2026-08-13T20:44:28.824685Z","submitted_at":"2020-09-07T17:59:25Z","title":"Measuring Massive Multitask Language Understanding","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2009.03300","snapshot_observed_at":"2026-08-15T16:25:35.500101Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.500101Z"},"links":{"cited_paper":"/paper/2009.03300","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:1160906a27352b0f2812446a400ae4947375be5adab3a69639d9f5316eae2e2c","observation_id":"d062791c-dbb2-4b6b-b6a7-21ede5e85ef2","resolution":{"observed_at":"2026-08-15T16:25:35.500101Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2103.03874","last_updated":"2021-11-08T21:30:18Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2021-03-05T18:59:39Z","title":"Measuring Mathematical Problem Solving With the MATH Dataset","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2103.03874","snapshot_observed_at":"2026-08-15T16:25:35.504361Z","title":null,"venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.504361Z"},"links":{"cited_paper":"/paper/2103.03874","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:e26202864dbf2c91b456abb355dc0bf98d1fafaeecca0892b7ee73d121b3eab2","observation_id":"48e79834-71bf-48de-b8f7-b22018b76567","resolution":{"observed_at":"2026-08-15T16:25:35.504361Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.09689","last_updated":"2022-12-19T18:21:00Z","snapshot_observed_at":"2026-08-14T14:17:57.981547Z","submitted_at":"2022-12-19T18:21:00Z","title":"Unnatural Instructions: Tuning Language Models with (Almost) No Human Labor","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.09689","snapshot_observed_at":"2026-08-15T16:25:35.508322Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.508322Z"},"links":{"cited_paper":"/paper/2212.09689","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:9d2fb371f9a4dec66b58d63a0f80e526ee7a4fa79b73aceb154b958a46e097a8","observation_id":"9980664b-b9ad-4173-a854-2838d6d1b1b1","resolution":{"observed_at":"2026-08-15T16:25:35.508322Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2106.09685","last_updated":"2021-10-16T18:40:34Z","snapshot_observed_at":"2026-08-11T08:20:29.798517Z","submitted_at":"2021-06-17T17:37:18Z","title":"LoRA: Low-Rank Adaptation of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2106.09685","snapshot_observed_at":"2026-08-15T16:25:35.512022Z","title":"J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; and Chen, W","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.512022Z"},"links":{"cited_paper":"/paper/2106.09685","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:fabf4cade8d70e696b68c9693d8145e2c285bfe08c06c18f8c31cd2dd1b43766","observation_id":"bc112cc0-46f6-4001-9b2d-bd1e020d062c","resolution":{"observed_at":"2026-08-15T16:25:35.512022Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.01586","last_updated":"2025-03-17T17:17:16Z","snapshot_observed_at":"2026-08-12T22:52:40.630080Z","submitted_at":"2024-09-03T03:59:22Z","title":"Booster: Tackling Harmful Fine-tuning for Large Language Models via Attenuating Harmful Perturbation","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.01586","snapshot_observed_at":"2026-08-15T16:25:35.520496Z","title":"F.; and Liu, L","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.520496Z"},"links":{"cited_paper":"/paper/2409.01586","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:5c254fce7b091682e1b8487aace7f412b2df2193e514bfc27b162d2d53e1c052","observation_id":"468945ff-c394-4a8b-aae3-214d259cdeb7","resolution":{"observed_at":"2026-08-15T16:25:35.520496Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.17433","last_updated":"2025-01-29T06:24:58Z","snapshot_observed_at":"2026-08-11T04:21:47.716265Z","submitted_at":"2025-01-29T06:24:58Z","title":"Virus: Harmful Fine-tuning Attack for Large Language Models Bypassing Guardrail Moderation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.17433","snapshot_observed_at":"2026-08-15T16:25:35.524521Z","title":"F.; and Liu, L","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.524521Z"},"links":{"cited_paper":"/paper/2501.17433","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:6386b4f5d75614179823330105c13b289019a3eae75ee0f609a03a60831cd78e","observation_id":"f5f1cb5b-891b-44da-950b-d6cac8a6d69c","resolution":{"observed_at":"2026-08-15T16:25:35.524521Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.01109","last_updated":"2024-11-24T20:09:55Z","snapshot_observed_at":"2026-08-13T19:54:16.744887Z","submitted_at":"2024-02-02T02:56:50Z","title":"Vaccine: Perturbation-aware Alignment for Large Language Models against Harmful Fine-tuning Attack","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.01109","snapshot_observed_at":"2026-08-15T16:25:35.533528Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.533528Z"},"links":{"cited_paper":"/paper/2402.01109","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:5c3db7f2125f14f0aed3a42e41ea40dcbefa356eba8d108f8ed127dfb8ab5e4b","observation_id":"18be176f-584e-40d0-86c2-d944de26f4f9","resolution":{"observed_at":"2026-08-15T16:25:35.533528Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.200671Z","title":null,"venue":null,"work_id":"982fd8e5-c645-4731-b161-11cd2f3be5aa","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.537145Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:489729dc56a9b7f9ddcc01e61f6adca099f4be38b81c28e78bb579bbc59c5d26","observation_id":"d04578d6-677e-4791-b157-4fac8425e1a4","resolution":