{"as_of":"2026-08-12T23:30:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:a7c4b8f7f947592d047407c6ab276512e34e68207e562fa7d0af271a70ce7478","coverage":[{"denominator":48,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":48,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-13T07:53:06.928500Z","state":"measured"},{"denominator":50,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":50,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-12T06:34:41.77262+00:00","state":"measured"},{"denominator":2,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":2,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-03T20:38:16.610310Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-07-03T20:38:54.897445Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"cited_work":{"arxiv_id":"2605.05630","doi":null,"metadata_source":"pith","pith_arxiv_id":"2605.05630","snapshot_observed_at":"2026-07-03T20:38:54.897445Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","venue":"cs.CL","work_id":"4cc3fd97-464f-469b-82c1-68398f36d5f4","year":2026},"citing_paper":{"arxiv_id":"2606.02423","last_updated":"2026-06-01T16:01:37Z","snapshot_observed_at":"2026-07-06T23:42:49.173711Z","submitted_at":"2026-06-01T16:01:37Z","title":"Investigating and Alleviating Harm Amplification in LLM Interactions","version":1},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-06-28T14:31:52.027889Z"},"links":{"cited_paper":"/paper/2605.05630","citing_paper":"/paper/2606.02423"},"observation_digest":"sha256:726ada7789de09b77bb6dee16f77cc09be7c92d50ccd4704f9fec18d2021b004","observation_id":"c0df8b7e-8afc-435d-917b-790524933707","resolution":{"observed_at":"2026-07-01T23:16:24.014149Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"cited_work":{"arxiv_id":"2605.05630","doi":null,"metadata_source":"pith","pith_arxiv_id":"2605.05630","snapshot_observed_at":"2026-07-03T20:38:54.897445Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","venue":"cs.CL","work_id":"4cc3fd97-464f-469b-82c1-68398f36d5f4","year":2026},"citing_paper":{"arxiv_id":"2607.01277","last_updated":"2026-07-01T06:36:29Z","snapshot_observed_at":"2026-08-05T18:03:53.977353Z","submitted_at":"2026-07-01T06:36:29Z","title":"Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-07-03T20:38:16.610310Z"},"links":{"cited_paper":"/paper/2605.05630","citing_paper":"/paper/2607.01277"},"observation_digest":"sha256:f53b3f7441dfbd583274fcd28ee3fc1ddfdf1ae0531005675c8bf34d3536ccc2","observation_id":"ca7c218f-c25e-460d-b32d-cbeab855beed","resolution":{"observed_at":"2026-07-03T20:38:54.898605Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2605.05630/citation-record","integrity":"/paper/2605.05630/integrity","json":"/paper/2605.05630/citation-record.json","paper":"/paper/2605.05630"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2212.08073","last_updated":"2022-12-15T06:19:23Z","snapshot_observed_at":"2026-08-02T04:53:58.766070Z","submitted_at":"2022-12-15T06:19:23Z","title":"Constitutional AI: Harmlessness from AI Feedback","version":1},"cited_work":{"arxiv_id":"2212.08073","doi":"10.48550/arxiv.2212.08073","metadata_source":"pith","pith_arxiv_id":"2212.08073","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Constitutional AI: Harmlessness from AI Feedback","venue":"cs.CL","work_id":"faaaa4e0-2676-4fac-a0b4-99aef10d2095","year":2022},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2212.08073","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:ea241ec012ca7aa1edd38fbabdd3f85438a692d2b565e2ef4cbaf93755728840","observation_id":"9f5c8bdc-7917-4bd1-a9c0-c5ad354326d6","resolution":{"observed_at":"2026-05-13T07:57:31.632110Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-01T07:38:15.114855+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-01T07:38:15.114855+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Universal jailbreak backdoors in large language model