{"as_of":"2026-08-15T14:17:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:2db88ed470b6039055b66ea8eb4265d17ac526baa803465b3c925ac6346d8157","coverage":[{"denominator":255,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":100,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-04T09:25:45.961893Z","state":"measured"},{"denominator":103,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":103,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-15T06:32:42.880941+00:00","state":"measured"},{"denominator":3,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":3,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T00:32:02.668360Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-07-04T20:00:07.826531Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"cited_work":{"arxiv_id":"2510.15476","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2510.15476","snapshot_observed_at":"2026-07-07T03:17:13.442555Z","title":"SoK: Taxonomy and Evaluation of Prompt Security in Large Language Models.arXiv preprint arXiv:2510.15476, 2025","venue":null,"work_id":"a2d86ead-24b4-4a3d-a4ff-7ad7b09a8ed8","year":2025},"citing_paper":{"arxiv_id":"2606.15549","last_updated":"2026-06-20T22:26:27Z","snapshot_observed_at":"2026-08-13T04:48:32.644022Z","submitted_at":"2026-06-14T02:30:09Z","title":"One Goal, Many Commands: Characterizing Denylist Fragility in AI Agents","version":2},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-06-27T04:42:45.420398Z"},"links":{"cited_paper":"/paper/2510.15476","citing_paper":"/paper/2606.15549"},"observation_digest":"sha256:165891a29682e2b28f338b42b4914694ef02d6b2ec76a837d7d95d2fd9b3cabd","observation_id":"c6354cbb-4b4a-47b8-b2c4-482deab1990e","resolution":{"observed_at":"2026-07-07T03:17:13.442555Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"cited_work":{"arxiv_id":"2510.15476","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2510.15476","snapshot_observed_at":"2026-07-07T03:17:13.442555Z","title":"SoK: Taxonomy and Evaluation of Prompt Security in Large Language Models.arXiv preprint arXiv:2510.15476, 2025","venue":null,"work_id":"a2d86ead-24b4-4a3d-a4ff-7ad7b09a8ed8","year":2025},"citing_paper":{"arxiv_id":"2606.25533","last_updated":"2026-06-24T08:08:10Z","snapshot_observed_at":"2026-08-14T06:14:06.391954Z","submitted_at":"2026-06-24T08:08:10Z","title":"Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-06-25T20:56:20.603088Z"},"links":{"cited_paper":"/paper/2510.15476","citing_paper":"/paper/2606.25533"},"observation_digest":"sha256:cf443ffdbbe9383738bc9e3a89606637ad54fa83694792c045b62f853f5ae884","observation_id":"dcc69231-6c3f-4338-9e8e-94f2e02cdc18","resolution":{"observed_at":"2026-07-07T03:17:13.442555Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-15T06:32:42.880941+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2510.15476","snapshot_observed_at":"2026-08-06T00:32:02.668360Z","title":"Sok: Taxonomy and evalua- tion of prompt security in large language models,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:02.668360Z"},"links":{"cited_paper":"/paper/2510.15476","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:ef4017bf8c1c0960440e6f6d832306b355925daff907dcb79057492322340323","observation_id":"f9cbcb8c-5570-4e46-a76b-b0d6fa736dd8","resolution":{"observed_at":"2026-08-06T00:32:02.668360Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2510.15476/citation-record","integrity":"/paper/2510.15476/integrity","json":"/paper/2510.15476/citation-record.json","paper":"/paper/2510.15476"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:35.805221Z","title":"glaive-code-assistant, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:35.805221Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:17aa97b5fed463038f7298defd9cdff4b97fa16e965c74dec46dae315b68f268","observation_id":"9b9a8f4d-0a44-4fef-974e-f8169200dfc4","resolution":{"observed_at":"2026-08-04T09:25:35.805221Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.14132","last_updated":"2023-11-07T03:30:15Z","snapshot_observed_at":"2026-07-06T16:10:54.723336Z","submitted_at":"2023-08-27T15:20:06Z","title":"Detecting Language Model Attacks with Perplexity","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.14132","snapshot_observed_at":"2026-08-04T09:25:35.865962Z","title":"Detecting language model attacks with perplexity.CoRR, abs/2308.14132, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:35.865962Z"},"links":{"cited_paper":"/paper/2308.14132","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:a92d0ea76bca378c6434e9633729db941cbc3fc2a121c7542f2a3d7bf6a3b6e3","observation_id":"baf3582e-15f8-4574-8754-8951849bde68","resolution":{"observed_at":"2026-08-04T09:25:35.865962Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.02577","last_updated":"2024-05-28T23:28:28Z","snapshot_observed_at":"2026-08-12T23:55:39.458737Z","submitted_at":"2024-05-28T23:28:28Z","title":"Are PPO-ed Language Models Hackable?","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.02577","snapshot_observed_at":"2026-08-04T09:25:35.928949Z","title":"Are ppo-ed language models hackable?CoRR, abs/2406.02577, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:35.928949Z"},"links":{"cited_paper":"/paper/2406.02577","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:b0e9a925ac70d05129b02a198652f8975262da295127304b9e03ab668690fce2","observation_id":"8b077a8a-59d7-4555-b6f9-9457827ace9d","resolution":{"observed_at":"2026-08-04T09:25:35.928949Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.02151","last_updated":"2025-04-17T18:55:45Z","snapshot_observed_at":"2026-08-13T00:39:04.444350Z","submitted_at":"2024-04-02T17:58:27Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02151","snapshot_observed_at":"2026-08-04T09:25:35.977601Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks.CoRR, abs/2404.02151, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:35.977601Z"},"links":{"cited_paper":"/paper/2404.02151","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:041713095b0f2283834e967acced879d300e127447d33114a7065b58e0c5be97","observation_id":"a359a567-a5ea-48b8-bab4-853163c268df","resolution":{"observed_at":"2026-08-04T09:25:35.977601Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:36.047680Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:36.047680Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:8bd25972527f60dda2706e41ab2ed46085853cd6704947afc7bb39aa930048fc","observation_id":"ed84495c-ce25-4a75-8c76-f0d6ba08505b","resolution":{"observed_at":"2026-08-04T09:25:36.047680Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.11969","last_updated":"2025-04-17T18:36:08Z","snapshot_observed_at":"2026-08-15T02:07:13.007558Z","submitted_at":"2024-07-16T17:59:55Z","title":"Does Refusal Training in LLMs Generalize to the Past Tense?","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.11969","snapshot_observed_at":"2026-08-04T09:25:36.084546Z","title":"Does refusal training in llms generalize to the past tense?CoRR, abs/2407.11969, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:36.084546Z"},"links":{"cited_paper":"/paper/2407.11969","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:32424a9d7e56e02f2a73c56b9e202189e3e1a21b3f7f71a544308a2d0613251c","observation_id":"0fea0ec6-61d4-4d00-aa42-eef9b3cf69bf","resolution":{"observed_at":"2026-08-04T09:25:36.084546Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:36.213690Z","title":"Does refusal training in llms generalize to the past tense? InThe Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:36.213690Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:86fb30e55c32992c6aaae80a7c38acc2d5f8eff728cd6862776654826f5d7872","observation_id":"ec056e70-a0bf-40d1-87a5-ffe022dfc284","resolution":{"observed_at":"2026-08-04T09:25:36.213690Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:36.303948Z","title":"Bowman, Ethan Perez, Roger