{"as_of":"2026-08-04T10:02:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:8e1a018291ab95db019cf73ea3abad522168dd333e51f9239d93122a3901514e","coverage":[{"denominator":37,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":37,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-10T15:54:24.013408Z","state":"measured"},{"denominator":37,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":37,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-04T06:34:03.388597+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2604.12548/citation-record","integrity":"/paper/2604.12548/integrity","json":"/paper/2604.12548/citation-record.json","paper":"/paper/2604.12548"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Model-as-a-service (MaaS): A survey","venue":null,"work_id":"f4759708-ddb4-4a78-90a2-13092dc375bb","year":2023},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:e6d4ff519d6f94b02e2231b4f64f20f87dc43b462a3a98b53a1f8874b2acb79a","observation_id":"ff2e81a2-bc07-4ce1-994f-10bffca44805","resolution":{"observed_at":"2026-05-17T18:02:02.746286Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Multimodal large language models: A survey","venue":null,"work_id":"959eb1f6-9fc6-46dd-ad5e-2624f52ef47c","year":2023},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:9fcf89cf81542d01ef81c6611cac6b473c72a65e1accdcc7e9fdab8d8011089e","observation_id":"755a6bc8-f523-400c-8dbe-df07891bf848","resolution":{"observed_at":"2026-05-17T18:02:02.736069Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Mixture of experts (MoE): A big data perspective","venue":null,"work_id":"a9b82726-0619-4f65-a46f-5ae37f711dd5","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:abf8ca05a9745d962f4b6639f63bbf6ded88fef6349f00eeaa570adb0d2bedab","observation_id":"7ef0c7a5-9477-4d32-afe5-c0d26fd3cf92","resolution":{"observed_at":"2026-05-17T18:02:02.789126Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.17704","last_updated":"2025-05-24T12:50:56Z","snapshot_observed_at":"2026-07-06T21:14:19.350177Z","submitted_at":"2025-04-24T16:11:01Z","title":"Safety in Large Reasoning Models: A Survey","version":3},"cited_work":{"arxiv_id":"2504.17704","doi":"10.48550/arxiv.2504.17704","metadata_source":"arxiv_reference","pith_arxiv_id":"2504.17704","snapshot_observed_at":"2026-07-10T12:15:01.137692Z","title":"Safety in large reasoning models: A survey","venue":null,"work_id":"470c49c6-107b-460e-a789-6a9f4d5db2f2","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"cited_paper":"/paper/2504.17704","citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:081fb33358eae0db2c4e28a21d8b629e1f30772c5361b249bd613eaa03ec7e98","observation_id":"fccb413b-75e1-4a2b-a9c9-a8e50611f09a","resolution":{"observed_at":"2026-05-11T09:41:00.379274Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Jailbreaking black box large language models in twenty queries","venue":null,"work_id":"1f0daac1-bc3b-42f7-9f35-271d8c367529","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:53b834d7ac2a09c1a405d86f69ae6b485fe8ad9faeb199ea8294b1005594b804","observation_id":"e2cb6d56-33ae-4da5-b50d-6b63c27a7b7b","resolution":{"observed_at":"2026-05-17T18:02:02.776819Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection","venue":null,"work_id":"6ebd8dbe-d8f9-432a-ac94-607183eabe85","year":2023},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:741ed969e0b8ce08709dd228e0b2fdf6b13156cfd03cefbc533e17c6e2801c90","observation_id":"50d2e92d-6450-48e5-8377-1ca602d369a4","resolution":{"observed_at":"2026-05-17T18:02:02.779970Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.16873","last_updated":"2025-06-02T18:59:01Z","snapshot_observed_at":"2026-07-06T18:05:42.862609Z","submitted_at":"2024-04-21T22:18:13Z","title":"AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs","version":2},"cited_work":{"arxiv_id":"2404.16873","doi":"10.48550/arxiv.2404.16873","metadata_source":"pith","pith_arxiv_id":"2404.16873","snapshot_observed_at":"2026-07-10T15:27:20.108686Z","title":"arXiv preprint arXiv:2404.16873 (2024)","venue":"cs.CR","work_id":"162cd8d7-72c1-4741-804d-acd0126638ee","year":2024},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"cited_paper":"/paper/2404.16873","citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:686513ebfd4f5b625c7c83f57736c541e3c5c1389c360301b6f893804dd08a39","observation_id":"7311c844-7b4e-4ce5-bbe1-9ca087b68089","resolution":{"observed_at":"2026-05-11T09:41:00.474344Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Certified