alignment","venue":null,"work_id":"ca572749-7bec-41e5-918d-759a4ee990d2","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:604c012b50fd2baeafcb9a2a0196e12eedb6baf73c16b6e4cea831fba9a8ff77","observation_id":"75916d8e-9faf-45f0-ba37-6e3740459295","resolution":{"observed_at":"2026-05-13T07:57:32.927124Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.06414","last_updated":"2026-04-20T20:58:30Z","snapshot_observed_at":"2026-08-10T17:13:42.931667Z","submitted_at":"2025-06-06T17:33:33Z","title":"Benchmarking Misuse Mitigation Against Covert Adversaries","version":2},"cited_work":{"arxiv_id":"2506.06414","doi":null,"metadata_source":"pith","pith_arxiv_id":"2506.06414","snapshot_observed_at":"2026-07-01T19:56:11.082168Z","title":"Benchmarking Misuse Mitigation Against Covert Adversaries","venue":"cs.CR","work_id":"a15eef5b-46a8-4bbb-927b-7919563e3c99","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2506.06414","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:27f07dfeb96dc5ab448379f57ad006f3a4da08319b70eacb22663aa9846fa7fb","observation_id":"89fca9b5-dff1-44c3-b1f4-b4a2b595b5b8","resolution":{"observed_at":"2026-05-13T07:57:31.664087Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"When llm meets drl: Advancing jailbreaking efficiency via drl-guided search.Advances in Neural Information Processing Systems, 37:26814–26845","venue":null,"work_id":"06895f56-f976-4572-b0d3-1bc454ba5aff","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:b5a59688e981ffa89100970a7cb7eca9a3fdcd82e41fce4e593d3422e02d43bc","observation_id":"f78f678a-2c6d-4ebe-a168-2cb0d8d6e3bc","resolution":{"observed_at":"2026-05-13T07:57:32.942266Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.10701","last_updated":"2024-08-20T09:58:01Z","snapshot_observed_at":"2026-08-12T23:00:50.969137Z","submitted_at":"2024-08-20T09:58:01Z","title":"Ferret: Faster and Effective Automated Red Teaming with Reward-Based Scoring Technique","version":1},"cited_work":{"arxiv_id":"2408.10701","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2408.10701","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Ferret: Faster and effective automated red teaming with reward-based scoring technique.CoRR, abs/2408.10701","venue":null,"work_id":"ed578ba6-d3f0-4094-8054-35e33911a7de","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2408.10701","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:76200d4f7251f83037fefb2a4d1c2009f57fb3e9f63226a8757637a1752dc1a2","observation_id":"ebfb0e98-c9e9-4ab2-ab72-55cff24707fb","resolution":{"observed_at":"2026-05-13T07:57:31.645187Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily.North American Chapter of the Association for Computational Linguistics","venue":null,"work_id":"2f8f9410-d7ad-477a-92dd-093656103ea7","year":2023},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:b7581881d52f347cf84e0f572d8b9f7c10d84a45b181455a4fa2f8ae2797b32c","observation_id":"9db8f46f-217b-4543-a34b-6eecedbc27b8","resolution":{"observed_at":"2026-05-13T07:57:32.934902Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Attacks, defenses and evaluations for llm conversation safety: A survey","venue":null,"work_id":"c894db6b-0364-4115-9f30-5eeb873af712","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:6ba04c4f0722d80352795169e28f691b45716448920c694f6431de1c2a4b21a3","observation_id":"b3857975-e69f-46fd-8694-7540a07137d1","resolution":{"observed_at":"2026-05-13T07:57:32.930908Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16339","last_updated":"2025-01-08T20:11:59Z","snapshot_observed_at":"2026-08-11T10:38:35.302365Z","submitted_at":"2024-12-20T21:00:11Z","title":"Deliberative Alignment: Reasoning Enables Safer Language Models","version":2},"cited_work":{"arxiv_id":"2412.16339","doi":"10.48550/arxiv.2412.16339","metadata_source":"arxiv_reference","pith_arxiv_id":"2412.16339","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Y ., Joglekar, M., Wallace, E., Jain, S., Barak, B., Heylar, A., Dias, R., Vallone, A., Ren, H., Wei, J., et al","venue":"arXiv (Cornell