{"observed_at":"2026-08-15T16:25:37.205244Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.07137","last_updated":"2025-04-07T22:32:46Z","snapshot_observed_at":"2026-08-12T10:25:46.830091Z","submitted_at":"2025-04-07T22:32:46Z","title":"Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.07137","snapshot_observed_at":"2026-08-15T16:25:35.540991Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.540991Z"},"links":{"cited_paper":"/paper/2504.07137","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:c4318eb98d9e9c209d00c86bc5d5e4d1e999a812f8c1910f7ed107bfa19e7641","observation_id":"8dbbecfb-e8b7-4477-a8ea-9051a1b85c0a","resolution":{"observed_at":"2026-08-15T16:25:35.540991Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.545273Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.545273Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:69ae59bd60b0cb3a5885ce8654897860f2706e4a65eb7c5a0fcd5f5013a0c008","observation_id":"10c4157a-e12b-43ce-80dc-ec8054f35342","resolution":{"observed_at":"2026-08-15T16:25:35.545273Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-15T16:25:35.548883Z","title":"Q.; Sablayrolles, A.; Mensch, A.; Bamford, C.; Chaplot, D","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.548883Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:09567289fd4826fe16a2f536ba985282a3540f50bc550d998de3ba6d6ba96cf2","observation_id":"96d1e257-d944-45cf-9a65-8e2a6c5847ff","resolution":{"observed_at":"2026-08-15T16:25:35.548883Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.188055Z","title":null,"venue":null,"work_id":"81902c8d-6de6-4286-8eea-e03170daf9cb","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.553625Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:a1964c44418ac79dc40120ab6ba2ff2b470749d03d7176b2279acd6f21c7b2ca","observation_id":"70274a89-1af6-4411-8775-a947129265ee","resolution":{"observed_at":"2026-08-15T16:25:37.192162Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.11596","last_updated":"2025-02-17T09:28:51Z","snapshot_observed_at":"2026-08-11T07:13:47.071232Z","submitted_at":"2025-02-17T09:28:51Z","title":"LLM Embeddings for Deep Learning on Tabular Data","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.11596","snapshot_observed_at":"2026-08-15T16:25:35.558732Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.558732Z"},"links":{"cited_paper":"/paper/2502.11596","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:e3f9888f9bce84497d2172e693a456584c0c4d96260bade52430cf6625f23914","observation_id":"e6ae978d-4772-4f3f-a900-1d9ec49f6752","resolution":{"observed_at":"2026-08-15T16:25:35.558732Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15593","last_updated":"2024-06-06T04:53:25Z","snapshot_observed_at":"2026-08-13T10:45:24.663597Z","submitted_at":"2023-07-28T14:52:08Z","title":"Robust Distortion-free Watermarks for Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15593","snapshot_observed_at":"2026-08-15T16:25:35.562902Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.562902Z"},"links":{"cited_paper":"/paper/2307.15593","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:65363de632f2c6737df1a0159eb51f0af0c7f876385eb2687d6555a157e71019","observation_id":"3dde08bb-842c-49fb-869d-762eabf1e434","resolution":{"observed_at":"2026-08-15T16:25:35.562902Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.174620Z","title":null,"venue":null,"work_id":"525532e6-f600-4e1e-a06b-08b7d76b9077","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.566932Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d33b74199e04690ea095c3899926e124b44caa8ec2863b5b3d05f633f5de2784","observation_id":"46e0b858-00b3-4787-9db8-d7fe7ad30e9e","resolution":{"observed_at":"2026-08-15T16:25:37.178690Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2304.05197","last_updated":"2023-11-01T05:14:01Z","snapshot_observed_at":"2026-08-13T12:05:01.318814Z","submitted_at":"2023-04-11T13:05:04Z","title":"Multi-step Jailbreaking Privacy Attacks on ChatGPT","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.05197","snapshot_observed_at":"2026-08-15T16:25:35.570589Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.570589Z"},"links":{"cited_paper":"/paper/2304.05197","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:a4195627973b53d4ebe15a41503834eee3751d6ba4bd3b05a6cb02218515ce54","observation_id":"926a9815-7dac-4d80-a119-e24de3292678","resolution":{"observed_at":"2026-08-15T16:25:35.570589Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.03218","last_updated":"2024-05-15T19:16:09Z","snapshot_observed_at":"2026-08-15T06:18:34.739211Z","submitted_at":"2024-03-05T18:59:35Z","title":"The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning","version":7},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.03218","snapshot_observed_at":"2026-08-15T16:25:35.574328Z","title":"D.; and Dombrowski, A.