{"as_of":"2026-08-07T05:47:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:130317e86f4b489e99f0cf71f3c9ee8e61d8655e2c8b381f1e2535d8496416f2","coverage":[{"denominator":96,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":96,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T00:32:05.231888Z","state":"measured"},{"denominator":96,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":96,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-06T06:34:29.942622+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.01117/citation-record","integrity":"/paper/2608.01117/integrity","json":"/paper/2608.01117/citation-record.json","paper":"/paper/2608.01117"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:55.514906Z","title":"Training language models to follow instructions with human feedback,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:55.514906Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:2f8a7ede9988d16399742c3be1536cc8c38dbb19f3583c1769561da458db5ef3","observation_id":"c32d0f65-0d69-489c-9ff0-cb07f2ccfc5e","resolution":{"observed_at":"2026-08-06T00:31:55.514906Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.10813","last_updated":"2025-03-04T22:19:41Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-14T17:59:44Z","title":"LongMemEval: Benchmarking Chat Assistants on Long-Term Interactive Memory","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.10813","snapshot_observed_at":"2026-08-06T00:31:55.637427Z","title":"Longmemeval: Benchmarking chat assistants on long-term interac- tive memory,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:55.637427Z"},"links":{"cited_paper":"/paper/2410.10813","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:06e8b3c31cfc55a0df6bcf8f6139dcca0b0f92f636c5df10a28d8a97cd0d8ee0","observation_id":"cd82891b-c1ae-4ae3-b844-6d4fa39a3ae8","resolution":{"observed_at":"2026-08-06T00:31:55.637427Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:55.784784Z","title":"Evaluating llm-based agents for multi-turn conversations: A survey,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:55.784784Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:28d21c0980a115c34fabf589b2418dcd1d3291d83f786cba4fee88948d97bd98","observation_id":"7cf4770b-9453-4016-9da2-d844e599d76a","resolution":{"observed_at":"2026-08-06T00:31:55.784784Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:55.875537Z","title":"Asleep at the keyboard? assessing the security of github copilot’s code contributions,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:55.875537Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:dcddb6078c690bbdd3fb1f287c53863f858b4949975175a80ead56f61e025f2e","observation_id":"107e38ed-712a-419d-85e0-0507dde3a437","resolution":{"observed_at":"2026-08-06T00:31:55.875537Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:55.975024Z","title":"Lost at c: A user study on the security implications of large language model code assistants,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:55.975024Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:2e703322ca55ee5d5a8b1196b9021c1e1b763ee5d49083b74c7cff0c9e537083","observation_id":"97099a72-e91f-4f57-b75a-7eefc586c561","resolution":{"observed_at":"2026-08-06T00:31:55.975024Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:56.092950Z","title":"A survey on large language models for code generation,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:56.092950Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:a7e70d816898855c94d0d718a5ab1191f96e64cb998c8ff7dea868e9a9af1f41","observation_id":"3076b682-3e56-43ed-a759-6efd71551ece","resolution":{"observed_at":"2026-08-06T00:31:56.092950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:56.211615Z","title":"Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:56.211615Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:ccacf89487b24f2a9bf0c6fd1a214451869086374dd6b3004a979fcba7dd54c9","observation_id":"55dc6c33-1b30-438c-8ed6-44eed6e324d7","resolution":{"observed_at":"2026-08-06T00:31:56.211615Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.05451","last_updated":"2024-11-08T09:58:02Z","snapshot_observed_at":"2026-07-06T19:47:21.547159Z","submitted_at":"2024-11-08T09:58:02Z","title":"WorkflowLLM: Enhancing Workflow Orchestration Capability of Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.05451","snapshot_observed_at":"2026-08-06T00:31:56.329166Z","title":"Workflowllm: Enhancing workflow orchestration capability of large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:56.329166Z"},"links":{"cited_paper":"/paper/2411.05451","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:bdfd17c93d91f9abcdd291710b5c8adbcb5c992ce4598b5ef4cd35b035b583a1","observation_id":"a2029bb6-0699-46e5-a514-291b31988b8d","resolution":{"observed_at":"2026-08-06T00:31:56.329166Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:56.406535Z","title":"Agent