University)","work_id":"900d0032-4aa1-4b47-ab57-616164d48b88","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2412.16339","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:e6d2c2a486fc2631887b24893b3a0ea9420527f79249dc93373d19badf6cfbfa","observation_id":"e132bfc6-f458-4968-bb02-2054c8aeab10","resolution":{"observed_at":"2026-05-13T07:57:31.670860Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-07-15T18:20:37.325806+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T18:20:37.325806+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Mtsa: Multi-turn safety alignment for llms through multi-round red-teaming","venue":null,"work_id":"28791da2-d679-429a-88cf-e5c690c7604a","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:c8f90189da04f39e837c0eeada27606a5f2a94575d84f3718f3870ca717b5836","observation_id":"740b670b-74a2-40ad-8cec-4fe7e4eb5134","resolution":{"observed_at":"2026-05-13T07:57:32.923013Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Harmful prompt classification for large language models","venue":null,"work_id":"1fb8f212-4310-4272-b692-b397dba01243","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:4c338df352e21fd00ce5cf08c09a5bd59d885feafe474798d7237e01ba4cac92","observation_id":"36150d7d-2fb5-4921-943f-46c053fd6e4f","resolution":{"observed_at":"2026-05-13T07:57:32.919510Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06674","last_updated":"2023-12-07T19:40:50Z","snapshot_observed_at":"2026-07-06T17:00:00.321552Z","submitted_at":"2023-12-07T19:40:50Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","version":1},"cited_work":{"arxiv_id":"2312.06674","doi":"10.3390/info16050365","metadata_source":"pith","pith_arxiv_id":"2312.06674","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","venue":"cs.CL","work_id":"93844332-869b-448c-a1be-35466150b1b2","year":2023},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2312.06674","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:de5a7e078b07cdfdc6e5306927bbe49b24fd58d59619e8b34d3b788291863e51","observation_id":"3c4d917c-6b4a-485c-a223-a63e1132a81d","resolution":{"observed_at":"2026-05-13T07:57:31.591542Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models","venue":null,"work_id":"a60d2419-328a-4ca0-8a1f-62652836952d","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:93f8db54a120abc5644f1469839047769e0caaa7eb32fcb3f0bed8b00f8f3185","observation_id":"0959dda4-fb4d-4767-9404-06500551d91b","resolution":{"observed_at":"2026-05-13T07:57:32.915722Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2402.03299","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-01T12:45:44.888794Z","title":"Guard: Role-playing to gener- ate natural-language jailbreakings to test guide- line adherence of large language models","venue":null,"work_id":"b3144468-9149-4233-b22b-2cec98219fb8","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:98056e1b46db3b5b769f8b9f780676eca4136f381b0e9e08a8070d1299533db3","observation_id":"d9d7d05f-fe85-4681-a27b-535e3a84c147","resolution":{"observed_at":"2026-05-13T07:57:31.609669Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Mdagents: An adaptive collaboration of llms for medical decision-making.Advances in Neural Information Processing Systems, 37:79410–79452","venue":null,"work_id":"12db0fcd-65da-4d49-8a25-685dd77e43da","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:267900906fe921bfe97806b81e73aa1c106e86875640bd5cb66d5bc8296b7230","observation_id":"e02d5534-5ac1-45f0-a59b-e841c7e3c46a","resolution":{"observed_at":"2026-05-13T07:57:32.900019Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Drattack: Prompt de- composition and reconstruction makes powerful llms jailbreakers","venue":null,"work_id":"897b809a-5423-4984-b436-8557fa5755d2","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:27cfcbbb6206745b3632614680c6c374e0099b1fddd4a2cfca11264584432cff","observation_id":"0299db71-2a34-44ef-ac66-3c611e44fb7b","resolution":{"observed_at":"2026-05-13T07:57:32.903591Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"AutoDAN: Generating stealthy jailbreak prompts on aligned large language models","venue":null,"work_id":"47020531-e352-4787-8c0f-77f24b2c8584","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:c4287642d9e43eff6437f96d2f30aa7481622775eed0f6e03f3242ea1b624257","observation_id":"06c9a443-6878-4a9d-bbee-fd494ae0ca8a","resolution":{"observed_at":"2026-05-13T07:57:32.896605Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2408.06292","last_updated":"2024-09-01T00:41:18Z","snapshot_observed_at":"2026-07-06T18:59:43.564435Z","submitted_at":"2024-08-12T16:58:11Z","title":"The AI Scientist: Towards Fully Automated Open-Ended Scientific Discovery","version":3},"cited_work":{"arxiv_id":"2408.06292","doi":"10.48550/arxiv.2408.06292","metadata_source":"pith","pith_arxiv_id":"2408.06292","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"The AI Scientist: Towards Fully Automated Open-Ended Scientific Discovery","venue":"cs.AI","work_id":"56b6b58d-e73a-4317-896e-36ac5f84e957","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2408.06292","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:057b28027abcaf9c5c8f6e1c929a71e640f0c9c8052ec87ffa0e93ad220db56a","observation_id":"bdf3ec43-17a0-4847-beac-d294515311dc","resolution":{"observed_at":"2026-05-13T07:57:31.578976Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-05-25T19:23:20.611352+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-25T19:23:20.611352+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"MALicious INTent dataset and inoculating LLMs for enhanced disinformation detection","venue":null,"work_id":"8219e386-0ddf-4e20-9f04-939faeadff66","year":2026},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:63ab76b66ba9070f30ddbdd8fe52dc02b7c65de12275d7e52d25ed09fa5dcbca","observation_id":"9ed64086-8e57-4d7a-9161-0749add5e415","resolution":{"observed_at":"2026-05-13T07:57:32.906987Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2505.01315","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Helping big language models protect themselves: An enhanced filtering and summariza- tion system.arXiv preprint arXiv:2505.01315","venue":null,"work_id":"3427b80b-60f1-4ded-8439-2f0ecb5fb611","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:58a16fe6c535e2067a01165b6c303a1b019abb6c39b187392b92ffb41f4bb10a","observation_id":"0dd0f639-04ef-4738-86a4-6e6dbe736f4b","resolution":{"observed_at":"2026-05-13T07:57:31.567279Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-09T18:16:26.555721Z","title":"Training language models to follow instructions with human feedback.Advances in neural information processing systems, 35:27730–27744","venue":null,"work_id":"aa3e2ba7-4265-495b-8612-615b2ddc9991","year":2022},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:93684add9d2e46ce6129b5c95bf746de00e3d0f8cfc7fffbcbd260b00c0dbddf","observation_id":"f85ff8e8-28ef-4466-9364-237936a1a29c","resolution":{"observed_at":"2026-05-13T07:57:32.892763Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Under- standing and mitigating overrefusal in llms from an unveiling perspective of safety decision boundary","venue":null,"work_id":"a025adf6-ab31-4fd6-abfe-feee3039bc77","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:c9386cd9677f16b572188ba52ae36f4b61b99529653d5f3c5b20ce27685061c8","observation_id":"713e0187-0d59-4fe0-84d2-a0ab68997008","resolution":{"observed_at":"2026-05-13T07:57:32.888996Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.01606","last_updated":"2024-10-02T14:47:05Z","snapshot_observed_at":"2026-08-12T22:32:29.046663Z","submitted_at":"2024-10-02T14:47:05Z","title":"Automated Red Teaming with GOAT: the Generative Offensive Agent Tester","version":1},"cited_work":{"arxiv_id":"2410.01606","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2410.01606","snapshot_observed_at":"2026-07-04T19:50:11.139672Z","title":"Automated red teaming with goat: the generative offensive agent