-K","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.574328Z"},"links":{"cited_paper":"/paper/2403.03218","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:00f1a334c5b1b689f60325ceb5c4d2bdad6692f3ccd98be5138a9ca18e7656cd","observation_id":"c75d8f18-27c6-478c-aa7e-ace93bf76c7e","resolution":{"observed_at":"2026-08-15T16:25:35.574328Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.20228","last_updated":"2025-03-26T04:46:31Z","snapshot_observed_at":"2026-08-10T00:27:32.257835Z","submitted_at":"2025-03-26T04:46:31Z","title":"TeleLoRA: Teleporting Model-Specific Alignment Across LLMs","version":1},"cited_work":{"arxiv_id":"2503.20228","doi":null,"metadata_source":"pith","pith_arxiv_id":"2503.20228","snapshot_observed_at":"2026-08-15T16:25:36.523427Z","title":"TeleLoRA: Teleporting Model-Specific Alignment Across LLMs","venue":"cs.LG","work_id":"be9f2cf2-272d-4498-8505-4aa0835d5af0","year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.582429Z"},"links":{"cited_paper":"/paper/2503.20228","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:ca5305d91533a7cbb44e94de9d2d982e0adcdb72d4fa2ff30d7562eeef363aff","observation_id":"b91a5ea8-9ede-4d8a-87b6-4166cec6f27f","resolution":{"observed_at":"2026-08-15T16:25:36.529377Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2504.01444","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:36.503105Z","title":null,"venue":null,"work_id":"9d477498-117c-47e5-a575-6ef6ba261079","year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.586017Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d387a6763b7b33b4c701a73e5c8fc6d529a599c9c9c6f57b09a8603f36f832d6","observation_id":"2d16c294-5216-4998-9779-f7dbae85971a","resolution":{"observed_at":"2026-08-15T16:25:36.509939Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.03191","last_updated":"2024-11-28T13:43:50Z","snapshot_observed_at":"2026-08-15T16:37:22.396444Z","submitted_at":"2023-11-06T15:29:30Z","title":"DeepInception: Hypnotize Large Language Model to Be Jailbreaker","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.03191","snapshot_observed_at":"2026-08-15T16:25:35.589876Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.589876Z"},"links":{"cited_paper":"/paper/2311.03191","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:e9319d85bb546f0cb56e9b8793cd71f6dd87d8f88296c9acfb7e244cf671ef89","observation_id":"0e368ff1-ba39-4568-88d8-30414caf00aa","resolution":{"observed_at":"2026-08-15T16:25:35.589876Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.12975","last_updated":"2024-08-21T11:57:05Z","snapshot_observed_at":"2026-08-12T23:39:49.389388Z","submitted_at":"2024-06-18T18:00:03Z","title":"SHIELD: Evaluation and Defense Strategies for Copyright Compliance in LLM Text Generation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.12975","snapshot_observed_at":"2026-08-15T16:25:35.597800Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.597800Z"},"links":{"cited_paper":"/paper/2406.12975","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:7af8c43b0bc1fe0d7a65696c985051e64dedc707fcd8e852418150afac3a7297","observation_id":"c47c0b94-a64a-4edc-8d32-104d6ebbdb54","resolution":{"observed_at":"2026-08-15T16:25:35.597800Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-06T02:57:30.438059Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-15T16:25:35.601622Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.601622Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:761b41024c0de97139493a238f6171f33fdba38a3ef687e44b40cc4f6f4ed405","observation_id":"ca700848-885d-4c03-8a6f-32e5254d0726","resolution":{"observed_at":"2026-08-15T16:25:35.601622Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.04249","last_updated":"2024-02-27T04:43:08Z","snapshot_observed_at":"2026-07-06T17:26:23.067923Z","submitted_at":"2024-02-06T18:59:08Z","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.04249","snapshot_observed_at":"2026-08-15T16:25:35.612838Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.612838Z"},"links":{"cited_paper":"/paper/2402.04249","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:1494b3c6e7fbbf08084a88321348cfa4727a16eb7d3b23f48949e2a9d78435e9","observation_id":"98430e03-cf23-443b-9007-c53b22089ba1","resolution":{"observed_at":"2026-08-15T16:25:35.612838Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.616456Z","title":"R.; and Papernot, N","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.616456Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:deefd1989f2db7c9b73415aa88bb1cd7ab77c6095c814fe025355ef9f90ef6fe","observation_id":"ca845d39-ef48-4bbc-9588-f5a40d6a5c14","resolution":{"observed_at":"2026-08-15T16:25:35.616456Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.02138","last_updated":"2026-04-15T01:27:38Z","snapshot_observed_at":"2026-08-15T12:46:13.472024Z","submitted_at":"2024-04-02T17:49:40Z","title":"Topic-Based Watermarks for Large Language Models","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02138","snapshot_observed_at":"2026-08-15T16:25:35.620427Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.620427Z"},"links":{"cited_paper":"/paper/2404.02138","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:cfd33ff99ac3428aa5d2afaba0bf7469cdf0d394e88dbb3fa5719b5c71438da9","observation_id":"833a1260-eedb-4242-bd8a-bccd6a290aab","resolution":{"observed_at":"2026-08-15T16:25:35.620427Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.157777Z","title":"J.; Hassani, H.; Robey, A.; and Wong, E","venue":null,"work_id":"7c1804fc-fbfc-4dd2-9ce1-2324e56978d9","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.625006Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:96770602f087b1edffb732f0236016d67c399d6060bc36ebb20eaa88fd6ea537","observation_id":"eb29432f-9822-466a-b1fa-8fa53f9fb69f","resolution":{"observed_at":"2026-08-15T16:25:37.165178Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.07579","last_updated":"2024-06-06T06:31:08Z","snapshot_observed_at":"2026-08-14T11:32:33.344853Z","submitted_at":"2023-10-11T15:19:31Z","title":"In-Context Unlearning: Language Models as Few Shot