security bench (asb): Formalizing and benchmark- ing attacks and defenses in llm-based agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:56.406535Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:b9b8db10cd81ac27774520886921059eed99e5b62889f11fc9387966503539c8","observation_id":"cbf01be6-2260-4685-b781-8e80b89937c9","resolution":{"observed_at":"2026-08-06T00:31:56.406535Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:56.526998Z","title":"Isolategpt: An execution isolation architecture for llm-based agentic systems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:56.526998Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:a04a5220b6b5464aa56c0083d9490f6f1b0669ed4c2099e19e623184c9026dbd","observation_id":"00a3030a-f506-45f2-99f2-4f8c3aba4af9","resolution":{"observed_at":"2026-08-06T00:31:56.526998Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:56.648922Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:56.648922Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:c42e635a8cc966e39ecc9bd126ecb4fc43a4ab6b935049c68a6bf2c173c846e5","observation_id":"294706d6-3404-4cd6-a2af-2386fbb77804","resolution":{"observed_at":"2026-08-06T00:31:56.648922Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:56.724764Z","title":"A survey on agentic security: Applications, threats and defenses,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:56.724764Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:18ac301640303bbe784c1e7203031b09b1fa6b1dfa9c75f91179e0e5c3308ca8","observation_id":"57277511-3f49-40d6-8416-6bc08c094404","resolution":{"observed_at":"2026-08-06T00:31:56.724764Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:56.872871Z","title":"Ai agents under threat: A survey of key security challenges and future pathways,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:56.872871Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:ea0b6ad80dda177cb340551245afd75bcf384371732e1c8ed5a8e1474f4fe7e5","observation_id":"170be5de-46f6-4207-a713-99b883c15d5e","resolution":{"observed_at":"2026-08-06T00:31:56.872871Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:56.987406Z","title":"Jailbroken: How does llm safety training fail?","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:56.987406Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:c9f4204cf45d42035108c9e40a6320cdc6ce4450bc447d025c6848f91280e484","observation_id":"c9361ab2-8938-4ab0-9d3b-f02beb5b963b","resolution":{"observed_at":"2026-08-06T00:31:56.987406Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:57.101800Z","title":"Malla: Demystifying real-world large language model integrated malicious services,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:57.101800Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:c0c3870c292d14ae1f7dbee356a857e8f4e883134afa8f0da608c6abde5c2c6e","observation_id":"eab0f278-d10d-438e-813b-2401a695d349","resolution":{"observed_at":"2026-08-06T00:31:57.101800Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:57.218426Z","title":"Gptracker: A large- scale measurement of misused gpts,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:57.218426Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:68049d3249f76ce35ede437ab8555f7a27d3efd547a22649a3c87a08c8d6da3b","observation_id":"fa50e402-3b42-4b94-9033-1fb12224bd83","resolution":{"observed_at":"2026-08-06T00:31:57.218426Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:57.300020Z","title":"Don’t listen to me: Understanding and exploring jailbreak prompts of large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:57.300020Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:081b1d601dfb2cfd2efc4c5912211a68bf54b1cd2d7cd029d69816dac7de6d67","observation_id":"038be16a-9700-4916-9d97-d048760d7abb","resolution":{"observed_at":"2026-08-06T00:31:57.300020Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:57.413110Z","title":"A survey on large language model (llm) security and privacy: The good, the bad, and the ugly,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:57.413110Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:43edfc3ccd11e3516dd8be5b9e4f3b13bac97a4dccf3679bc0864be11bfe1880","observation_id":"60dbaa07-8da6-4ee7-9aca-fd1c3509bd56","resolution":{"observed_at":"2026-08-06T00:31:57.413110Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:57.441651Z","title":"From chatbots to phishbots?: Phishing scam generation in commercial large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:57.441651Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:f53ab22940bf93d9b8ba57b003b954eebf6cd755d2aaa89d6ab3e319c0eab5f9","observation_id":"78956061-563d-4bdb-b0e7-1ca23eca0450","resolution":{"observed_at":"2026-08-06T00:31:57.441651Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.08073","last_updated":"2022-12-15T06:19:23Z","snapshot_observed_at":"2026-08-02T04:53:58.766070Z","submitted_at":"2022-12-15T06:19:23Z","title":"Constitutional