tester","venue":null,"work_id":"1344694e-7af1-4e8c-bf09-02845b6042d6","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2410.01606","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:f6e437398aba5133bc749ecd8b5bf9fc2826096b68bf60ddd7734c0aaf61ada5","observation_id":"b901169b-d343-4807-a2ae-f999b4192b6d","resolution":{"observed_at":"2026-05-13T07:57:31.620956Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.13203","last_updated":"2025-08-23T02:09:57Z","snapshot_observed_at":"2026-08-11T11:02:05.829392Z","submitted_at":"2025-04-15T16:11:28Z","title":"X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents","version":2},"cited_work":{"arxiv_id":"2504.13203","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2504.13203","snapshot_observed_at":"2026-07-03T06:07:41.476618Z","title":"X-teaming: Multi- turn jailbreaks and defenses with adaptive multi-agents","venue":null,"work_id":"14895b6e-e521-434c-b30f-db8fcc0f1232","year":2026},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2504.13203","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:ef4b2bc252e91d8880d3d04fd168f3753712bd4c9cad29002ab11be8d80856ab","observation_id":"e0e18198-5df1-4b24-a777-3fb36a7faae7","resolution":{"observed_at":"2026-05-13T07:57:31.626795Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2410.10700","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T06:29:38.110985Z","title":"Derail yourself: Multi-turn llm jailbreak attack through self- discovered clues","venue":null,"work_id":"ca3b7a31-c581-46ef-9a75-9955cc0a03fe","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:b528dc66af66bf9bf1c0b21d5bb9280ca15f31c15009ea4823ed7518b0b05a97","observation_id":"e906ecb5-360e-4186-a871-b4f3fba228e8","resolution":{"observed_at":"2026-05-13T07:57:31.678460Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Llms know their vulnerabilities: Uncover safety gaps through natural distribution shifts","venue":null,"work_id":"7a80a50f-6acb-41fc-a3c3-4b64c60afa5c","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:ce543d369852b524cdf7ffde55548e9bb0d849975e235090ba6f3edfc97e955f","observation_id":"12e04150-aa1e-4b4c-ae7d-b674abde3880","resolution":{"observed_at":"2026-05-13T07:57:32.881502Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-09T16:36:22.423469Z","title":"Xstest: A test suite for identifying exaggerated safety behaviours in large language models","venue":null,"work_id":"21d00f52-3082-4186-9cf0-44f5460160d4","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:3b9fe4425f2505365e09a840baaa4787b3c83356dfbf719126feff76e6b9b9a2","observation_id":"0036137a-b777-4228-b85a-73bf3fa6172c","resolution":{"observed_at":"2026-05-13T07:57:32.873952Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-06T01:31:44.629285Z","title":"Great, now write an article about that: The crescendo {Multi-Turn}{LLM} jailbreak attack","venue":null,"work_id":"3cec901a-bb57-4db3-8bdf-f4d165f6a8d3","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:ed65b8e8b5580f235ba457c42a94c3b21c92ac56c082013facf6ac2e65e780f7","observation_id":"01eb5443-436e-4bd2-8f16-e1629e75369a","resolution":{"observed_at":"2026-05-13T07:57:32.878068Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Llms in software security: A survey of vulnerability detection techniques and insights.ACM Computing Surveys, 58(5):1–35","venue":null,"work_id":"aaf30b20-30e2-458b-a124-801c384ee29d","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:b4bfa5bfa3f4444d600997132fe0a1bbb0964eb67995ea00a4d7b6352b4d6741","observation_id":"ee96c0bf-1e18-471d-836e-b1aa4f4c3912","resolution":{"observed_at":"2026-05-13T07:57:32.885365Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Safe in isolation, dangerous together: Agent-driven multi- turn decomposition jailbreaks on