B","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:36.303948Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:02a947d0081bc93a3d27612e5bb22b7ed9d23ed6aed8280614317147229785aa","observation_id":"5a7de3c8-ddd0-42b6-9c48-785eba686cbe","resolution":{"observed_at":"2026-08-04T09:25:36.303948Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.11805","last_updated":"2025-05-09T21:04:06Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-12-19T02:39:27Z","title":"Gemini: A Family of Highly Capable Multimodal Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.11805","snapshot_observed_at":"2026-08-04T09:25:36.428626Z","title":"Dai, Anja Hauth, Katie Millican, David Silver, Slav Petrov, Melvin Johnson, Ioannis Antonoglou, Julian Schrittwieser, Amelia Glaese, Jilin Chen, Emily Pitler, Timothy P","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:36.428626Z"},"links":{"cited_paper":"/paper/2312.11805","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:dc3121e1fcc5c009d8abe2d031a2db46743e050f6dcd933831f8ad1be285526e","observation_id":"9f92f486-5722-4298-9119-79da1760dfc2","resolution":{"observed_at":"2026-08-04T09:25:36.428626Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:36.525826Z","title":"Surro- gateprompt: Bypassing the safety filter of text-to-image models via substitution","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:36.525826Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:a48097288c385676880b8fb630e78b57780f786b902e356d7baecbb4c7601e4d","observation_id":"d3aba117-b1ff-40dd-921b-6140cac603f1","resolution":{"observed_at":"2026-08-04T09:25:36.525826Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.16609","last_updated":"2023-09-28T17:07:49Z","snapshot_observed_at":"2026-08-09T21:25:20.369782Z","submitted_at":"2023-09-28T17:07:49Z","title":"Qwen Technical Report","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.16609","snapshot_observed_at":"2026-08-04T09:25:36.554045Z","title":"Qwen technical report.CoRR, abs/2309.16609, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:36.554045Z"},"links":{"cited_paper":"/paper/2309.16609","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:abf61da3e5a8ded34155b1b08bc0365f5c8169dde42fe8d622d28a35f54562a2","observation_id":"7739b3f9-3994-46b0-826b-960823cce346","resolution":{"observed_at":"2026-08-04T09:25:36.554045Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-08-04T09:25:36.686698Z","title":"Brown, Jack Clark, Sam McCandlish, Chris Olah, Benjamin Mann, and Jared Kaplan","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:36.686698Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:e2007f23af56a44ed4ae8ac96459d1e4063d29447dd861c8f91cf06f619719ad","observation_id":"b346aeeb-be63-4fe1-9478-41fe118ee20b","resolution":{"observed_at":"2026-08-04T09:25:36.686698Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.15302","last_updated":"2024-11-16T19:21:32Z","snapshot_observed_at":"2026-08-13T04:12:08.056259Z","submitted_at":"2024-02-23T13:03:12Z","title":"How (un)ethical are instruction-centric responses of LLMs? Unveiling the vulnerabilities of safety guardrails to harmful queries","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.15302","snapshot_observed_at":"2026-08-04T09:25:36.791950Z","title":"How (un)ethical are instruction-centric responses of llms? unveiling the vulnerabilities of safety guardrails to harmful queries.CoRR, abs/2402.15302, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:36.791950Z"},"links":{"cited_paper":"/paper/2402.15302","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:d88de531dd4b288f3c2174fe07c4367cc260ffb4e66d67ed9c598a63977c02ff","observation_id":"a633e9ce-f650-46b3-bd21-9df0549dcbef","resolution":{"observed_at":"2026-08-04T09:25:36.791950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.09662","last_updated":"2023-08-30T10:21:00Z","snapshot_observed_at":"2026-08-13T10:32:14.793112Z","submitted_at":"2023-08-18T16:27:04Z","title":"Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignment","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.09662","snapshot_observed_at":"2026-08-04T09:25:36.898264Z","title":"Red-teaming large language models using chain of utterances for safety-alignment","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:36.898264Z"},"links":{"cited_paper":"/paper/2308.09662","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:60b7d8add6aacd674158d33c31bd523f0d5676dc1b4777033c22578e818647c7","observation_id":"e41f6a8a-e9f9-4042-9641-5bcc6b2df7a1","resolution":{"observed_at":"2026-08-04T09:25:36.898264Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.17098","last_updated":"2025-08-31T22:34:34Z","snapshot_observed_at":"2026-08-14T02:32:28.928874Z","submitted_at":"2024-04-26T01:17:06Z","title":"CLARE: Cognitive Load Assessment in REaltime with Multimodal Data","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.17098","snapshot_observed_at":"2026-08-04T09:25:36.977659Z","title":"James Mclellan, Aaron J","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:36.977659Z"},"links":{"cited_paper":"/paper/2404.17098","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:1e78e5c461c73b74e5ba82829a08c1b1544021259a15b2a3d015b207a3fb1ef1","observation_id":"e3018bdf-9640-480a-8863-347328d5ded5","resolution":{"observed_at":"2026-08-04T09:25:36.977659Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:37.119417Z","title":"Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:37.119417Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:b3733c702e0f5601c0e2fad2af22d4e942dde4075a164ca9b9de6aa81d305a4a","observation_id":"e6386057-4902-4bd3-8347-511b75b75692","resolution":{"observed_at":"2026-08-04T09:25:37.119417Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:37.216242Z","title":null,"venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:37.216242Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:1a46abdfa26bee017b8f29c6a5b784b33ff8084333f075ed3b13b789ece89501","observation_id":"9714b2ec-69f2-40db-9f43-a930fd320da8","resolution":{"observed_at":"2026-08-04T09:25:37.216242Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:37.321962Z","title":"Camelai domain expert datasets (physics, math, chemistry & biology), 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:37.321962Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:1e6cafd894f567e77552427836e880091d9cc4ad9d899dc4d8aa11a8f39c9cef","observation_id":"34530978-c609-4bd9-a876-bac5191efeda","resolution":{"observed_at":"2026-08-04T09:25:37.321962Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:37.468338Z","title":"Abu-Ghazaleh, M","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:37.468338Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:036f2b0da2cba901debedcb766583c98268c4d71c54a786952c7aba9f387de4a","observation_id":"0596d4c6-4e43-4580-9e75-31ef44c45463","resolution":{"observed_at":"2026-08-04T09:25:37.468338Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:37.530953Z","title":"Synneure: Intelligent human-machine teamwork in virtual space","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:37.530953Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:33138df5820570beb2585418dec4eb47bd4229ea76f7f2b4f45c15e3b7df945c","observation_id":"049cd096-529f-41f3-a266-a0ea331e1ad1","resolution":{"observed_at":"2026-08-04T09:25:37.530953Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:37.594081Z","title":"Pappas, Florian Tram` er, Hamed Hassani, and Eric Wong","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:37.594081Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:e89cd15b62f87e0d544b281d5b2d682527cf32999d71ca4e842b5b124882c1a2","observation_id":"12a379a3-78ae-46e8-95f9-842f97684580","resolution":{"observed_at":"2026-08-04T09:25:37.594081Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-08-12T12:29:45.113982Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-04T09:25:37.655290Z","title":"Pappas, and Eric