defenses for data poisoning attacks","venue":null,"work_id":"c1958dc0-153f-4563-8921-eeda8e264b9d","year":2017},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:a80d998e93a84b96b0cdfc61c6fe4a27857e732a44597913b274d850100358dc","observation_id":"9f11f76f-e81e-4496-905d-025b4969ae8b","resolution":{"observed_at":"2026-05-17T18:02:02.783168Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Defending large language models against jailbreaking attacks through goal prioriti- zation","venue":null,"work_id":"a95842b7-8b34-4cb2-ab50-9daaa66c3d9a","year":2024},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:a14a39af85ecaaf5d175e5a0eab80946da501b9489b6afc4c09f735dee772882","observation_id":"66950a75-5670-4354-9dfa-278da53d908c","resolution":{"observed_at":"2026-05-17T18:02:02.782085Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Many-shot jailbreaking","venue":null,"work_id":"3dca3682-4463-4a6a-90ea-30a3c9f0b051","year":2024},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:d6c9e1baea4709a8edacdb768ce20111165fe3f4e4510453be47b3a02f98ada2","observation_id":"a0d34ecd-8fa9-43a5-86b9-963b12bac8f1","resolution":{"observed_at":"2026-05-17T18:02:02.785927Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Poisoning language models during instruction tuning","venue":null,"work_id":"8d0c16f0-ba7a-435d-88c9-6fb1beb0c8a2","year":2023},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:ae9960f6630ef07332e240cb0004f02d0d7fcf74d7f4cee52df0515604d5c2bb","observation_id":"60765ed4-2fd4-4543-82d4-c42df9607390","resolution":{"observed_at":"2026-05-17T18:02:02.763969Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Universal adversarial triggers for attacking and analyzing nlp","venue":null,"work_id":"62a28f98-80a1-4d3e-b6c2-64c8afe46f77","year":2019},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:534c0a41e99732be46e8087811bcc9505f3d2ba51c2ccff109c1f6bb668aad4c","observation_id":"75988f09-8143-4832-9e70-7b30bcbb1180","resolution":{"observed_at":"2026-05-17T18:02:02.798072Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Auto- Prompt: Eliciting knowledge from language models with automatically generated prompts","venue":null,"work_id":"0379bf0f-b2b2-464f-a466-6f7808433de5","year":2020},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:acb67775ad1d60ecd76317843dd86885731f62b09269969f0396df8f87a4f899","observation_id":"07bb2040-79c4-4d8b-8084-1686e0b0b7d5","resolution":{"observed_at":"2026-05-17T18:02:02.804722Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":"2307.15043","doi":"10.48550/arxiv.2307.15043","metadata_source":"pith","pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-07-11T02:47:49.837877Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","venue":"cs.CL","work_id":"3322fa86-1768-4677-8425-dd326b45e078","year":2023},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:0615ce5a5061c73e533ed757d1cc750dd9265f6df67ae74b09eaf1a045155b49","observation_id":"e228b997-e501-4bda-a1f6-c32d01b0fc79","resolution":{"observed_at":"2026-05-11T09:41:00.437700Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Promptrobust: Towards evaluating the robustness of large language models on adversarial prompts","venue":null,"work_id":"600c2823-5e3a-4da6-b2b8-b349421ff6d4","year":2023},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:d99875b2911562af950af1c6e532462e31fce699e15ddb9193c96dca824b1ae4","observation_id":"9ecfd9f7-59e3-4629-8560-2ab84e0268bf","resolution":{"observed_at":"2026-05-17T18:02:02.801237Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Red teaming visual language models","venue":null,"work_id":"8258e7a3-fa23-40fb-82d5-293cedece883","year":2024},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:65c33d6d0465d203abc89e91cbeca797198b4068227e8ea1751ae55849336131","observation_id":"2ce9acb9-1790-42da-9d54-5affe3a6c8af","resolution":{"observed_at":"2026-05-17T18:02:02.784734Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2503.11519","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"arXiv preprint arXiv:2503.11519 (2025)","venue":null,"work_id":"260d706c-acd3-49c0-a380-895c953d4493","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:028c6806cbab3e0807344cf30ed4a9b9bc24108e95b278896ff79575bce93f6c","observation_id":"da67828f-94dc-4725-9469-2999c1b10128","resolution":{"observed_at":"2026-05-11T09:41:00.456076Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.09023","last_updated":"2025-10-10T05:51:04Z","snapshot_observed_at":"2026-08-03T03:11:42.084785Z","submitted_at":"2025-10-10T05:51:04Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","version":1},"cited_work":{"arxiv_id":"2510.09023","doi":"10.48550/arxiv.2510.09023","metadata_source":"pith","pith_arxiv_id":"2510.09023","snapshot_observed_at":"2026-07-10T12:27:04.220949Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","venue":"cs.LG","work_id":"585d66b7-a25c-4390-a7c8-8b15064c122f","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"cited_paper":"/paper/2510.09023","citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:62c36c6b82bf5d207c53addbc59d74e6ba2ec976352ecf5a727a455aa9f7d0d4","observation_id":"6f4fdde2-2c2e-47b0-8e86-f356c9abc9e5","resolution":{"observed_at":"2026-05-16T18:53:24.731592Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.13162","last_updated":"2025-02-16T18:47:41Z","snapshot_observed_at":"2026-07-06T20:38:48.725605Z","submitted_at":"2025-02-16T18:47:41Z","title":"ShieldLearner: A New Paradigm for Jailbreak Attack Defense in LLMs","version":1},"cited_work":{"arxiv_id":"2502.13162","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.13162","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Shieldlearner: A new paradigm for jailbreak attack defense in llms","venue":null,"work_id":"3cbead5f-648e-426c-9848-654ddb7a36ad","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"cited_paper":"/paper/2502.13162","citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:527ec7cbfd225f7f046b7fcd2929d59015c7282f91c39f1299cb85af1029f64f","observation_id":"2fefa364-0629-4ad5-8811-f9d5aa02e6cf","resolution":{"observed_at":"2026-05-11T09:41:00.350285Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"The hidden risks of large reasoning models: A safety assessment of R1","venue":null,"work_id":"2b8eaf12-9d92-48b3-939e-ea9a6968e13a","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:bdff02822728384221bc095e392e1801a310352e5221b81e7dd1039ca2958432","observation_id":"e607288b-a2b4-448b-beb5-10c6b5ac97f3","resolution":{"observed_at":"2026-05-17T18:02:02.761539Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Sugar- coated poison: Benign generation unlocks jailbreaking","venue":null,"work_id":"c5818bba-c514-40cd-a98a-5a2a0f1dc36d","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:f9953096a82c6700da6071f175d797fea2a5f9a27b49609744ae107724c9840c","observation_id":"7f1cea53-f874-4c94-9901-1654983e25e3","resolution":{"observed_at":"2026-05-17T18:02:02.758396Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.20493","last_updated":"2025-04-29T07:34:22Z","snapshot_observed_at":"2026-07-06T21:16:18.566725Z","submitted_at":"2025-04-29T07:34:22Z","title":"Token-Efficient Prompt Injection Attack: Provoking Cessation in LLM Reasoning via Adaptive Token Compression","version":1},"cited_work":{"arxiv_id":"2504.20493","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2504.20493","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Token-efficient prompt injection attack: Provoking cessation in LLM reasoning via adaptive token compression","venue":null,"work_id":"20b4ea9c-325e-4060-b3b5-1e1566d07427","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"cited_paper":"/paper/2504.20493","citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:602554a6428fe12a3b425dfd890e5e275180a972bd982686da5e9cb1fd5b4996","observation_id":"40e707ae-1686-42f8-a653-8d729ee20f00","resolution":{"observed_at":"2026-05-11T09:41:00.466332Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.07192","doi":"10.48550/arxiv.2510.07192","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T00:47:43.851468Z","title":"Poisoning attacks on llms require a near-constant number of poison samples","venue":null,"work_id":"60539e43-e946-4e78-b94e-8e9b741b1dc1","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:3a8c93ef25fd98762d36f99d2ac6128b210c5d13ac67b2b9b77e4697f8e93f10","observation_id":"4e3d6dd6-5798-4141-9e5c-f3a71aa59f40","resolution":{"observed_at":"2026-05-11T09:41:00.366632Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:33.362261+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:33.362261+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Adversarial