AI: Harmlessness from AI Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.08073","snapshot_observed_at":"2026-08-06T00:31:57.515679Z","title":"Constitutional AI: Harmlessness from AI feedback,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:57.515679Z"},"links":{"cited_paper":"/paper/2212.08073","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:5b29a6a46db1c8b1673f30250dcb3ee7325f5f244577cdb0809d80de12a4a7d5","observation_id":"8060fc06-a6e4-4195-b008-5e04a5731d9f","resolution":{"observed_at":"2026-08-06T00:31:57.515679Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.536567Z","title":"Improving llm safety alignment with dual-objective optimization,","venue":null,"work_id":"73f4c2e3-71cf-42f1-989a-c6568d9e72c1","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:57.641455Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:d0eb81b9a59b1799db866f7f932fc9a8c67927324e9573ff94f2df9c7e6415b5","observation_id":"73063fe6-64c2-48a2-b150-135e3e1c7b4f","resolution":{"observed_at":"2026-08-06T00:32:12.545421Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.510935Z","title":"Fine-tuning aligned language models compromises safety, even when users do not intend to!","venue":null,"work_id":"57452504-8c14-44c5-87ec-1ab91f2b0855","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:57.801433Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:1cddabd92031d7a48889c415165da4643a786a043cef0ba528861b67eacdf2c4","observation_id":"03f8496c-c33c-4731-b267-3c85ee7978a7","resolution":{"observed_at":"2026-08-06T00:32:12.521615Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.487852Z","title":"Harmbench: a standardized evaluation framework for automated red teaming and robust refusal,","venue":null,"work_id":"8d486324-9d91-43b6-9bc2-1a6d20d59743","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:57.966371Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:ef48c0d0f91d05eb9526dab12ce21abce43937ba64872c25d24f4ab7efd929df","observation_id":"f0b4a246-1771-4366-950b-a6ea4fb9a2d4","resolution":{"observed_at":"2026-08-06T00:32:12.496713Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.465005Z","title":"Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models,","venue":null,"work_id":"64f6ab5f-b1e9-4034-bc67-612b2b0f9e99","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:58.093785Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:28e39781c4d530d92cd765d8b09f9f519dd93d92c25bfb8158fa235489d78926","observation_id":"b3bf5573-465f-4cc6-a3df-eca75d6a31ef","resolution":{"observed_at":"2026-08-06T00:32:12.472015Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.446396Z","title":"Improving alignment and robustness with circuit breakers,","venue":null,"work_id":"b86b702b-26e8-4e7f-a961-d061d63a1c4b","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:58.197875Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:57cd82622920744ec2d9ae5480ef466e1ba85c8b8276bbf1e8e1994fdca8a8db","observation_id":"5b131fb9-1d32-43d0-b2c8-84fee66d32eb","resolution":{"observed_at":"2026-08-06T00:32:12.452404Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.07932","last_updated":"2024-05-14T15:56:37Z","snapshot_observed_at":"2026-07-06T18:13:42.288757Z","submitted_at":"2024-05-13T17:08:42Z","title":"PARDEN, Can You Repeat That? Defending against Jailbreaks via Repetition","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.07932","snapshot_observed_at":"2026-08-06T00:31:58.285828Z","title":"Parden, can you repeat that? defending against jailbreaks via repetition,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:58.285828Z"},"links":{"cited_paper":"/paper/2405.07932","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:6f59c0e5ac872354569f0674321322f03c7ba1c7c10681fc16a928d824ec3eef","observation_id":"0a567a2d-8569-43b6-b558-250895a07e85","resolution":{"observed_at":"2026-08-06T00:31:58.285828Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:58.376585Z","title":"On large language models’ resilience to coercive interrogation,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:58.376585Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:8e038af826ca538ac9bcccf4bb2dc6568275c1d7c6a4d7f3603c97a9aac2da23","observation_id":"7b6a9354-23ae-494b-b36b-e17cfdf33fe1","resolution":{"observed_at":"2026-08-06T00:31:58.376585Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.415688Z","title":"You only prompt once: On the capabilities of prompt learning on large language models to tackle toxic content,","venue":null,"work_id":"e7d30937-caf0-4575-9a47-63a1fa128fd1","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:58.486508Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:687402c120dc3b36b2d0b88baa5364b6f5cccf885f17353841b42fa7c8d1de43","observation_id":"607fab59-35c0-40d8-bccb-8fae18d893b3","resolution":{"observed_at":"2026-08-06T00:32:12.421869Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.396448Z","title":"{LLM-Fuzzer}: Scaling as- sessment of large language model jailbreaks,","venue":null,"work_id":"95a7882c-94f3-4950-b2de-658fc59b241a","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:58.604802Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:199a898f126b274e59dc97b9b6294b62998222a320f930bd5f903433461d8bf1","observation_id":"97d673b5-a034-4a14-b363-f1f52f210252","resolution":{"observed_at":"2026-08-06T00:32:12.403495Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.368489Z","title":"Mind the inconspicuous: Revealing the hidden weakness in aligned {LLMs}’refusal boundaries,","venue":null,"work_id":"6777d1f2-8e9e-4f47-b602-66da0298e0a9","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:58.660865Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:13f319aad06c5c2137b2ccf4b09fdbd642edac105da75d7dd9d8e96bfe4c0150","observation_id":"5702cdc3-0182-421c-ab3c-01beae57348e","resolution":{"observed_at":"2026-08-06T00:32:12.384412Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.347412Z","title":"Safety misalignment against large language models","venue":null,"work_id":"84e38bc7-76ec-4f6c-959b-8e36e36073dc","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:58.735355Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:55fe100f674298e7326e93b2ebe3200021dbafa3f04fdc1bba091dbce7ffcda9","observation_id":"63bf2d99-03d0-4d2b-9737-81695d561695","resolution":{"observed_at":"2026-08-06T00:32:12.354697Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.315642Z","title":"Refusal is not an option: Unlearning safety alignment of large language models,","venue":null,"work_id":"347c70ab-a13d-4c3b-8376-f37b39be07bb","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:58.818726Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:efcc2b34e2b55c5d3980029971f0e4fb8aeae21e03c9db6f9728d01ed3f06c29","observation_id":"95cc5bf5-3c65-4186-a227-0f87cad7268d","resolution":{"observed_at":"2026-08-06T00:32:12.322834Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.285775Z","title":"Mission impossible: A statistical perspective on jailbreaking llms,","venue":null,"work_id":"b6c22d7f-f887-47d2-89ff-3d9687eeab95","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:58.902116Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:8b11feecd28d666ab87350442f2f2feaacc903fc511a27335832d5a7f5935168","observation_id":"cbaabaae-24ed-4322-b4ec-65742247ef1c","resolution":{"observed_at":"2026-08-06T00:32:12.297721Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.195724Z","title":"A comprehensive study of jailbreak attack versus defense for large language models,","venue":null,"work_id":"e3869beb-e3b4-4cfa-a3cc-4f956672e4f6","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:59.106919Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:f4be50c1679f7455c5920302d5eeede832fe387ba02c4dcaf49a5fc3c1789f33","observation_id":"4f185973-70e3-4682-a0b9-95ae43890d1e","resolution":{"observed_at":"2026-08-06T00:32:12.245227Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.114749Z","title":"“do anything now","venue":null,"work_id":"6cb9203b-8770-43e8-b5e2-d168b22955f1","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:59.217860Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:e15781a24e7130f85ffee08d8444b593ad0d2d7a4a40b7b144a0f5f6415e1392","observation_id":"d11cbd9f-6724-4819-ac50-75b5cf13daed","resolution":{"observed_at":"2026-08-06T00:32:12.144803Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:12.037440Z","title":"{TwinBreak}: Jailbreak- ing{LLM}security alignments based on twin prompts,","venue":null,"work_id":"c44baee1-151d-4ac4-adbb-cf777aab9749","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:59.324764Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:572d32026c25c4ae0d35ce4e67e11317f938ea1e83aaeaebe82201564e32382d","observation_id":"4b5db5ce-47dc-452a-8e0e-c6cbdc633682","resolution":{"observed_at":"2026-08-06T00:32:12.073308Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-06T00:31:59.438314Z","title":"Universal and transferable adversarial attacks on aligned language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:59.438314Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:a271786cce977af93bfc016f08323d3c619f80c332e156692897588330fb5fe6","observation_id":"29beb297-5cc5-44cb-82c7-5a76d12c1f92","resolution":{"observed_at":"2026-08-06T00:31:59.438314Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:59.550901Z","title":"Jailbreaking black box large language models in twenty queries,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:59.550901Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:321a61302dbf41160006a11186be764d3608d1efbc4b04dc751cfaf67e4a811e","observation_id":"11b63b8b-e254-4c37-8a6c-8ed4a6a9cb93","resolution":{"observed_at":"2026-08-06T00:31:59.550901Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:31:59.629647Z","title":"Tree of attacks: Jailbreaking black- box llms automatically,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:59.629647Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:841de7ef211ad82f36120098f351064713f4aa76612f23aaa2bc37e44d8a66d1","observation_id":"249ac1dd-68a7-4ef4-b4b0-651d0878fecc","resolution":{"observed_at":"2026-08-06T00:31:59.629647Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.944172Z","title":"Making them ask and answer: Jailbreaking large language models in few queries via disguise and reconstruction,","venue":null,"work_id":"c941e017-679b-4804-bea4-93f19aec968f","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:59.696322Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:f1486d9065edc4df86d2f2319556b66e828bc1fc583ab4c9952399a71abd6215","observation_id":"ea90a336-85bc-43ba-a0c0-1ee8f387c924","resolution":{"observed_at":"2026-08-06T00:32:11.965032Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.867898Z","title":"Sneakyprompt: Jailbreaking text-to-image generative models,","venue":null,"work_id":"d557e875-76fe-4fb4-bc42-1959193b3cba","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:59.807161Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:a7eab7fdf0a7f14991b9ac394d592ae6cc3987d1fa12a686de4251de955fc58e","observation_id":"f739a255-c0a2-4b4d-b79e-156ba68e789a","resolution":{"observed_at":"2026-08-06T00:32:11.897782Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.798673Z","title":"Fuzz-testing meets llm- based agents: An automated and efficient framework for jailbreaking text-to-image generation models,","venue":null,"work_id":"97ac2461-e7bb-4e5d-bfd4-e6f0cb35ff76","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-06T00:31:59.918315Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:4008c26f6305647a81cc94cad14137efa0d1d727ec3ea1ca73433f48c43bcb54","observation_id":"8a562615-5a73-4fbb-8794-286120f838d3","resolution":{"observed_at":"2026-08-06T00:32:11.824151Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.736867Z","title":"Modifier unlocked: Jailbreak- ing text-to-image models through prompts,","venue":null,"work_id":"30dcf41f-c0c9-4769-bebd-8e3a29d874a1","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:00.012596Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:a69c43178cac850049d3d4e08063311f8bd6cde76c35047663c8b3ed4e380825","observation_id":"e7f34c33-4d5a-4f83-95c0-3c4f7292b930","resolution":{"observed_at":"2026-08-06T00:32:11.762977Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.15170","last_updated":"2025-08-01T10:42:39Z","snapshot_observed_at":"2026-08-06T23:59:49.274498Z","submitted_at":"2025-06-18T06:33:19Z","title":"From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.15170","snapshot_observed_at":"2026-08-06T00:32:00.146044Z","title":"From llms to mllms to agents: A survey of emerging paradigms in jailbreak attacks and defenses within llm ecosystem,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:00.146044Z"},"links":{"cited_paper":"/paper/2506.15170","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:2095d1122729ce559b15e6931174d7929c4f68b3b5845573df6ee668f06a7f10","observation_id":"183d512f-8525-4ef8-a2bf-694b927d5b79","resolution":{"observed_at":"2026-08-06T00:32:00.146044Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.664428Z","title":"Exposing the guardrails:{Reverse- Engineering}and jailbreaking safety filters in{DALL· E}{Text-to- Image}pipelines,","venue":null,"work_id":"0ad3326e-0f95-4b21-abb8-e6dfd51559bf","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:00.250823Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:55bbc9d80de85f65e38b2ea675e2ab9dee168da2883652114828658b7cb96253","observation_id":"859f1718-dc3d-40f5-a1d7-a871b7cc5e00","resolution":{"observed_at":"2026-08-06T00:32:11.692657Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.594352Z","title":"Jailbreaking llms: A survey of attacks, defenses and evaluation,","venue":null,"work_id":"ddf5dfa5-3c3a-4a51-abd0-f02d1d55bff8","year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:00.328425Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:c5deb0986df602a904f918970e81bd9e63597900afa92f7c96d6d5643dcb1b28","observation_id":"ec09ada3-3d7f-404b-9b02-48bfb673b00d","resolution":{"observed_at":"2026-08-06T00:32:11.621183Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.520285Z","title":"Surrogateprompt: Bypassing the safety filter of text-to-image models via substitution,","venue":null,"work_id":"1dc947ad-a479-4707-ad39-af11a8ac9cf3","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:00.424873Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:c56a972bfd11d62ca4631c13612252db4c6251b4eab20fc268940f942f536430","observation_id":"981c0708-ece5-4ac1-bbd4-364e0cf01a29","resolution":{"observed_at":"2026-08-06T00:32:11.549592Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.447784Z","title":"Jailbreakbench: An open robustness benchmark for jail- breaking