Wong","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:37.655290Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:4f34c4cc2b044d1fbd2ddf9678502d5758b4ab1fc6d951e7b8671a810bdf5056","observation_id":"77568c13-4dc4-4203-bf10-059230c62010","resolution":{"observed_at":"2026-08-04T09:25:37.655290Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:37.745718Z","title":"Pappas, and Eric Wong","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:37.745718Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:fb692d76a72c1aa433d65aff8752d6e39b517c1c826e60ce60c5c4654aa19a16","observation_id":"30779e11-7784-4282-91b0-1954946d0ce4","resolution":{"observed_at":"2026-08-04T09:25:37.745718Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-08-14T19:45:16.313175Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-08-04T09:25:37.843859Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:37.843859Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:68b618b7c58c6aeeb8dbe6c46f0c38049ac66ae5520cabcc33115f09c87fafed","observation_id":"32e7f717-16b9-4033-a048-8ed85123dc67","resolution":{"observed_at":"2026-08-04T09:25:37.843859Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:37.955176Z","title":"When LLM meets DRL: advancing jailbreaking efficiency via drl-guided search","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:37.955176Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:e07a8b8d387e95d2e7f40f00be019eb9a19067003a8132afaf2f7b521efe938a","observation_id":"431632c8-01bb-403c-b47c-a9451766b5ef","resolution":{"observed_at":"2026-08-04T09:25:37.955176Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.08725","last_updated":"2024-06-13T01:05:22Z","snapshot_observed_at":"2026-08-15T08:57:08.361160Z","submitted_at":"2024-06-13T01:05:22Z","title":"RL-JACK: Reinforcement Learning-powered Black-box Jailbreaking Attack against LLMs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.08725","snapshot_observed_at":"2026-08-04T09:25:38.012962Z","title":"RL-JACK: reinforcement learning- powered black-box jailbreaking attack against llms.CoRR, abs/2406.08725, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.012962Z"},"links":{"cited_paper":"/paper/2406.08725","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:e26f8c5926f422766316e2238bff1690f0f7ec8411db0f3a1f27aeb9ec8946d7","observation_id":"83850c27-a627-4be6-86ff-bd3abf98e28d","resolution":{"observed_at":"2026-08-04T09:25:38.012962Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09177","last_updated":"2024-10-02T10:43:07Z","snapshot_observed_at":"2026-08-14T15:26:55.851599Z","submitted_at":"2024-02-14T13:45:19Z","title":"Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09177","snapshot_observed_at":"2026-08-04T09:25:38.087372Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.087372Z"},"links":{"cited_paper":"/paper/2402.09177","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:b8cf9ab522d235817099103fe4626efe54209338f32f9dafbfe5c72f3fe63609","observation_id":"50577956-3357-40d7-a052-48ca48250d2a","resolution":{"observed_at":"2026-08-04T09:25:38.087372Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.18981","last_updated":"2024-07-23T15:29:57Z","snapshot_observed_at":"2026-08-14T14:58:39.535213Z","submitted_at":"2024-07-23T15:29:57Z","title":"Prompt Injection Attacks on Large Language Models in Oncology","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.18981","snapshot_observed_at":"2026-08-04T09:25:38.152499Z","title":"Wiest, Carolin V","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.152499Z"},"links":{"cited_paper":"/paper/2407.18981","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:09636cfb87dd45ee91e46db95ee209c8d22533f893daaa2914e0296d4861ecae","observation_id":"3b6fa656-4f8b-4db8-b93a-60076a35138b","resolution":{"observed_at":"2026-08-04T09:25:38.152499Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:38.235834Z","title":"Cogstack, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.235834Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:bd666f78ae05024c14c1b3d6206ab8bbe6cca10a74a052049b8fef879df5b2cb","observation_id":"bedcacc9-ef63-49fd-9418-127f1168ef4c","resolution":{"observed_at":"2026-08-04T09:25:38.235834Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.05061","last_updated":"2024-08-09T13:32:50Z","snapshot_observed_at":"2026-08-12T23:06:00.067385Z","submitted_at":"2024-08-09T13:32:50Z","title":"A Jailbroken GenAI Model Can Cause Substantial Harm: GenAI-powered Applications are Vulnerable to PromptWares","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.05061","snapshot_observed_at":"2026-08-04T09:25:38.278442Z","title":"A jailbroken genai model can cause substantial harm: Genai-powered applications are vulnerable to promptwares.CoRR, abs/2408.05061, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.278442Z"},"links":{"cited_paper":"/paper/2408.05061","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:983cb1e1bfe7dc66ba4646209f95001d8c271b18902bd3743f7cbdfe35c221d8","observation_id":"93f9ec51-6210-42a8-a429-997c188f1592","resolution":{"observed_at":"2026-08-04T09:25:38.278442Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.17699","last_updated":"2024-10-04T07:16:19Z","snapshot_observed_at":"2026-08-12T22:37:04.523735Z","submitted_at":"2024-09-26T10:12:19Z","title":"MoJE: Mixture of Jailbreak Experts, Naive Tabular Classifiers as Guard for Prompt Attacks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.17699","snapshot_observed_at":"2026-08-04T09:25:38.354404Z","title":"Moje: Mixture of jailbreak experts, naive tabular classifiers as guard for prompt attacks.CoRR, abs/2409.17699, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.354404Z"},"links":{"cited_paper":"/paper/2409.17699","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:15b931aa0021dab9d80a1f48f71ebe169c9449ec4a88602d9003ba879d4db5f7","observation_id":"a1a0e7d8-929c-45da-9d63-741195854150","resolution":{"observed_at":"2026-08-04T09:25:38.354404Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:38.438918Z","title":"Moje: Mixture of jailbreak experts, naive tabular classifiers as guard for prompt attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.438918Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:29f9962d1caa05c2dfd34c01ade493fb1d2ca3363aec4117af11cf8e9d49c7a1","observation_id":"c45bcb92-58bf-43b9-a57b-83d2ccbcb919","resolution":{"observed_at":"2026-08-04T09:25:38.438918Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:38.557256Z","title":"alpaca-gpt4-cot, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.557256Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:2a87c555a1ac331572cde4617f5a3f63465ec450dde692f10de595ce780b0ae0","observation_id":"ab74301b-214b-4d37-b953-ee73a08f750b","resolution":{"observed_at":"2026-08-04T09:25:38.557256Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:38.623405Z","title":"Dataset and lessons learned from the 2024 satml LLM capture-the-flag competition","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.623405Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:45bea98f4c2d4ad1dc78a6ada5e7ee385b3506783a14935fddf935c8b986cec6","observation_id":"0f38120c-10fc-4679-954b-6e5b77f129bb","resolution":{"observed_at":"2026-08-04T09:25:38.623405Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-04T09:25:38.687859Z","title":"Agentdojo: A dynamic environment to evaluate attacks and defenses for LLM agents.CoRR, abs/2406.13352, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.687859Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:171f1273833c10ee22634a885773509db8aa63b72ab6fb08e71bbffdfe8d2755","observation_id":"0a0ab53c-274f-4eea-9840-214d7c8b968b","resolution":{"observed_at":"2026-08-04T09:25:38.687859Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:38.782483Z","title":"Attack prompt generation for red teaming and defending