training for free!","venue":null,"work_id":"e5698cd1-0836-44ea-a80e-de4d69e2d0c3","year":2019},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:086e2ee069b17cf9b5e2a71ab1f89a3c0821f3854a8ce34193a5aedd3d6e984d","observation_id":"45a44b9c-ac91-4639-b9b0-4b9f1d851381","resolution":{"observed_at":"2026-05-17T18:02:02.795329Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Amnesiac machine learning","venue":null,"work_id":"a3112fae-5742-45fa-b838-68a06c149868","year":2021},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:b9e896f2dad0a3e91ce192cb0f41035b5f29e28531c04e8f0072085087188240","observation_id":"c1d2003a-a1d7-4ef3-bcfe-9b2bb49aa241","resolution":{"observed_at":"2026-05-17T18:02:02.751809Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Membership inference attacks against machine learning models","venue":null,"work_id":"440e4021-89c0-41bf-970c-ee47b54e3d1d","year":2017},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:3ec779098dfad467edfaad06ecce30f7c6820bca676748aa8364636b04ae2435","observation_id":"bb794607-65bb-4515-ab46-ec0f478c43a5","resolution":{"observed_at":"2026-05-17T18:02:02.792570Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2504.09604","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Ackerman and Nina Panickssery","venue":null,"work_id":"6087171d-e0ae-4f03-9f6f-e06ca8653c9d","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:bc5f32286c9609f3a6d385389e4460f1faf25c28249f5b06969d5485fafb036c","observation_id":"3a0cd059-ed16-48ae-84d2-45ea7e2dab99","resolution":{"observed_at":"2026-05-11T09:41:00.406514Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"SelfDefend: LLMs can defend themselves against jailbreaking in a practical manner","venue":null,"work_id":"012f82c0-c7cc-48f2-8c2e-4cf98df6296e","year":2025},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:d12f880efcd045f4e872b10651e49d7ff9d4db1bb20b28037bb08fe1a6b5140e","observation_id":"3e2646fb-9dee-4921-9c2b-956ecad09058","resolution":{"observed_at":"2026-05-17T18:02:02.807796Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"A survey on in-context learning","venue":null,"work_id":"0d5bd021-0475-483e-8279-0bf6103dd009","year":2024},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:4ec304660a9f9b602c7df7dedb489db3e9b64a6141829d260cf5910254175f47","observation_id":"05402d42-fc70-4b25-af19-5c5434c6e40c","resolution":{"observed_at":"2026-05-17T18:02:02.765062Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Red teaming language models with language models","venue":null,"work_id":"9ca04a41-7dbe-4531-b6d8-9b4bfa4542bb","year":2022},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:8d7bd85522011587dca24fd89bbb4e0109c543d84dced2818d71cfa5a674872a","observation_id":"fc29c32f-22c0-42d5-9478-04311f7110ef","resolution":{"observed_at":"2026-05-17T18:02:02.761842Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Strip: A defence against trojan attacks on deep neural networks","venue":null,"work_id":"12f1a25e-1f5a-4018-9226-52303f4a5f7c","year":2019},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:476f54964b5e8f75c789af1fd5822d33d49fa23d2deb7bc9413f3c1df2824a81","observation_id":"10013782-d979-4cdf-a8d6-d3d5b5a3d67c","resolution":{"observed_at":"2026-05-17T18:02:02.740652Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.03987","last_updated":"2023-08-12T14:57:37Z","snapshot_observed_at":"2026-08-04T09:02:49.602701Z","submitted_at":"2023-07-08T14:25:57Z","title":"A Stitch in Time Saves Nine: Detecting and Mitigating Hallucinations of LLMs by Validating Low-Confidence Generation","version":2},"cited_work":{"arxiv_id":"2307.03987","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2307.03987","snapshot_observed_at":"2026-07-02T07:26:46.313156Z","title":"arXiv preprint arXiv:2307.03987 (2023)","venue":null,"work_id":"ed2401c9-d6cb-44af-8ff9-07841e73e642","year":2023},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"cited_paper":"/paper/2307.03987","citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:28a43ce47952e35289c1b7d8eb23878a89192eb8bdc046d6de8f40920c3c7765","observation_id":"bf5b1655-afab-417b-88e9-f3c814500768","resolution":{"observed_at":"2026-05-11T09:41:00.398146Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"DecodingTrust: A comprehensive assessment of trustworthiness in GPT