LLMs","venue":null,"work_id":"5c402672-5cef-474d-b687-19e60d79e142","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:4bd3bf0c0773d7544c9e6d7ee70b7b06d3835e68b516670281535a0f12b9bf86","observation_id":"c76ea605-4480-48fc-8fd8-f6a6cae98125","resolution":{"observed_at":"2026-05-13T07:57:32.869745Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-09T14:26:21.198691Z","title":null,"venue":null,"work_id":"c69dcc4d-85af-4249-accc-cbae1a0e230c","year":null},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:09b2053b28f0bba564a5503d5790c51cb3a2d45c2054ffcbff30875b00898c48","observation_id":"243e972b-6898-4523-b033-64922b8fe830","resolution":{"observed_at":"2026-05-13T07:57:32.864569Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"RoleBreak: Character hallucination as a jailbreak attack in role-playing systems","venue":null,"work_id":"89c95b55-f5a0-4b67-b81a-63ac4c6f90b2","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:874bc42b3f701df1647fab2f6f4c746f1e2d71631b53d40990c02ee2c247fc8a","observation_id":"bd9a4b83-5810-431f-ba96-96acd2a4195d","resolution":{"observed_at":"2026-05-13T07:57:32.860681Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.21598","last_updated":"2025-03-27T15:19:55Z","snapshot_observed_at":"2026-08-07T16:32:33.505759Z","submitted_at":"2025-03-27T15:19:55Z","title":"Prompt, Divide, and Conquer: Bypassing Large Language Model Safety Filters via Segmented and Distributed Prompt Processing","version":1},"cited_work":{"arxiv_id":"2503.21598","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2503.21598","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Prompt, Divide, and Conquer: Bypassing Large Language Model Safety Filters via Segmented and Distributed Prompt Processing","venue":null,"work_id":"cf0199b6-2ec7-44e2-8dfb-d766359d2369","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2503.21598","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:ce810f73b12e408238a5c114d7081dceec42511d6439372077d3f33df1f43ca6","observation_id":"75345be8-5153-4eac-b542-c5cd256fb9b1","resolution":{"observed_at":"2026-05-13T07:57:31.638947Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2506.05735","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Do llms really forget? evaluating unlearning with knowledge correlation and confidence awareness","venue":null,"work_id":"5d3249b1-d9ff-443f-8b45-85b42b618da1","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:c3db1af4490941d11208d248b520df1f905ad7844c3172638acf20a33b5917bb","observation_id":"a4363bf8-9826-416b-81c3-532ecf4351c3","resolution":{"observed_at":"2026-05-13T07:57:31.615277Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2512.01353","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-03T17:48:46.391290Z","title":"The trojan knowledge: Bypassing commercial LLM guardrails via harmless prompt weaving and adaptive tree search","venue":null,"work_id":"b73cd1e3-8b58-45f0-bc4b-4a0173b73c43","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:eb046e95a7f86087b5c737fdc118a52958b6ea13fa9c676e11294a3832824d7b","observation_id":"ea262b3d-35de-4b08-a360-b0c8b4fd9177","resolution":{"observed_at":"2026-05-13T07:57:31.598074Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.16667","last_updated":"2024-07-23T17:34:36Z","snapshot_observed_at":"2026-08-12T23:16:13.740391Z","submitted_at":"2024-07-23T17:34:36Z","title":"RedAgent: Red Teaming Large Language Models with Context-aware Autonomous Language Agent","version":1},"cited_work":{"arxiv_id":"2407.16667","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.16667","snapshot_observed_at":"2026-07-04T19:50:11.196920Z","title":"Redagent: Red teaming large language models with context-aware au- tonomous language agent.arXiv preprint arXiv:2407.16667","venue":null,"work_id":"d2f46e66-7014-4525-9685-d7b3a13d18a7","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2407.16667","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:7000afc469b1e4b8c748f5d90b984d5ae024893c77734864e2aa3d3b32a57a5f","observation_id":"6e07299f-5b16-43b2-8667-2130f86a1661","resolution":{"observed_at":"2026-05-13T07:57:31.572737Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Chain of attack: Hide your intention through multi-turn