large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.782483Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:8a762b81247b348d7fd2a3747ca77cfe58e95299728edf7c24aadc657adeb3b4","observation_id":"00863392-c6b6-418d-a1df-f21c64a6756a","resolution":{"observed_at":"2026-08-04T09:25:38.782483Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.08715","last_updated":"2023-10-25T07:30:51Z","snapshot_observed_at":"2026-08-13T10:54:52.644606Z","submitted_at":"2023-07-16T01:07:15Z","title":"MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.08715","snapshot_observed_at":"2026-08-04T09:25:38.849327Z","title":"Masterkey: Automated jailbreak across multiple large language model chatbots.arXiv preprint arXiv:2307.08715, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.849327Z"},"links":{"cited_paper":"/paper/2307.08715","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:c91e99de82e813c03dbb82c005f573e36b729fcba0e58e6b11c77ff31b7aa5f3","observation_id":"9817fec3-0c68-4669-a3f1-b040e5fcea88","resolution":{"observed_at":"2026-08-04T09:25:38.849327Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.08416","last_updated":"2024-02-13T12:40:39Z","snapshot_observed_at":"2026-08-13T04:19:52.920196Z","submitted_at":"2024-02-13T12:40:39Z","title":"Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.08416","snapshot_observed_at":"2026-08-04T09:25:38.931982Z","title":"Pandora: Jailbreak gpts by retrieval augmented generation poisoning.CoRR, abs/2402.08416, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:38.931982Z"},"links":{"cited_paper":"/paper/2402.08416","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:9a7892a77d9e9da4c667b2dc77a94e8d66a7f0eff8852a70855058cb9933f1d5","observation_id":"5c0115b3-6007-4d3b-a37c-5413d25effe7","resolution":{"observed_at":"2026-08-04T09:25:38.931982Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:39.106482Z","title":"Multilingual jailbreak challenges in large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:39.106482Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:71a6b55cae0f5dd8f23aba96890349ea512901a3f85529f2a3ec9ae91f153b7b","observation_id":"fe063ec7-405b-46c2-bccd-e3c714248afd","resolution":{"observed_at":"2026-08-04T09:25:39.106482Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:39.377432Z","title":"A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:39.377432Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:eacb431e7acb87091b6eac64d012f616c951404f4dd9220d9870f2d8339a4b1f","observation_id":"8e4a384a-071d-4ea2-9755-6c5ee37db158","resolution":{"observed_at":"2026-08-04T09:25:39.377432Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.00523","last_updated":"2025-06-24T18:55:29Z","snapshot_observed_at":"2026-08-13T21:05:36.732753Z","submitted_at":"2024-08-01T12:54:46Z","title":"Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.00523","snapshot_observed_at":"2026-08-04T09:25:39.433419Z","title":"Jailbreaking text-to-image models with llm-based agents.CoRR, abs/2408.00523, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:39.433419Z"},"links":{"cited_paper":"/paper/2408.00523","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:9e3e2daed0ab891e40bf2369cc93443ee33604611a094874a70c8e5bb6ce10fb","observation_id":"03e90c74-720b-4f37-b830-b4c646a49900","resolution":{"observed_at":"2026-08-04T09:25:39.433419Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.04190","last_updated":"2024-10-05T15:10:01Z","snapshot_observed_at":"2026-08-12T22:30:05.869412Z","submitted_at":"2024-10-05T15:10:01Z","title":"Harnessing Task Overload for Scalable Jailbreak Attacks on Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.04190","snapshot_observed_at":"2026-08-04T09:25:39.483290Z","title":"Harnessing task overload for scalable jailbreak attacks on large language models.CoRR, abs/2410.04190, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:39.483290Z"},"links":{"cited_paper":"/paper/2410.04190","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:70ab515537dd19131d4a80b09140fdad0ae022bfccfe2876f55873d9ea381bb2","observation_id":"e7191af2-caa0-40af-ba24-745f0d852e4f","resolution":{"observed_at":"2026-08-04T09:25:39.483290Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.01364","last_updated":"2024-06-03T14:32:30Z","snapshot_observed_at":"2026-08-14T07:23:11.877775Z","submitted_at":"2024-06-03T14:32:30Z","title":"BELLS: A Framework Towards Future Proof Benchmarks for the Evaluation of LLM Safeguards","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.01364","snapshot_observed_at":"2026-08-04T09:25:39.537797Z","title":"BELLS: A framework towards future proof benchmarks for the evaluation of LLM safeguards.CoRR, abs/2406.01364, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:39.537797Z"},"links":{"cited_paper":"/paper/2406.01364","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:2beea04470fd4bd227b0844045446ae5a2bfe646c5770057cbac9c827a9d2dda","observation_id":"a7645fa9-ea0d-47a0-a6de-365ab87a2eb1","resolution":{"observed_at":"2026-08-04T09:25:39.537797Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.04811","last_updated":"2025-03-25T01:51:22Z","snapshot_observed_at":"2026-08-14T06:32:03.296288Z","submitted_at":"2024-08-09T01:45:39Z","title":"h4rm3l: A language for Composable Jailbreak Attack Synthesis","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.04811","snapshot_observed_at":"2026-08-04T09:25:39.619070Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:39.619070Z"},"links":{"cited_paper":"/paper/2408.04811","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:95e26a2bf5710028d3553e0ef19f27baeb3145d8f97fcde72a69c293ca34654b","observation_id":"12484ebc-aed0-47c4-b236-83de6b3fcc95","resolution":{"observed_at":"2026-08-04T09:25:39.619070Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:39.672069Z","title":"Multi-turn jailbreaking large language models via attention shifting","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:39.672069Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:4b7ab9b5371dd3563ce06a79a35190659ace4fc390feb8175fccb8b0b0fa9cda","observation_id":"9f7eb929-631e-42f1-a104-96d669327d06","resolution":{"observed_at":"2026-08-04T09:25:39.672069Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.00296","last_updated":"2026-07-04T04:35:22Z","snapshot_observed_at":"2026-08-12T22:33:49.942321Z","submitted_at":"2024-10-01T00:37:29Z","title":"VLMGuard: Bootstrapping Malicious Prompt Detectors from Unlabeled Vision-Language Prompts in the Wild","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.00296","snapshot_observed_at":"2026-08-04T09:25:39.742694Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:39.742694Z"},"links":{"cited_paper":"/paper/2410.00296","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:23b21f8b8d87edb49788016153f5eb7cfda4d0519f00d89f154711490931061e","observation_id":"9594e70f-3e35-4f86-aa52-c6c430098b00","resolution":{"observed_at":"2026-08-04T09:25:39.742694Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.14853","last_updated":"2025-02-16T07:47:15Z","snapshot_observed_at":"2026-08-15T03:25:21.737167Z","submitted_at":"2024-08-27T08:12:08Z","title":"Atoxia: Red-teaming Large Language Models with Target Toxic Answers","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.14853","snapshot_observed_at":"2026-08-04T09:25:39.796732Z","title":"Detecting AI flaws: Target-driven attacks on internal faults in language models.CoRR, abs/2408.14853, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:39.796732Z"},"links":{"cited_paper":"/paper/2408.14853","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:7e520a0e12c21f81a3a6b668913f6b501e06aef18cdd98163a4363ea3fda88d4","observation_id":"02103ce5-3b21-4a7d-aa4c-47433d021e50","resolution":{"observed_at":"2026-08-04T09:25:39.796732Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:39.931308Z","title":"Vr-hand-in-hand: Using virtual reality (VR) hand tracking for hand-object data annotation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:39.931308Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:08dbbe683a0ccd0cb57f9b4da858a01fd5fdc3704f9606cdcdce216a7f602153","observation_id":"e408f8ef-b6a3-48a5-bccf-d2bfce19d96e","resolution":{"observed_at":"2026-08-04T09:25:39.931308Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:40.034725Z","title":"A