large language models,","venue":null,"work_id":"89b0b1e4-1848-45c9-98de-222a35413515","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:00.502530Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:106c3b23985e8d7e13e1b1172fa2095058304dfca18c757b6090cef220b79fcc","observation_id":"54230e98-0de6-4e71-b28a-49d00c5cc524","resolution":{"observed_at":"2026-08-06T00:32:11.477370Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.06120","last_updated":"2025-05-09T15:21:44Z","snapshot_observed_at":"2026-08-02T13:06:07.304813Z","submitted_at":"2025-05-09T15:21:44Z","title":"LLMs Get Lost In Multi-Turn Conversation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.06120","snapshot_observed_at":"2026-08-06T00:32:00.631410Z","title":"Llms get lost in multi-turn conversation,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:00.631410Z"},"links":{"cited_paper":"/paper/2505.06120","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:623b19700aa31cfdf13417d81fa35531971568987faec088a9c887cbd6943953","observation_id":"a4288414-39ae-4d79-9bd6-4c362022ffff","resolution":{"observed_at":"2026-08-06T00:32:00.631410Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.09959","last_updated":"2025-01-17T05:21:49Z","snapshot_observed_at":"2026-07-06T20:22:19.281265Z","submitted_at":"2025-01-17T05:21:49Z","title":"A Survey on Multi-Turn Interaction Capabilities of Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.09959","snapshot_observed_at":"2026-08-06T00:32:00.805296Z","title":"A survey on multi-turn interaction capabilities of large language models,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:00.805296Z"},"links":{"cited_paper":"/paper/2501.09959","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:6546937e06d589cffd44824157e38b1a5c0447b354b82b676f1d48f11202842b","observation_id":"ef96daba-4418-4710-b59b-2fe6b172e9b7","resolution":{"observed_at":"2026-08-06T00:32:00.805296Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.15221","last_updated":"2024-09-04T00:58:59Z","snapshot_observed_at":"2026-07-06T19:06:41.697671Z","submitted_at":"2024-08-27T17:33:30Z","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.15221","snapshot_observed_at":"2026-08-06T00:32:00.935942Z","title":"Llm defenses are not robust to multi-turn human jailbreaks yet,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:00.935942Z"},"links":{"cited_paper":"/paper/2408.15221","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:5f053eded338bbab6266c20cb0ab6c2acb04a125b4c515c398287d461600ade1","observation_id":"51f6832f-3f61-4b2a-8830-0224e9affcb8","resolution":{"observed_at":"2026-08-06T00:32:00.935942Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.369215Z","title":"Great, now write an article about that: The crescendo{Multi-Turn}{LLM}jailbreak attack,","venue":null,"work_id":"a154bddf-1d9a-42e5-a208-9e08b61257b4","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:01.070590Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:9215b664ee5e5c4269f1375655afa9b0ccb88c807160a3c339e73ddbe4319a7b","observation_id":"343c3b41-3deb-4a72-996f-2c4756e87d8c","resolution":{"observed_at":"2026-08-06T00:32:11.406388Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.288605Z","title":"Foot-in-the-door: A multi- turn jailbreak for LLMs,","venue":null,"work_id":"0d2148ae-0620-4f6f-a669-b90dbc0cc9f1","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:01.201235Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:57c576e3d5e0c38aad5e0c6007af9afa11bc6ed98b20d7220d83f404dbac09b9","observation_id":"7cf8fb96-4b28-4bd2-817f-0cd67b59cda9","resolution":{"observed_at":"2026-08-06T00:32:11.319328Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.09177","last_updated":"2024-10-02T10:43:07Z","snapshot_observed_at":"2026-08-01T16:03:38.510223Z","submitted_at":"2024-02-14T13:45:19Z","title":"Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.09177","snapshot_observed_at":"2026-08-06T00:32:01.366073Z","title":"Lever- aging the Context through Multi-Round Interactions for Jailbreaking Attacks,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:01.366073Z"},"links":{"cited_paper":"/paper/2402.09177","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:25a08c51b54ff18f753c16fa98f66c4fadde8d89333606f6c2f2d487d549233e","observation_id":"2f6ab5d0-e13c-4c95-9801-f73d70b71723","resolution":{"observed_at":"2026-08-06T00:32:01.366073Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.04686","last_updated":"2024-08-08T09:18:47Z","snapshot_observed_at":"2026-07-06T18:58:35.218405Z","submitted_at":"2024-08-08T09:18:47Z","title":"Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.04686","snapshot_observed_at":"2026-08-06T00:32:01.466125Z","title":"Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:01.466125Z"},"links":{"cited_paper":"/paper/2408.04686","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:64b993b04c986ea4d6115bdf7591ea54f5d019c424d3195705c092225af3dc27","observation_id":"c1c959c2-b2b0-483c-b504-5c3df9b3b704","resolution":{"observed_at":"2026-08-06T00:32:01.466125Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.239627Z","title":"Masterkey: Automated jailbreaking of large language model chatbots,","venue":null,"work_id":"0eafeb76-ebe6-4e6c-9e49-e10040558846","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:01.557122Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:0f6d142702d63e6788a4ed99bfa04765045b7d85ab09d7577d392e0c5a373f1c","observation_id":"ecbe0251-ec47-484f-ac2e-f34112f266d0","resolution":{"observed_at":"2026-08-06T00:32:11.247675Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.01606","last_updated":"2024-10-02T14:47:05Z","snapshot_observed_at":"2026-08-03T19:54:21.584740Z","submitted_at":"2024-10-02T14:47:05Z","title":"Automated Red Teaming with GOAT: the Generative Offensive Agent Tester","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.01606","snapshot_observed_at":"2026-08-06T00:32:01.641441Z","title":"Automated red teaming with goat: the generative offensive agent tester,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:01.641441Z"},"links":{"cited_paper":"/paper/2410.01606","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:2b2a590b17b34221d41fa2bb14f3383b5a3b4175be810c08a9ab602f5305a57b","observation_id":"6b42f3bf-9a72-418f-a5ee-904ff7ee36c9","resolution":{"observed_at":"2026-08-06T00:32:01.641441Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.01278","last_updated":"2025-04-02T01:06:19Z","snapshot_observed_at":"2026-07-06T21:02:42.779646Z","submitted_at":"2025-04-02T01:06:19Z","title":"Strategize Globally, Adapt Locally: A Multi-Turn Red Teaming Agent with Dual-Level Learning","version":1},"cited_work":{"arxiv_id":"2504.01278","doi":null,"metadata_source":"pith","pith_arxiv_id":"2504.01278","snapshot_observed_at":"2026-08-06T00:32:08.064695Z","title":"Strategize Globally, Adapt Locally: A Multi-Turn Red Teaming Agent with Dual-Level Learning","venue":"cs.AI","work_id":"7d697f66-e062-49f0-85de-e0130d79f3c6","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:01.734958Z"},"links":{"cited_paper":"/paper/2504.01278","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:969384f81432dac337a0594db40ac0bbd4bc94e088ac72cbab61d9280681e9bc","observation_id":"0a5ba394-e867-4c2b-b1cd-633f2d686784","resolution":{"observed_at":"2026-08-06T00:32:08.142664Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.10619","last_updated":"2025-05-28T09:31:33Z","snapshot_observed_at":"2026-08-02T12:09:36.861596Z","submitted_at":"2025-03-13T17:57:32Z","title":"Tempest: Autonomous Multi-Turn Jailbreaking of Large Language Models with Tree Search","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.10619","snapshot_observed_at":"2026-08-06T00:32:01.874179Z","title":"Tempest: Autonomous multi-turn jailbreak- ing of large language models with tree search,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:01.874179Z"},"links":{"cited_paper":"/paper/2503.10619","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:e1a80c0612b87a392982163a5e7c6f60cf1f17f55ce6ababc1683be81faf0fe6","observation_id":"aa2b3761-a635-4c4f-b46f-7bfb360c4877","resolution":{"observed_at":"2026-08-06T00:32:01.874179Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.13203","last_updated":"2025-08-23T02:09:57Z","snapshot_observed_at":"2026-07-06T21:11:10.415720Z","submitted_at":"2025-04-15T16:11:28Z","title":"X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.13203","snapshot_observed_at":"2026-08-06T00:32:01.993974Z","title":"X-teaming: Multi-turn jailbreaks and defenses with adaptive multi-agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:01.993974Z"},"links":{"cited_paper":"/paper/2504.13203","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:9516980c43007e15080a1f821350d239e3101d5a72c7e456b0f58824ff33f805","observation_id":"d588199e-7137-435a-a72d-6bda0eea9447","resolution":{"observed_at":"2026-08-06T00:32:01.993974Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.069510Z","title":"Safe in isolation, dangerous together: Agent-driven multi-turn decomposition jailbreaks on LLMs,","venue":null,"work_id":"1c9bd2c5-3534-4049-86b3-4ae5b52afbb3","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:02.065580Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:89e78017ba0b27c5fe9d4a292ae333cf48c52313b0bd29a66893e02cba051bfe","observation_id":"c6e00d92-fd8d-4195-a142-246f2e5e3803","resolution":{"observed_at":"2026-08-06T00:32:11.074461Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.21598","last_updated":"2025-03-27T15:19:55Z","snapshot_observed_at":"2026-07-06T20:59:44.949088Z","submitted_at":"2025-03-27T15:19:55Z","title":"Prompt, Divide, and Conquer: Bypassing Large Language Model Safety Filters via Segmented and Distributed Prompt