Unlearners","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.07579","snapshot_observed_at":"2026-08-15T16:25:35.629057Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.629057Z"},"links":{"cited_paper":"/paper/2310.07579","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:cb5ffb675539669c3300814f77e2f14b4fbec618a1206c457528d4f290b09248","observation_id":"0edacc3f-f76f-4b44-b7a7-038ce3b123f5","resolution":{"observed_at":"2026-08-15T16:25:35.629057Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.143701Z","title":null,"venue":null,"work_id":"d9b2ab0f-df21-40f9-b0c3-e77a3e3e1af9","year":2022},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":60,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.633450Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:840e854f0ee5913c3dc3aea2247e7d4ec53f6101b0ff16559741d5bb32463bbd","observation_id":"c3ff32b1-5882-4710-a2ed-0495bdeabd70","resolution":{"observed_at":"2026-08-15T16:25:37.148810Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-08-15T07:52:32.620818Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-15T16:25:35.637678Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":61,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.637678Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:e0a2b5c5d92e3339262fc98064ba7e487dfcb1d896cac8d80df3ce6d6cb366fa","observation_id":"ddceaa23-7b54-4660-a7df-0af32dfa13e8","resolution":{"observed_at":"2026-08-15T16:25:35.637678Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.18290","last_updated":"2024-07-29T22:26:36Z","snapshot_observed_at":"2026-08-01T16:34:38.795326Z","submitted_at":"2023-05-29T17:57:46Z","title":"Direct Preference Optimization: Your Language Model is Secretly a Reward Model","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.18290","snapshot_observed_at":"2026-08-15T16:25:35.641624Z","title":"D.; and Finn, C","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":62,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.641624Z"},"links":{"cited_paper":"/paper/2305.18290","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d8ab2d0f5a6605c163f234454ca977cf23f85e0ef74bf8dc682bae4a1cb0311a","observation_id":"53b212db-a8ec-46fa-84a7-f7fea271f2ea","resolution":{"observed_at":"2026-08-15T16:25:35.641624Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.129959Z","title":null,"venue":null,"work_id":"b1a2ce07-340c-48a9-b29d-0347a95aa8a3","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":63,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.645915Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:d43c513964a2c244cd1619b2478c8bf771415933cd1caeaf1f665209bdb89937","observation_id":"3ce97506-2eff-4deb-b347-a0fcd6367b25","resolution":{"observed_at":"2026-08-15T16:25:37.134159Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.01263","last_updated":"2024-04-01T11:50:35Z","snapshot_observed_at":"2026-08-14T04:19:38.572552Z","submitted_at":"2023-08-02T16:30:40Z","title":"XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.01263","snapshot_observed_at":"2026-08-15T16:25:35.649342Z","title":"R.; Vidgen, B.; Attanasio, G.; Bianchi, F.; and Hovy, D","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":64,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.649342Z"},"links":{"cited_paper":"/paper/2308.01263","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:dc5861900c73284da30194343376858cc9507bb166fba727d2de55200549a5c4","observation_id":"e76398f4-5be7-4001-bc36-72747e6bb4ad","resolution":{"observed_at":"2026-08-15T16:25:35.649342Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.118388Z","title":null,"venue":null,"work_id":"bbe86ab0-7878-4de1-9a12-3ed37fc4fbf7","year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.653241Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:9a1d9f0aaac5246eea00e67c4cb39271e31f55eb5d2c657014a3e8b26e5aadc5","observation_id":"0cf543b4-961c-4339-a167-43334dd940df","resolution":{"observed_at":"2026-08-15T16:25:37.122424Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2210.01240","last_updated":"2023-03-02T03:54:28Z","snapshot_observed_at":"2026-08-13T14:13:47.667807Z","submitted_at":"2022-10-03T21:34:32Z","title":"Language Models Are Greedy Reasoners: A Systematic Formal Analysis of Chain-of-Thought","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2210.01240","snapshot_observed_at":"2026-08-15T16:25:35.657150Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":66,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.657150Z"},"links":{"cited_paper":"/paper/2210.01240","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:c9425aa9b245aa41f41a5ddf9bbdbbfed1a46e37f405719bb996bd7dd33e1fe1","observation_id":"529d0413-b7ce-4b21-969d-7682e60c144b","resolution":{"observed_at":"2026-08-15T16:25:35.657150Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.03348","last_updated":"2023-11-24T12:50:31Z","snapshot_observed_at":"2026-08-14T06:06:00.145476Z","submitted_at":"2023-11-06T18:55:18Z","title":"Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.03348","snapshot_observed_at":"2026-08-15T16:25:35.661660Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.661660Z"},"links":{"cited_paper":"/paper/2311.03348","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:3b99e0288e768018db76a4c1d277d99a45d404afe8ae34491253dfa0d0fd40b3","observation_id":"0054103c-e053-4a9b-87c5-b95df03abe64","resolution":{"observed_at":"2026-08-15T16:25:35.661660Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.105377Z","title":null,"venue":null,"work