comprehensive survey of attack techniques, implementation, and mitigation strategies in large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:40.034725Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:4166e219ae57133e19c566981bc2089084372ccfb39f62dca10e0d5384cb814d","observation_id":"ddb40eed-ee9a-48ad-af23-4dd5eaa62854","resolution":{"observed_at":"2026-08-04T09:25:40.034725Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:40.115576Z","title":"Unbridled icarus: A survey of the potential perils of image inputs in multimodal large language model security","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:40.115576Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:df528d3fb1575577017a78152a4dcf64b844d2f3001185833e071d9c266eef7d","observation_id":"621c4223-71ea-4e8f-8f65-626e4fd54b5f","resolution":{"observed_at":"2026-08-04T09:25:40.115576Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.08793","last_updated":"2025-06-06T20:39:01Z","snapshot_observed_at":"2026-08-13T00:31:01.844148Z","submitted_at":"2024-04-12T19:54:42Z","title":"JailbreakLens: Visual Analysis of Jailbreak Attacks Against Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.08793","snapshot_observed_at":"2026-08-04T09:25:40.187719Z","title":"Jailbreaklens: Visual analysis of jailbreak attacks against large language models.CoRR, abs/2404.08793, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:40.187719Z"},"links":{"cited_paper":"/paper/2404.08793","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:01c37d1eb726dd585c759767bfebc475e3916298fc4ff2ffc9771e3d4a7ba4b8","observation_id":"ff93b40b-3006-4fca-bfc7-8ceef6c257e9","resolution":{"observed_at":"2026-08-04T09:25:40.187719Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:40.259864Z","title":"Safety alignment in NLP tasks: Weakly aligned summarization as an in-context attack","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:40.259864Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:5c33e0514e2b26101609ddb122cbe691925274436484ef083ff6b18c1c706ed9","observation_id":"41d41791-47f3-478b-8b93-8b1a43fcb9fe","resolution":{"observed_at":"2026-08-04T09:25:40.259864Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.15202","last_updated":"2024-05-24T04:14:32Z","snapshot_observed_at":"2026-08-12T23:59:11.325763Z","submitted_at":"2024-05-24T04:14:32Z","title":"Cross-Task Defense: Instruction-Tuning LLMs for Content Safety","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.15202","snapshot_observed_at":"2026-08-04T09:25:40.395617Z","title":"Papalexakis, Aichi Chien, and Yue Dong","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:40.395617Z"},"links":{"cited_paper":"/paper/2405.15202","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:4ea92d0a421814d582c458546c42d9c5d16c49389552fed40fef4b76139cb998","observation_id":"fc437b38-c7f0-44d9-9a3f-f019cf882af7","resolution":{"observed_at":"2026-08-04T09:25:40.395617Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.07188","last_updated":"2024-07-14T18:27:14Z","snapshot_observed_at":"2026-08-15T03:26:24.732285Z","submitted_at":"2024-06-11T12:01:09Z","title":"Merging Improves Self-Critique Against Jailbreak Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.07188","snapshot_observed_at":"2026-08-04T09:25:40.483282Z","title":"Merging improves self-critique against jailbreak attacks.CoRR, abs/2406.07188, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:40.483282Z"},"links":{"cited_paper":"/paper/2406.07188","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:5035173080a75e45b170debbe87803c56829484b2c5a6ac7e53d38264597fce6","observation_id":"0104abb8-b93e-4a6d-ba73-08658c0f765b","resolution":{"observed_at":"2026-08-04T09:25:40.483282Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:40.543033Z","title":"MART: improving LLM safety with multi-round automatic red-teaming","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:40.543033Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:cd4a9f07f41036ee7e3cd1efacaa847d7c883d69939e221260fa9ce1330fb749","observation_id":"db601228-2c5c-4aa0-865b-c89d4baef68e","resolution":{"observed_at":"2026-08-04T09:25:40.543033Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.14020","last_updated":"2024-02-21T18:59:13Z","snapshot_observed_at":"2026-08-13T04:13:27.147849Z","submitted_at":"2024-02-21T18:59:13Z","title":"Coercing LLMs to do and reveal (almost) anything","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.14020","snapshot_observed_at":"2026-08-04T09:25:40.590605Z","title":"Coercing llms to do and reveal (almost) anything.CoRR, abs/2402.14020, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:40.590605Z"},"links":{"cited_paper":"/paper/2402.14020","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:f3adcc79277b8caadb52b64fb4cfe133a6b937ee83af18ca36821a23405ad955","observation_id":"a4c1acff-d1c7-4c9a-8f25-cb5f0c6c7363","resolution":{"observed_at":"2026-08-04T09:25:40.590605Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09154","last_updated":"2025-03-03T09:37:27Z","snapshot_observed_at":"2026-08-13T04:19:08.545815Z","submitted_at":"2024-02-14T13:13:26Z","title":"Attacking Large Language Models with Projected Gradient Descent","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09154","snapshot_observed_at":"2026-08-04T09:25:40.661962Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:40.661962Z"},"links":{"cited_paper":"/paper/2402.09154","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:c69ec369f0ccfc98c40227642d3e85950d66020ac41bb0dd45f7770f967532a5","observation_id":"dbb98816-ca6a-40f5-96a0-89c93ed6d197","resolution":{"observed_at":"2026-08-04T09:25:40.661962Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.05993","last_updated":"2024-09-11T14:42:29Z","snapshot_observed_at":"2026-08-14T08:56:02.730744Z","submitted_at":"2024-04-09T03:54:28Z","title":"AEGIS: Online Adaptive AI Content Safety Moderation with Ensemble of LLM Experts","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.05993","snapshot_observed_at":"2026-08-04T09:25:40.793268Z","title":"AEGIS: online adaptive AI content safety moderation with ensemble of LLM experts.CoRR, abs/2404.05993, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:40.793268Z"},"links":{"cited_paper":"/paper/2404.05993","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:55f527e5631bf51f7f383905a3720220536beaa121d2970aff36e4983229674f","observation_id":"c2d13794-9a2b-4399-9469-ee2f79f5efd0","resolution":{"observed_at":"2026-08-04T09:25:40.793268Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.00137","last_updated":"2024-08-29T17:30:05Z","snapshot_observed_at":"2026-08-13T22:29:13.364751Z","submitted_at":"2024-08-29T17:30:05Z","title":"Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.00137","snapshot_observed_at":"2026-08-04T09:25:40.938534Z","title":"Emerging vulnerabilities in frontier models: Multi-turn jailbreak attacks.CoRR, abs/2409.00137, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:40.938534Z"},"links":{"cited_paper":"/paper/2409.00137","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:f4973746c975714e7977d0c19cb54e7bb2988123c3b8047670bdc675344fbb4c","observation_id":"ea59c527-9285-4805-8af7-78b1f2e8efef","resolution":{"observed_at":"2026-08-04T09:25:40.938534Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.02551","last_updated":"2024-10-30T17:16:44Z","snapshot_observed_at":"2026-08-12T23:30:16.785484Z","submitted_at":"2024-07-02T16:19:25Z","title":"Breach By A Thousand Leaks: Unsafe Information Leakage in `Safe' AI Responses","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.02551","snapshot_observed_at":"2026-08-04T09:25:41.056143Z","title":"A false sense of safety: Unsafe information leakage in ’safe’ AI