interrogation","venue":null,"work_id":"46e4d51c-83da-4d43-aa83-1048ed2ce8f5","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:4910a6d029f041335e6ae6fe54625e3f544efe8c7107d62ad62190b9684d5d89","observation_id":"c3dcbaeb-85bb-4a43-a5f8-3ee2b02e116f","resolution":{"observed_at":"2026-05-13T07:57:32.856337Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.02446","last_updated":"2024-01-27T22:54:52Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-03T21:30:56Z","title":"Low-Resource Languages Jailbreak GPT-4","version":2},"cited_work":{"arxiv_id":"2310.02446","doi":"10.48550/arxiv.2310.02446","metadata_source":"pith","pith_arxiv_id":"2310.02446","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Low-Resource Languages Jailbreak GPT-4","venue":"cs.CL","work_id":"e88f3256-3186-452b-ba46-58885055c4ec","year":2023},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2310.02446","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:ed7485462fc459b541478ba5a74f0785da996b22bc483f465eda08b06d4f1d03","observation_id":"b6d226c8-474d-485d-90d1-cdd3e69bc946","resolution":{"observed_at":"2026-05-17T09:24:14.203470Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.10949","last_updated":"2025-06-14T15:17:52Z","snapshot_observed_at":"2026-08-10T00:50:04.738479Z","submitted_at":"2025-06-12T17:50:58Z","title":"Monitoring Decomposition Attacks in LLMs with Lightweight Sequential Monitors","version":2},"cited_work":{"arxiv_id":"2506.10949","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2506.10949","snapshot_observed_at":"2026-07-02T03:06:29.875159Z","title":"2025 , journal =","venue":null,"work_id":"9ef86ea7-9856-4338-b1ec-0b501a2ed860","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2506.10949","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:c5e626b7287d2b298f55f20601bc42072ad38ee31736beab76e25e0fa8f1b2bb","observation_id":"bf6a401c-29f4-4f08-8bf5-5470b59922ae","resolution":{"observed_at":"2026-05-13T07:57:31.586472Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.05775","last_updated":"2026-07-27T20:50:40Z","snapshot_observed_at":"2026-08-10T01:02:48.484224Z","submitted_at":"2025-08-07T18:42:16Z","title":"Guardians and Offenders: A Survey on Harmful Content Generation and Safety Mitigation of LLM","version":3},"cited_work":{"arxiv_id":"2508.05775","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2508.05775","snapshot_observed_at":"2026-07-29T00:24:32.402891Z","title":"Guardians and offenders: A survey on harmful content generation and safety mitigation of llm","venue":null,"work_id":"2759a7a3-ff77-4531-92a0-e72ce18d644c","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2508.05775","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:f9f3cbcd4ca11a80d47631ea74a5791dc39d8a9e3b4cb844b3647ad2127713c4","observation_id":"9c3d6022-748a-4c66-b3d8-d7f6c01daa7a","resolution":{"observed_at":"2026-07-29T00:24:32.402891Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"DAMON: A dialogue-aware MCTS framework for jailbreaking large language models","venue":null,"work_id":"8fcb6284-87c7-4f45-b5f5-6c7eb10cb644","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:a9c5e00c3602f482a6884011e0d80cad3874ae154ebe6d314f803dd3c65c817b","observation_id":"341417bf-ea3e-42fd-848f-2951adf7dca5","resolution":{"observed_at":"2026-05-13T07:57:32.848385Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-09T10:26:11.302207Z","title":"Intention analysis makes llms a good jailbreak defender","venue":null,"work_id":"d9feb0eb-2f39-4a76-927e-e8d3c25540e0","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:72c434f0fa19d4c2b1f24313ec63ed04a5172c59526d21065169e6e10ee6309f","observation_id":"1e128392-699d-478e-ab93-85e4a71fffb3","resolution":{"observed_at":"2026-05-13T07:57:32.844494Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"e9df0b35-7baa-4133-92c0-45a9f83b794d","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:302c5c1555c33af6c9e6573a3af8e9a13f1ee2f366be91ab2c8378eea791da1c","observation_id":"b0573178-2b7b-428d-b7be-9ecaef243605","resolution":{"observed_at":"2026-05-13T07:57:32.851910Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.14276","last_updated":"2025-10-16T04:00:18Z","snapshot_observed_at":"2026-07-06T22:32:47.087967Z","submitted_at":"2025-10-16T04:00:18Z","title":"Qwen3Guard