_id":"6247b603-4c3c-411f-8d77-3025191cc339","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":68,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.666208Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:3141b79f755e35aa5854b8c1b801a3f501e607196cb24231c9aece76163f25f3","observation_id":"399fe1e5-aac0-4f27-a586-77d9448e3b04","resolution":{"observed_at":"2026-08-15T16:25:37.110048Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.10844","last_updated":"2023-10-16T21:37:24Z","snapshot_observed_at":"2026-08-15T06:11:28.424821Z","submitted_at":"2023-10-16T21:37:24Z","title":"Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.10844","snapshot_observed_at":"2026-08-15T16:25:35.669919Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.669919Z"},"links":{"cited_paper":"/paper/2310.10844","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:b38c9c2ef9969a7e9793358d2f04869465fef53295d4a81f5bb3b9d1d1522f84","observation_id":"36314a39-cde8-4e78-9130-60869cbd74c4","resolution":{"observed_at":"2026-08-15T16:25:35.669919Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.093900Z","title":"Do Anything Now","venue":null,"work_id":"29c6f1f1-1c81-45c9-bd3d-088222e7d112","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":70,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.673744Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:dae462ae0e68bd4f99f7fa3b9147ca5b57fa599a8e909dcd33e069efbe1b8cf4","observation_id":"9ac3813f-9ba9-4c50-a3b5-403f03f45be1","resolution":{"observed_at":"2026-08-15T16:25:37.097746Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.03825","last_updated":"2024-05-15T12:06:31Z","snapshot_observed_at":"2026-08-15T09:51:02.522141Z","submitted_at":"2023-08-07T16:55:20Z","title":"\"Do Anything Now\": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.03825","snapshot_observed_at":"2026-08-15T16:25:35.677147Z","title":"Do Anything Now","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":71,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.677147Z"},"links":{"cited_paper":"/paper/2308.03825","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:69ea852e2b2d3320a35d6ca1bea37a104a225a79bd36f1f1eeba83f158cb5d64","observation_id":"d1af0da0-2d5e-4a04-80e3-98009e17e73c","resolution":{"observed_at":"2026-08-15T16:25:35.677147Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.09292","last_updated":"2024-07-17T16:23:28Z","snapshot_observed_at":"2026-08-12T23:23:24.848912Z","submitted_at":"2024-07-12T14:26:14Z","title":"Counterfactual Explainable Incremental Prompt Attack Analysis on Large Language Models","version":2},"cited_work":{"arxiv_id":"2407.09292","doi":null,"metadata_source":"pith","pith_arxiv_id":"2407.09292","snapshot_observed_at":"2026-08-15T16:25:36.155292Z","title":"Counterfactual Explainable Incremental Prompt Attack Analysis on Large Language Models","venue":"cs.CR","work_id":"42115274-22d0-4dac-b6d8-cf18d2cb126d","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":72,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.681487Z"},"links":{"cited_paper":"/paper/2407.09292","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:f1bfe9ab600af267dcdd56b89461511916f39db92fe4a4c268b32fbeffdb56e1","observation_id":"0df81bd0-f189-401c-b4da-e05e884a8bfa","resolution":{"observed_at":"2026-08-15T16:25:36.160505Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.10260","last_updated":"2024-08-27T03:32:47Z","snapshot_observed_at":"2026-08-04T21:32:35.483431Z","submitted_at":"2024-02-15T18:58:09Z","title":"A StrongREJECT for Empty Jailbreaks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.10260","snapshot_observed_at":"2026-08-15T16:25:35.685837Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":73,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.685837Z"},"links":{"cited_paper":"/paper/2402.10260","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:2e5b5f4bc38b358e12c0355dc1b4466c9dc926113a287bd8ee907246bf86978f","observation_id":"6d520293-7269-4cab-88c1-5d92ee86b72c","resolution":{"observed_at":"2026-08-15T16:25:35.685837Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.00761","last_updated":"2025-02-10T18:26:14Z","snapshot_observed_at":"2026-08-12T23:10:02.039675Z","submitted_at":"2024-08-01T17:59:12Z","title":"Tamper-Resistant Safeguards for Open-Weight LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.00761","snapshot_observed_at":"2026-08-15T16:25:35.689623Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":74,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.689623Z"},"links":{"cited_paper":"/paper/2408.00761","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:7f7b97927a5f1c4baad3aeef3bc11b9bcddf4882bff1f556030a291ca485ec96","observation_id":"b5dffa9a-35b4-4ccc-af4a-d3635da1ee57","resolution":{"observed_at":"2026-08-15T16:25:35.689623Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.19786","last_updated":"2025-03-25T15:52:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-03-25T15:52:34Z","title":"Gemma 3 Technical