responses.CoRR, abs/2407.02551, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:41.056143Z"},"links":{"cited_paper":"/paper/2407.02551","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:1d88bc8be354d33f6cf4594fc42bdb128510e8033738dbdef223c6e7690abd59","observation_id":"dcd95c5d-ffb9-484a-b7fc-9d929a2e496a","resolution":{"observed_at":"2026-08-04T09:25:41.056143Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:41.188536Z","title":"Gradient-based adversarial attacks against text transformers","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:41.188536Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:5af708f4c4862c280d8553a3ba0a741c60097ec658c5a72a120a667e82e213e2","observation_id":"7f41054c-378c-4f36-a00b-8c506c3c32b4","resolution":{"observed_at":"2026-08-04T09:25:41.188536Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:41.328475Z","title":"Cold-attack: Jailbreaking llms with stealthiness and controllability","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:41.328475Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:4c86c8f9381dbf231e5990cc314517c32dfcc0958e8f85dd6f69b0d6f1653bc8","observation_id":"a4ad2add-d635-41d4-859f-6f32aa0172ad","resolution":{"observed_at":"2026-08-04T09:25:41.328475Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:41.550062Z","title":"From chatgpt to threatgpt: Impact of generative AI in cybersecurity and privacy.IEEE Access, 11:80218–80245, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:41.550062Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:93644ecf51d4f12a45ad0dcfd5d5d642d8b057f7ab50992630ecf6c4eef90eb5","observation_id":"d461019a-a9cc-49b4-bdad-6cf6e54bf68f","resolution":{"observed_at":"2026-08-04T09:25:41.550062Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:41.479378Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:41.479378Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:b0250ec997535f705ed4e55c4c55f168c671d21a41f8f5490f2a1a83264466e6","observation_id":"3301909c-d3bb-4f92-aac1-796af4abbf4f","resolution":{"observed_at":"2026-08-04T09:25:41.479378Z","resolver_source":null,"status":"parse_uncertain"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:41.823447Z","title":"Gajera, and Chitta Baral","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:41.823447Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:bb9974c97dae7f1c5523a12350e7ad84c242caad55be2814ff4035e3b970f05d","observation_id":"42915daa-e987-4308-a05b-cfa38d400ce0","resolution":{"observed_at":"2026-08-04T09:25:41.823447Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:41.701831Z","title":"Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:41.701831Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:8816a76615990efbe892145f4f3882bdf1605cd5fd6d25b1e48b971a478e828a","observation_id":"6791c844-f679-405d-9538-5d0b15001a93","resolution":{"observed_at":"2026-08-04T09:25:41.701831Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:42.148660Z","title":"Privacy of federated QR decomposition using additive secure multiparty compu- tation.IEEE Trans","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:42.148660Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:6fb27b3b15af14868e19c9b51020eba9e8830e29a0f465746843e2a45e8de331","observation_id":"4d9b2e1d-9a45-4dac-b6bc-f9f8ed73cb27","resolution":{"observed_at":"2026-08-04T09:25:42.148660Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:41.985748Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:41.985748Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:47d7fdee53ecbbeea1e6f828398bc4b558a806b6c08f88346163bb72abd21005","observation_id":"43b66e3c-e880-4716-a81e-adb2da2b930e","resolution":{"observed_at":"2026-08-04T09:25:41.985748Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:42.429264Z","title":"Springer Briefs in Computer Science","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:42.429264Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:ae7b5fdc5dfd2c80ea41c51d32e2e4b839559a9fd88b4d7070de651013712a0b","observation_id":"3fe12d56-4d6b-427d-8c8b-16655549bc71","resolution":{"observed_at":"2026-08-04T09:25:42.429264Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:42.308793Z","title":"Query-based adversarial prompt generation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:42.308793Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:ed1c3fd70da293b24c45b14b6bb16fe79e11de2f3217755b9d17bfabff64403d","observation_id":"5cc54660-f3a2-4a99-918c-f20b7b49f2c7","resolution":{"observed_at":"2026-08-04T09:25:42.308793Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:42.631277Z","title":"Gradient cuff: Detecting jailbreak attacks on large language models by exploring refusal loss landscapes","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:42.631277Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:4c1706bd9eb8180ae1c62e646a248290c8b8e5437ef036c5cb8af6ee92985d3a","observation_id":"0735b77b-8282-401f-8bfe-7b518102fb1a","resolution":{"observed_at":"2026-08-04T09:25:42.631277Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:42.520819Z","title":"Defending against indirect prompt injection attacks with spotlighting","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:42.520819Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:812e35b111ae018ff4301c0151528a4086b6855b237c9d355a5629bac715a4e0","observation_id":"455d9866-9f50-4a02-8f64-8bf5c5e63266","resolution":{"observed_at":"2026-08-04T09:25:42.520819Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:42.795114Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:42.795114Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:55a3314fc382e241268acde03a38c05f5af5b004f6b4ffea7b1bcc8edbcdfd7c","observation_id":"9c51da07-703f-4b26-94b6-c2c89dfdf775","resolution":{"observed_at":"2026-08-04T09:25:42.795114Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.18118","last_updated":"2024-12-24T14:26:36Z","snapshot_observed_at":"2026-08-12T23:34:44.396559Z","submitted_at":"2024-06-26T07:15:44Z","title":"SafeAligner: Safety Alignment against Jailbreak Attacks via Response Disparity Guidance","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.18118","snapshot_observed_at":"2026-08-04T09:25:42.743728Z","title":"Safealigner: Safety alignment against jailbreak attacks via response disparity guidance.CoRR, abs/2406.18118, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:42.743728Z"},"links":{"cited_paper":"/paper/2406.18118","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:a861bd669c263c2e3e198531bbeae1f5bf2d0ad4cf35a2500de3079eb1624af8","observation_id":"16c3402c-6f54-42f2-840b-f2182031128a","resolution":{"observed_at":"2026-08-04T09:25:42.743728Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.06237","last_updated":"2024-12-10T20:23:44Z","snapshot_observed_at":"2026-08-13T22:49:25.727049Z","submitted_at":"2023-11-10T18:52:58Z","title":"Summon a Demon and Bind it: A Grounded Theory of LLM Red Teaming","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.06237","snapshot_observed_at":"2026-08-04T09:25:42.921586Z","title":"Summon a demon and bind it: A grounded theory of LLM red teaming in the wild.CoRR, abs/2311.06237, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:42.921586Z"},"links":{"cited_paper":"/paper/2311.06237","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:2a282a34cd75f53ead147213da3b139ef032256a31b1b1cca7d220718d89f670","observation_id":"96ae2779-3cc2-4ded-9764-a56c00db3b65","resolution":{"observed_at":"2026-08-04T09:25:42.921586Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:42.848076Z","title":"Catastrophic jailbreak of open-source llms via exploiting generation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:42.848076Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:ea4a5def2ec0023ff1cd2fe0a471fc8ad116c8c65da12c7f81bb67c845ff68f1","observation_id":"592b08cf-b8fc-47db-84f2-61193b21fecc","resolution":{"observed_at":"2026-08-04T09:25:42.848076Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:43.019507Z","title":"Beavertails: Towards improved safety alignment of LLM via a human-preference