Technical Report","version":1},"cited_work":{"arxiv_id":"2510.14276","doi":"10.48550/arxiv.2510.14276","metadata_source":"pith","pith_arxiv_id":"2510.14276","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Qwen3Guard Technical Report","venue":"cs.CL","work_id":"de1c5964-d29a-456c-97cc-30684b243a85","year":2025},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2510.14276","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:9bc2429e023c81445115163e6eaf432002978b7c7b12ca60e5b6b33d7ead128d","observation_id":"dfe079d6-5def-4232-8c0e-88f2c01d0992","resolution":{"observed_at":"2026-05-13T22:33:37.835217Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"How alignment and jailbreak work: Explain llm safety through intermediate hidden states","venue":null,"work_id":"0b0d39e5-9356-4704-86a7-c543d66ac55f","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:c51706d31a7cf5862187abba9451244b1d3c70ba3bbcbdd4cb912a71ed48605b","observation_id":"a39de01f-bfe8-44e8-a071-c5bf51f894c7","resolution":{"observed_at":"2026-05-13T07:57:32.911223Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Improving alignment and robustness with circuit breakers.Advances in Neural Information Processing Systems, 37:83345– 83373","venue":null,"work_id":"6387ad0b-0d0b-4e6d-87a5-ce3e04b0bfb5","year":2024},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:9bb2b3dad31c24fa34d9b42703e0c7a1d90ecab8c650cbd3c2e45a87afb40e9d","observation_id":"b9478d0c-3645-425a-a4ed-d18a15886c46","resolution":{"observed_at":"2026-05-13T07:57:32.835812Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":"2307.15043","doi":"10.48550/arxiv.2307.15043","metadata_source":"pith","pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","venue":"cs.CL","work_id":"3322fa86-1768-4677-8425-dd326b45e078","year":2023},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:c22f529abc3c5c17d5e6d2baef8d9570b4d6486d4f76d0c0268337a152139176","observation_id":"98d77232-8e32-4708-a8e0-2d753668b23d","resolution":{"observed_at":"2026-05-13T07:57:31.603876Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-15T23:50:40.271168+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"c84664a0-9efe-47a1-b9a6-20586e0fdb20","year":null},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:c88273512f0d6c1210275352db7d555dfda52f001219c3726e47940a4be9fe62","observation_id":"5aea485c-9738-47f5-9723-071b12d54600","resolution":{"observed_at":"2026-05-13T07:57:32.831853Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"index\" (0-based)","venue":null,"work_id":"fac8f1d8-dde9-47fc-84a0-c5a8699f5105","year":null},"citing_paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue","version":2},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-05-13T07:53:06.928500Z"},"links":{"citing_paper":"/paper/2605.05630"},"observation_digest":"sha256:73edbd8780cb7a298da8f9a2d9c0a5f684442e7b550595daa27d485f88a4d466","observation_id":"327ab0f2-d5ec-49bb-b311-9e03c137afbb","resolution":{"observed_at":"2026-05-13T07:57:32.840740Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2605.05630","last_updated":"2026-05-12T16:52:21Z","latest_version":2,"primary_category":"cs.CL","snapshot_observed_at":"2026-08-11T16:37:02.295676Z","submitted_at":"2026-05-07T03:35:31Z","title":"One Turn Too Late: Response-Aware Defense Against Hidden Malicious Intent in Multi-Turn Dialogue"},"reference_resolution":{"displayed":48,"state_counts":{"malformed_identifier":0,"metadata_mismatch":3,"parse_uncertain":0,"unresolved":3,"verified_exact":17,"verified_fuzzy":25},"total_outbound_references":48},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"thesis":"As of 12 August 2026, this Paper Citation Record lists 48 of 48 outbound references and 2 inbound Pith citation observations for arXiv:2605.05630."}