Report","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.19786","snapshot_observed_at":"2026-08-15T16:25:35.694213Z","title":"M.; Goedeckemeyer, A.; Saade, A.; Feng, A.; Kolesnikov, A.; Bendebury, A.; Abdagic, A.; Vadi, A.; György, A.; Pinto, A","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":75,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.694213Z"},"links":{"cited_paper":"/paper/2503.19786","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:62ae51c39885920aae764d6f74bcf10e084862a15efe295df26abd97b05dea6d","observation_id":"8e6337e5-00e5-4a69-9bae-f25b6ef9dfa9","resolution":{"observed_at":"2026-08-15T16:25:35.694213Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:35.698672Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":76,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.698672Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:9b3c60ce8cc7b75b9b3d59e76b1f5afca83fabd4b471b5b568acd5deb6cc13d3","observation_id":"9af2336c-692a-4b0d-a3fa-f783b16507e6","resolution":{"observed_at":"2026-08-15T16:25:35.698672Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.21598","last_updated":"2025-03-27T15:19:55Z","snapshot_observed_at":"2026-08-07T16:32:33.505759Z","submitted_at":"2025-03-27T15:19:55Z","title":"Prompt, Divide, and Conquer: Bypassing Large Language Model Safety Filters via Segmented and Distributed Prompt Processing","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.21598","snapshot_observed_at":"2026-08-15T16:25:35.702135Z","title":"M.; and Papadimitratos, P","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":77,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.702135Z"},"links":{"cited_paper":"/paper/2503.21598","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:13716da2ce188205056b49456fd9c10f269f8a31a3a537d6ab9cf25ee0f931bf","observation_id":"5655b3f3-d956-4b39-99a4-a1fa20e609ec","resolution":{"observed_at":"2026-08-15T16:25:35.702135Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.13387","last_updated":"2023-09-04T01:47:30Z","snapshot_observed_at":"2026-08-13T10:27:40.164741Z","submitted_at":"2023-08-25T14:02:12Z","title":"Do-Not-Answer: A Dataset for Evaluating Safeguards in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.13387","snapshot_observed_at":"2026-08-15T16:25:35.706234Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":78,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.706234Z"},"links":{"cited_paper":"/paper/2308.13387","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:6d5d5a53eea0361571bc6aad5e7e76d75c0f40c1d62bd6c42510e2e5b2d212c6","observation_id":"874015b7-cb02-40d5-924a-cdcdf96b9abf","resolution":{"observed_at":"2026-08-15T16:25:35.706234Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.02483","last_updated":"2023-07-05T17:58:10Z","snapshot_observed_at":"2026-08-15T10:16:52.688429Z","submitted_at":"2023-07-05T17:58:10Z","title":"Jailbroken: How Does LLM Safety Training Fail?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.02483","snapshot_observed_at":"2026-08-15T16:25:35.713916Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":80,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.713916Z"},"links":{"cited_paper":"/paper/2307.02483","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:4edd69709462426df70ac0260abe8aa11c6f6e5e761fcd7f12dcd816348281ed","observation_id":"51df8078-f20f-4b92-8d42-72156df20f57","resolution":{"observed_at":"2026-08-15T16:25:35.713916Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.15641","last_updated":"2024-10-21T05:01:50Z","snapshot_observed_at":"2026-08-12T22:18:58.790631Z","submitted_at":"2024-10-21T05:01:50Z","title":"SMILES-Prompting: A Novel Approach to LLM Jailbreak Attacks in Chemical Synthesis","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.15641","snapshot_observed_at":"2026-08-15T16:25:35.717645Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":81,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.717645Z"},"links":{"cited_paper":"/paper/2410.15641","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:4682ccb43f46240c93a079b7e75ec2f512a6ba67720860ff7cedee06f24dafd6","observation_id":"54f0fe5f-a4cd-4e81-974e-d7c8efcbbd7b","resolution":{"observed_at":"2026-08-15T16:25:35.717645Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.081142Z","title":null,"venue":null,"work_id":"105eb211-1821-4855-9563-27a65b9046ea","year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":82,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.721358Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:c93ce2284316e290443f40b6914e82d5cf83622316028f5d022831dc82c4e32d","observation_id":"e8441d64-02c5-48ec-880f-9169d9c2e1e5","resolution":{"observed_at":"2026-08-15T16:25:37.085522Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.064287Z","title":null,"venue":null,"work_id":"3b50257b-db7a-4b15-b83b-37c06aa4b51a","year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":83,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.724987Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:b2061bd6fb05621b3ce9d6b6be23223ef3d875db6bc854c71bba6da5ca2836e8","observation_id":"b33b4b48-4e00-4557-b1d1-80b2dd061767","resolution":{"observed_at":"2026-08-15T16:25:37.069441Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.16667","last_updated":"2024-07-23T17:34:36Z","snapshot_observed_at":"2026-08-14T01:14:19.712060Z","submitted_at":"2024-07-23T17:34:36Z","title":"RedAgent: Red Teaming Large Language Models with Context-aware Autonomous Language