dataset","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:43.019507Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:4fd1fc20673f36d29db3f8f6fd877469914ffef89302c23eb044e4b67a0fd719","observation_id":"a4caaa46-b992-4e71-9ba7-e9340233975d","resolution":{"observed_at":"2026-08-04T09:25:43.019507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-04T09:25:42.972944Z","title":"Baseline defenses for adversarial attacks against aligned language models.CoRR, abs/2309.00614, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:42.972944Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:0bf97d40d18da2e204b719b3c5bc8f408b38ae64590d47a3eca25e36c1a6e7e8","observation_id":"dd32e0e4-2fb8-4cb4-882b-c3330f9b24c6","resolution":{"observed_at":"2026-08-04T09:25:42.972944Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:43.222934Z","title":"Automated progressive red teaming","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:43.222934Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:c4cd67ce3e29f034a78625dd505cf210f3510a927d8b1eadcfa428fd4dbab3ce","observation_id":"9a4f3330-ff82-440f-b9a5-8e93d4572fc1","resolution":{"observed_at":"2026-08-04T09:25:43.222934Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:43.117969Z","title":"Improved techniques for optimization-based jailbreaking on large language models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:43.117969Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:df10b28da93b425e87f3d8daaee7f9f43fbedbaf119aa4946ae61aab8e161de0","observation_id":"2a66055a-f2f6-4ede-9f09-0dac4dcfb177","resolution":{"observed_at":"2026-08-04T09:25:43.117969Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.16756","last_updated":"2025-02-17T06:59:54Z","snapshot_observed_at":"2026-08-12T22:55:09.813220Z","submitted_at":"2024-08-29T17:54:14Z","title":"How Well Do LLMs Handle Cantonese? Benchmarking Cantonese Capabilities of Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.16756","snapshot_observed_at":"2026-08-04T09:25:43.462117Z","title":"How far can cantonese NLP go? benchmarking cantonese capabilities of large language models.CoRR, abs/2408.16756, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:43.462117Z"},"links":{"cited_paper":"/paper/2408.16756","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:5d3ce96071c29b56b70bbf5a7951cf6431c85bf9c44bfcf30f0a5cfb57efd7e5","observation_id":"b67286f1-d679-48a7-8b1a-f8d062120594","resolution":{"observed_at":"2026-08-04T09:25:43.462117Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:43.358431Z","title":"Artprompt: ASCII art-based jailbreak attacks against aligned llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:43.358431Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:be85711579a7053ca06542a6e2b4e3902bf853f9e8fcf4ea6cc0f094f1c627bc","observation_id":"993f03bd-2797-4073-b236-6c4772f2f376","resolution":{"observed_at":"2026-08-04T09:25:43.358431Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.11313","last_updated":"2025-04-02T08:03:11Z","snapshot_observed_at":"2026-08-13T21:31:01.607929Z","submitted_at":"2024-08-21T03:35:24Z","title":"An Optimizable Suffix Is Worth A Thousand Templates: Efficient Black-box Jailbreaking without Affirmative Phrases via LLM as Optimizer","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.11313","snapshot_observed_at":"2026-08-04T09:25:43.691276Z","title":"Unlocking adversarial suffix optimization without affirmative phrases: Efficient black-box jailbreaking via LLM as optimizer.CoRR, abs/2408.11313, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:43.691276Z"},"links":{"cited_paper":"/paper/2408.11313","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:7c95fefd39bd557a39c6c2660579850f94fb1045a1480464ba471bcbbe0a1454","observation_id":"dc745b0d-06b8-4b6d-aa5d-f51d89c7c6e0","resolution":{"observed_at":"2026-08-04T09:25:43.691276Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:43.586510Z","title":"Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:43.586510Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:3a91fec249c68034661646c19a2f1a34b8bb8ca133b15e9bc334f6b5a4fe79e6","observation_id":"b48ce965-8368-4aac-839f-57502c835e31","resolution":{"observed_at":"2026-08-04T09:25:43.586510Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:43.924124Z","title":"GUARD: role-playing to generate natural-language jailbreakings to test guideline adherence of large language models.CoRR, abs/2402.03299, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:43.924124Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:6af9752b189c4a060b2b95962178da2071ff99040222a575692faed5562fa1b7","observation_id":"58b33b15-decc-4f83-94c5-397ff037b586","resolution":{"observed_at":"2026-08-04T09:25:43.924124Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.17458","last_updated":"2025-06-07T08:11:07Z","snapshot_observed_at":"2026-08-12T22:37:19.205060Z","submitted_at":"2024-09-26T01:24:17Z","title":"RED QUEEN: Safeguarding Large Language Models against Concealed Multi-Turn Jailbreaking","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.17458","snapshot_observed_at":"2026-08-04T09:25:43.834739Z","title":"RED QUEEN: safeguarding large language models against concealed multi-turn jailbreaking.CoRR, abs/2409.17458, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:43.834739Z"},"links":{"cited_paper":"/paper/2409.17458","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:cca78d7a6e78cece8d7f89fd2642df88d691cd0f1a73d5ad384a9bdb9bd6706d","observation_id":"72cb0e55-3ef8-44af-b1be-3c2f0f1f0849","resolution":{"observed_at":"2026-08-04T09:25:43.834739Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:44.167467Z","title":"airoboros-2.2, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:44.167467Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:edcf87cf92da18fa81c82f0531cdccf6f59607dc9b82a2f5cee29f988dc01ac4","observation_id":"3ac69714-b70b-42f7-9c0a-9d2a565ae173","resolution":{"observed_at":"2026-08-04T09:25:44.167467Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:44.048608Z","title":"Jailbreakzoo: Survey, landscapes, and horizons in jailbreaking large language and vision-language models.CoRR, abs/2407.01599, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:44.048608Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:84e230b817d0f7289ec29478246932b62aa437534f5e6dfc7f5ec2f9e440d05a","observation_id":"41e4b29d-9027-4200-8c48-8ec8fb5729b6","resolution":{"observed_at":"2026-08-04T09:25:44.048608Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.14595","last_updated":"2024-07-01T19:58:00Z","snapshot_observed_at":"2026-08-12T23:38:08.845991Z","submitted_at":"2024-06-20T17:43:18Z","title":"Adversaries Can Misuse Combinations of Safe Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.14595","snapshot_observed_at":"2026-08-04T09:25:44.450683Z","title":"Dragan, and Jacob Steinhardt","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:44.450683Z"},"links":{"cited_paper":"/paper/2406.14595","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:2aaf7c4072c7898d51e6ee99c9aabcbe5112d27f7f34cd06e9d5d8e491b785b9","observation_id":"61c77a38-f94c-43af-8797-e095fed36918","resolution":{"observed_at":"2026-08-04T09:25:44.450683Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:44.303783Z","title":"Dragan, Aditi Raghunathan, and Jacob Steinhardt","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:44.303783Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:286751b48f742056c52ba368b64ef9dc50e8e15b547417b93c9f11a2caa7d805","observation_id":"d4b97758-ce27-4c7d-9aab-6405ad414d27","resolution":{"observed_at":"2026-08-04T09:25:44.303783Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.14048","last_updated":"2024-06-20T07:13:25Z","snapshot_observed_at":"2026-08-13T17:39:55.824833Z","submitted_at":"2024-06-20T07:13:25Z","title":"Prompt Injection Attacks in Defended Systems","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.14048","snapshot_observed_at":"2026-08-04T09:25:44.752795Z","title":"Prompt injection attacks in defended