models","venue":null,"work_id":"0fb5f3f3-00a8-4a03-bcac-1e43cb1fe2f2","year":2023},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:49898807d35bfb957e7f9234336d72d04f4b2ecf611e77e389f8544d1d40e489","observation_id":"b5fd5c6b-01a9-4196-9edf-fe856a1d2f1b","resolution":{"observed_at":"2026-05-17T18:02:02.749703Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2411.01077","last_updated":"2025-08-16T23:07:24Z","snapshot_observed_at":"2026-07-06T19:43:55.074449Z","submitted_at":"2024-11-01T23:18:32Z","title":"Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detection","version":5},"cited_work":{"arxiv_id":"2411.01077","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2411.01077","snapshot_observed_at":"2026-07-02T13:26:59.340136Z","title":"Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed Chi, Quoc V","venue":null,"work_id":"759aa1ba-429c-49a6-bfe5-46823c9810ea","year":2022},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"cited_paper":"/paper/2411.01077","citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:a33ae6bfe92c62a331cf966eee48e620e93170e5573deabf71a533f1ce5426d2","observation_id":"1bac7cee-21ce-49aa-9b01-83122f3bc2c9","resolution":{"observed_at":"2026-05-11T09:41:00.448352Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1911.03030","last_updated":"2023-11-08T03:57:25Z","snapshot_observed_at":"2026-07-06T08:35:25.887801Z","submitted_at":"2019-11-08T03:57:41Z","title":"Certified Data Removal from Machine Learning Models","version":6},"cited_work":{"arxiv_id":"1911.03030","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"1911.03030","snapshot_observed_at":"2026-07-04T19:40:06.859666Z","title":"Cer- tified data removal from machine learning models","venue":null,"work_id":"cc4c9aaf-15c1-4875-b678-e03473aa3112","year":1911},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"cited_paper":"/paper/1911.03030","citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:8af3afb6ca753abf08d3135277518d70d764d6d06b2db113631247f0e61babbf","observation_id":"44551253-064f-4a92-8988-1daf560d2621","resolution":{"observed_at":"2026-05-11T09:41:00.413001Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1811.03728","last_updated":"2018-11-09T01:08:00Z","snapshot_observed_at":"2026-07-06T07:13:39.005894Z","submitted_at":"2018-11-09T01:08:00Z","title":"Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering","version":1},"cited_work":{"arxiv_id":"1811.03728","doi":null,"metadata_source":"pith","pith_arxiv_id":"1811.03728","snapshot_observed_at":"2026-07-04T21:00:09.063525Z","title":"Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering","venue":"cs.LG","work_id":"2e1136ed-bfba-455c-979e-f617263c8b5e","year":2018},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"cited_paper":"/paper/1811.03728","citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:785cb4f3bb8052fa58e7de5c7bc77e49c5e131a66e3bdff4290de66d1336d9a1","observation_id":"48367eca-1cbc-4b0f-83cd-540aaad00375","resolution":{"observed_at":"2026-05-11T09:41:00.428312Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Extracting training data from large language models","venue":null,"work_id":"ebf1803a-1f33-4afb-94e5-22b787ce4261","year":2021},"citing_paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-05-10T15:54:24.013408Z"},"links":{"citing_paper":"/paper/2604.12548"},"observation_digest":"sha256:17ff95222fbe5d36b2c850c12a6e02380fcdcc72885ab7fdd4c5a397a1ec5ab9","observation_id":"a51664cd-4d30-4cbf-836f-543a326db8cf","resolution":{"observed_at":"2026-05-17T18:02:02.768647Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-04T06:34:03.388597+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2604.12548","last_updated":"2026-04-14T10:20:15Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-06T23:00:41.835763Z","submitted_at":"2026-04-14T10:20:15Z","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection"},"reference_resolution":{"displayed":37,"state_counts":{"malformed_identifier":0,"metadata_mismatch":5,"parse_uncertain":0,"unresolved":0,"verified_exact":8,"verified_fuzzy":24},"total_outbound_references":37},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-04T06:34:03.388597+00:00","source":"crossref"},{"observed_at":"2026-08-04T06:33:57.428241+00:00","source":"retraction_watch"}],"thesis":"As of 4 August 2026, this Paper Citation Record lists 37 of 37 outbound references and 0 inbound Pith citation observations for arXiv:2604.12548."}