Agent","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.16667","snapshot_observed_at":"2026-08-15T16:25:35.728642Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":84,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.728642Z"},"links":{"cited_paper":"/paper/2407.16667","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:185601522d6db236cdaa1b4696b4bc665b8eec92cfee56325029294a1999d0de","observation_id":"7744cce7-13fd-4e4c-a439-05382bd6f77b","resolution":{"observed_at":"2026-08-15T16:25:35.728642Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.049030Z","title":null,"venue":null,"work_id":"6fece501-45d1-48b2-b514-4fd1adc19ea9","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":85,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.732524Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:57f4a44b8e88fcdc1f44973e7a18a21494ad84a46065ebe29dedd129eec2da3b","observation_id":"6600dd76-3429-4677-9637-7463b1b07cf3","resolution":{"observed_at":"2026-08-15T16:25:37.053075Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.09388","last_updated":"2025-05-14T13:41:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-05-14T13:41:34Z","title":"Qwen3 Technical Report","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.09388","snapshot_observed_at":"2026-08-15T16:25:35.736230Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":86,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.736230Z"},"links":{"cited_paper":"/paper/2505.09388","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:055951addb3bc9fa419943ea01b3d1e930fba22e779fd00f9865cdc3aaae6a5b","observation_id":"602c5ab8-683e-42e2-b488-b0ba8192c37d","resolution":{"observed_at":"2026-08-15T16:25:35.736230Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.11459","last_updated":"2024-10-15T10:07:15Z","snapshot_observed_at":"2026-08-14T20:25:42.869208Z","submitted_at":"2024-10-15T10:07:15Z","title":"Jigsaw Puzzles: Splitting Harmful Questions to Jailbreak Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.11459","snapshot_observed_at":"2026-08-15T16:25:35.740179Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":87,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.740179Z"},"links":{"cited_paper":"/paper/2410.11459","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:6001e811c729704b7a61adc81578730782f7d3d645375e2a824597d43f9baad0","observation_id":"6737df63-0dd1-4039-b648-154aac2f6535","resolution":{"observed_at":"2026-08-15T16:25:35.740179Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.11407","last_updated":"2024-11-18T09:28:58Z","snapshot_observed_at":"2026-08-15T04:36:37.002692Z","submitted_at":"2024-11-18T09:28:58Z","title":"The Dark Side of Trust: Authority Citation-Driven Jailbreak Attacks on Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.11407","snapshot_observed_at":"2026-08-15T16:25:35.744416Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":88,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.744416Z"},"links":{"cited_paper":"/paper/2411.11407","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:da6c2afadb82cd521f67e896df785a69362b28727748fcad8836b4aed348b96f","observation_id":"7bd9f140-c927-4bba-9625-210afbdebf6d","resolution":{"observed_at":"2026-08-15T16:25:35.744416Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.02446","last_updated":"2024-01-27T22:54:52Z","snapshot_observed_at":"2026-08-13T01:25:06.346704Z","submitted_at":"2023-10-03T21:30:56Z","title":"Low-Resource Languages Jailbreak GPT-4","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.02446","snapshot_observed_at":"2026-08-15T16:25:35.748405Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":89,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.748405Z"},"links":{"cited_paper":"/paper/2310.02446","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:a345981578c54392c2869dd30860ef3b9a2b463d92d605cb4f1de840559b95ba","observation_id":"a969486c-572c-44f7-aaab-60fbad43883b","resolution":{"observed_at":"2026-08-15T16:25:35.748405Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.02958","last_updated":"2025-06-17T07:41:08Z","snapshot_observed_at":"2026-08-15T11:19:57.679635Z","submitted_at":"2025-02-05T07:51:32Z","title":"Position: Editing Large Language Models Poses Serious Safety Risks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.02958","snapshot_observed_at":"2026-08-15T16:25:35.752237Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":90,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.752237Z"},"links":{"cited_paper":"/paper/2502.02958","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:2569daa49613254e55526c6647f0afe6139982632f29d1ac688254a12cb70430","observation_id":"6b76a273-6f9b-4777-8418-4253fb003343","resolution":{"observed_at":"2026-08-15T16:25:35.752237Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.17336","last_updated":"2024-09-30T21:25:23Z","snapshot_observed_at":"2026-08-15T18:00:34.759543Z","submitted_at":"2024-03-26T02:47:42Z","title":"Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.17336","snapshot_observed_at":"2026-08-15T16:25:35.760832Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":92,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.760832Z"},"links":{"cited_paper":"/paper/2403.17336","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:39f1f178dfebeca327f9b9a19f208be6a4a428299e4f2e922fdb6bfeb3ea7548","observation_id":"c7c025be-ad8a-434b-ab31-d3acc0e091cb","resolution":{"observed_at":"2026-08-15T16:25:35.760832Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1905.07830","last_updated":"2019-05-19T23:57:23Z","snapshot_observed_at":"2026-08-15T09:37:44.321271Z","submitted_at":"2019-05-19T23:57:23Z","title":"HellaSwag: Can a Machine Really Finish Your Sentence?