systems.CoRR, abs/2406.14048, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:44.752795Z"},"links":{"cited_paper":"/paper/2406.14048","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:a868280508f3ce2f5d98f82c8097ed1a4a07a07aab3ab0a00c54ffefe753ee3b","observation_id":"335c8800-3be9-4431-add4-ab1500a44bb0","resolution":{"observed_at":"2026-08-04T09:25:44.752795Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:44.645801Z","title":"Exploiting programmatic behavior of llms: Dual-use through standard security attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":92,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:44.645801Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:ad45fe080306b50ffb2ba29fd384d1824f11548f006e9461e0bfc713ab74896f","observation_id":"c932a8fe-9906-402a-b4f3-6e6a69f40eab","resolution":{"observed_at":"2026-08-04T09:25:44.645801Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14725","last_updated":"2024-06-24T05:01:06Z","snapshot_observed_at":"2026-08-13T00:49:07.118008Z","submitted_at":"2024-03-20T21:53:56Z","title":"Testing the Limits of Jailbreaking Defenses with the Purple Problem","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14725","snapshot_observed_at":"2026-08-04T09:25:45.047622Z","title":"Jailbreaking is best solved by definition.CoRR, abs/2403.14725, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:45.047622Z"},"links":{"cited_paper":"/paper/2403.14725","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:aee32c079f7c2d15a4d37ee6731e273c0ed15b7d3eadd6ec8102e03bddde7eab","observation_id":"d03ab2ff-9879-4317-98e8-9dd6494ca598","resolution":{"observed_at":"2026-08-04T09:25:45.047622Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.15180","last_updated":"2024-02-27T01:39:20Z","snapshot_observed_at":"2026-08-13T04:12:18.009364Z","submitted_at":"2024-02-23T08:22:24Z","title":"Break the Breakout: Reinventing LM Defense Against Jailbreak Attacks with Self-Refinement","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.15180","snapshot_observed_at":"2026-08-04T09:25:44.871354Z","title":"Break the breakout: Reinventing LM defense against jailbreak attacks with self-refinement.CoRR, abs/2402.15180, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:44.871354Z"},"links":{"cited_paper":"/paper/2402.15180","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:2626350fc1c8c7a6da89fe4dd03246e453e8050d655b3551a1c2a50afe53ed3e","observation_id":"59b80ef8-a9d3-4ade-9607-bfd534c63dad","resolution":{"observed_at":"2026-08-04T09:25:44.871354Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02705","last_updated":"2025-02-04T19:47:09Z","snapshot_observed_at":"2026-08-15T05:53:59.943730Z","submitted_at":"2023-09-06T04:37:20Z","title":"Certifying LLM Safety against Adversarial Prompting","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02705","snapshot_observed_at":"2026-08-04T09:25:45.397309Z","title":"Certifying LLM safety against adversarial prompting.CoRR, abs/2309.02705, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:45.397309Z"},"links":{"cited_paper":"/paper/2309.02705","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:a4763b2b34dcc819540285fb506f70caf3bf3d9875c8cd28d94855f8bfc9f62f","observation_id":"510fa07b-1d80-43a3-9c68-e3914854dc9c","resolution":{"observed_at":"2026-08-04T09:25:45.397309Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.03554","last_updated":"2024-08-07T05:30:10Z","snapshot_observed_at":"2026-08-15T03:35:35.814909Z","submitted_at":"2024-08-07T05:30:10Z","title":"Empirical Analysis of Large Vision-Language Models against Goal Hijacking via Visual Prompt Injection","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.03554","snapshot_observed_at":"2026-08-04T09:25:45.204025Z","title":"Empirical analysis of large vision-language models against goal hijacking via visual prompt injection.CoRR, abs/2408.03554, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":96,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:45.204025Z"},"links":{"cited_paper":"/paper/2408.03554","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:0f05e356f19acf47bb8e308d26a15acbab4ece84bde242dc741e6bb60bf599a4","observation_id":"e9abbf7f-1f7f-47bf-9ac7-84ff298caac9","resolution":{"observed_at":"2026-08-04T09:25:45.204025Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.07317","last_updated":"2024-03-14T20:56:23Z","snapshot_observed_at":"2026-08-13T10:34:44.234745Z","submitted_at":"2023-08-14T17:59:56Z","title":"Platypus: Quick, Cheap, and Powerful Refinement of LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.07317","snapshot_observed_at":"2026-08-04T09:25:45.762344Z","title":"Lee, Cole J","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":97,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:45.762344Z"},"links":{"cited_paper":"/paper/2308.07317","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:c1f0da95f28e1822443a9cfeeb125e51709c210ea6396439bf75272b8a2d4ac7","observation_id":"91d877c2-d706-4788-9dcf-4d42d5b19472","resolution":{"observed_at":"2026-08-04T09:25:45.762344Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.01446","last_updated":"2024-08-05T11:34:10Z","snapshot_observed_at":"2026-08-14T10:42:15.015647Z","submitted_at":"2023-09-04T08:54:20Z","title":"Open Sesame! Universal Black Box Jailbreaking of Large Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.01446","snapshot_observed_at":"2026-08-04T09:25:45.557792Z","title":"Open sesame! universal black box jailbreaking of large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":98,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:45.557792Z"},"links":{"cited_paper":"/paper/2309.01446","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:cfd519c2f9f45c6899c74d69a32497f2be1c9a8b49172e49063c477b2c7dbca8","observation_id":"8ab876c1-6575-4d55-b711-3fb3217f109b","resolution":{"observed_at":"2026-08-04T09:25:45.557792Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.16765","last_updated":"2024-01-30T06:04:04Z","snapshot_observed_at":"2026-08-13T04:32:04.658955Z","submitted_at":"2024-01-30T06:04:04Z","title":"A Cross-Language Investigation into Jailbreak Attacks in Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.16765","snapshot_observed_at":"2026-08-04T09:25:45.961893Z","title":"A cross-language investigation into jailbreak attacks in large language models.CoRR, abs/2401.16765, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":99,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:45.961893Z"},"links":{"cited_paper":"/paper/2401.16765","citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:1a8a2ca8d40077dac76ff298b5aa0c2f48168683a87b9fb5cfe0745d82708388","observation_id":"16f4b4f1-0897-4ce5-b30d-3bc42dd98d7d","resolution":{"observed_at":"2026-08-04T09:25:45.961893Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-04T09:25:45.887588Z","title":"Multi-step jailbreaking privacy attacks on chatgpt","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"reference_index":100,"source":"pdf_text","source_observed_at":"2026-08-04T09:25:45.887588Z"},"links":{"citing_paper":"/paper/2510.15476"},"observation_digest":"sha256:476323f5dce40ad6f023231573e943ceba83e277b8a5b4e360b57d7833e80903","observation_id":"2c28a4b1-0b8e-4d39-9786-d5530b3e1275","resolution":{"observed_at":"2026-08-04T09:25:45.887588Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","latest_version":3,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-14T22:20:04.981358Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses"},"reference_resolution":{"displayed":100,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":1,"unresolved":99,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":255},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-15T06:32:42.880941+00:00","source":"crossref"},{"observed_at":"2026-08-15T06:32:39.529945+00:00","source":"retraction_watch"}],"thesis":"As of 15 August 2026, this Paper Citation Record lists 100 of 255 outbound references and 3 inbound Pith citation observations for arXiv:2510.15476."}