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1905.07830","snapshot_observed_at":"2026-08-15T16:25:35.765564Z","title":null,"venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":93,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.765564Z"},"links":{"cited_paper":"/paper/1905.07830","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:b728599286b18e2a5b5adf71f000663bd502dd7b58ea7a4ab0ec58dbf8b3a06d","observation_id":"2d1cdad1-23db-49bf-973b-2304ef7d8878","resolution":{"observed_at":"2026-08-15T16:25:35.765564Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.06373","last_updated":"2024-01-23T22:46:12Z","snapshot_observed_at":"2026-08-14T23:44:20.639875Z","submitted_at":"2024-01-12T16:13:24Z","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.06373","snapshot_observed_at":"2026-08-15T16:25:35.773425Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":95,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.773425Z"},"links":{"cited_paper":"/paper/2401.06373","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:7aeea87b098dc8c57832c6ab390120d064fa0455e413876d516e9059f07bf0ea","observation_id":"f7125f4b-9524-4f2f-bb51-c7472aa3e70c","resolution":{"observed_at":"2026-08-15T16:25:35.773425Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.07395","last_updated":"2024-10-09T19:46:30Z","snapshot_observed_at":"2026-08-12T22:26:52.757022Z","submitted_at":"2024-10-09T19:46:30Z","title":"LLM Embeddings Improve Test-time Adaptation to Tabular $Y|X$-Shifts","version":1},"cited_work":{"arxiv_id":"2410.07395","doi":null,"metadata_source":"pith","pith_arxiv_id":"2410.07395","snapshot_observed_at":"2026-08-15T16:25:35.862352Z","title":"LLM Embeddings Improve Test-time Adaptation to Tabular $Y|X$-Shifts","venue":"cs.LG","work_id":"5f4ed496-f7a6-41b6-8b7f-9245f9026219","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":96,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.777182Z"},"links":{"cited_paper":"/paper/2410.07395","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:41c5bc84491c5db12b98014f1237bb70ff54b21fc3bbb96ad350465e3e6e235a","observation_id":"51ede104-63ed-4a65-95df-a7068fb2edba","resolution":{"observed_at":"2026-08-15T16:25:35.868451Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T16:25:37.034110Z","title":null,"venue":null,"work_id":"0bd32fd0-acf6-4ffa-97f9-22e2ac1b6190","year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":97,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.781938Z"},"links":{"citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:c9e726e2af7d53db4431b9925ac93c02402d072a15f33d4b7a60b2422ea8d1bc","observation_id":"7e84904e-ce8f-4cf2-b123-5d300a9c3e9d","resolution":{"observed_at":"2026-08-15T16:25:37.038890Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.18104","last_updated":"2024-06-10T11:20:43Z","snapshot_observed_at":"2026-08-13T04:08:31.134661Z","submitted_at":"2024-02-28T06:50:14Z","title":"Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.18104","snapshot_observed_at":"2026-08-15T16:25:35.786739Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":98,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.786739Z"},"links":{"cited_paper":"/paper/2402.18104","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:352968f8b25f7498d6ec86787573ec3e970d16bfe28164b6d1594b47049a2d6e","observation_id":"7d03a866-8998-4115-942f-ca7cbea3c008","resolution":{"observed_at":"2026-08-15T16:25:35.786739Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.11206","last_updated":"2023-05-18T17:45:22Z","snapshot_observed_at":"2026-08-08T19:18:06.171048Z","submitted_at":"2023-05-18T17:45:22Z","title":"LIMA: Less Is More for Alignment","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.11206","snapshot_observed_at":"2026-08-15T16:25:35.790232Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":99,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.790232Z"},"links":{"cited_paper":"/paper/2305.11206","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:530c77c2d06ed3e1caf8324feb528ccbcaad27a640a15828af76dc90d0f2bbfb","observation_id":"2511efdb-5ff7-41fc-acc9-8bd3f5727caf","resolution":{"observed_at":"2026-08-15T16:25:35.790232Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.07827","last_updated":"2024-02-12T17:34:13Z","snapshot_observed_at":"2026-08-15T16:46:04.358915Z","submitted_at":"2024-02-12T17:34:13Z","title":"Aya Model: An Instruction Finetuned Open-Access Multilingual Language Model","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.07827","snapshot_observed_at":"2026-08-15T16:25:35.794271Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","version":1},"reference_index":100,"source":"arxiv_source","source_observed_at":"2026-08-15T16:25:35.794271Z"},"links":{"cited_paper":"/paper/2402.07827","citing_paper":"/paper/2509.08000"},"observation_digest":"sha256:0b59c05c0ee7f7054b41b0946a4d83744aa3b38d10f6055ae0355ca08348bcf9","observation_id":"82f303b1-65e0-4869-8233-fc05e3500b2e","resolution":{"observed_at":"2026-08-15T16:25:35.794271Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2509.08000","last_updated":"2025-09-06T16:03:07Z","latest_version":1,"primary_category":"cs.CL","snapshot_observed_at":"2026-08-15T18:20:27.874208Z","submitted_at":"2025-09-06T16:03:07Z","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs"},"reference_resolution":{"displayed":91,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":85,"verified_exact":4,"verified_fuzzy":2},"total_outbound_references":91},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"thesis":"As of 16 August 2026, this Paper Citation Record lists 91 of 91 outbound references and 1 inbound Pith citation observation for arXiv:2509.08000."}