Processing","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.21598","snapshot_observed_at":"2026-08-06T00:32:02.155613Z","title":"Prompt, divide, and conquer: Bypassing large language model safety filters via segmented and distributed prompt processing,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:02.155613Z"},"links":{"cited_paper":"/paper/2503.21598","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:9a21afb53ceb2b900898170a74d9c941969ff6733e6789cfdca124bf3ff8d127","observation_id":"5c6a294a-45b9-4ab2-9cb9-9e6a3bdf7d9d","resolution":{"observed_at":"2026-08-06T00:32:02.155613Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.10844","last_updated":"2023-10-16T21:37:24Z","snapshot_observed_at":"2026-07-06T16:34:11.453458Z","submitted_at":"2023-10-16T21:37:24Z","title":"Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.10844","snapshot_observed_at":"2026-08-06T00:32:02.310068Z","title":"Survey of vulnerabilities in large language models revealed by adversarial attacks,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:02.310068Z"},"links":{"cited_paper":"/paper/2310.10844","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:b487072ade1b5c73e103a903ca9f18f457b4eec1e51027a112d4fe5341d272bb","observation_id":"7ed41cf7-1526-48e1-8dd2-6471e029d600","resolution":{"observed_at":"2026-08-06T00:32:02.310068Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:02.401447Z","title":"Sok: Evaluating jailbreak guardrails for large language models,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:02.401447Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:552484e131592da089f5cd51db6e438744a3fda87552388e7982f1377ce85d73","observation_id":"d42c154f-a99c-45f2-a7ea-8f2cd01181ce","resolution":{"observed_at":"2026-08-06T00:32:02.401447Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:11.041652Z","title":"Prompt-based jailbreaking of leading llm chatbots: A survey of attacks and defenses,","venue":null,"work_id":"0bbb7e81-879b-4ef0-8c1f-6aec018992d9","year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:02.544339Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:6b8def55f8d6f3b202b47c377c21bac83412d873d6f1b8a09e406bb9d08c4d1a","observation_id":"b7c6a29f-a859-4520-9795-22f6528b60c9","resolution":{"observed_at":"2026-08-06T00:32:11.048115Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.15476","last_updated":"2026-07-04T04:20:15Z","snapshot_observed_at":"2026-08-06T02:45:04.316908Z","submitted_at":"2025-10-17T09:38:54Z","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2510.15476","snapshot_observed_at":"2026-08-06T00:32:02.668360Z","title":"Sok: Taxonomy and evalua- tion of prompt security in large language models,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:02.668360Z"},"links":{"cited_paper":"/paper/2510.15476","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:ae7f6756a6b25b26d51d6bf0f2416d7295e6245c0d4ad8fecf7845e27ec577f9","observation_id":"f9cbcb8c-5570-4e46-a76b-b0d6fa736dd8","resolution":{"observed_at":"2026-08-06T00:32:02.668360Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:02.757612Z","title":"Hon- eytrap: Deceiving large language model attackers to honeypot traps with resilient multi-agent defense,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:02.757612Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:1cd68accffb326e9e15536c34fdcc32905654d3d598338c7aa9fcd7d8b849e6c","observation_id":"7d6c9d96-6eec-4edc-a17e-bed509f768e8","resolution":{"observed_at":"2026-08-06T00:32:02.757612Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.05058","last_updated":"2026-05-06T15:53:17Z","snapshot_observed_at":"2026-07-06T23:17:43.402046Z","submitted_at":"2026-05-06T15:53:17Z","title":"SoK: Robustness in Large Language Models against Jailbreak Attacks","version":1},"cited_work":{"arxiv_id":"2605.05058","doi":null,"metadata_source":"pith","pith_arxiv_id":"2605.05058","snapshot_observed_at":"2026-08-06T00:32:07.408934Z","title":"SoK: Robustness in Large Language Models against Jailbreak Attacks","venue":"cs.CR","work_id":"118e1818-0e06-4105-a5ce-5a608cc63f7f","year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:02.888403Z"},"links":{"cited_paper":"/paper/2605.05058","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:6e7367ca426bcb657a674d8d271e73072ff0df642b41e2cd24840894da6a6921","observation_id":"b8ea8cf3-74fc-45e5-90a4-e0ecdcc7f1af","resolution":{"observed_at":"2026-08-06T00:32:07.498813Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:02.957358Z","title":"Security and privacy challenges of large language models: A survey,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:02.957358Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:cba52e9d108ec4ccfd0f4dfc3a19fa4e84130265ff5fc8f0df8c971a3d60f7d5","observation_id":"f3521345-0fb3-4029-b89f-16ddec124c0e","resolution":{"observed_at":"2026-08-06T00:32:02.957358Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.04295","last_updated":"2024-08-30T11:57:47Z","snapshot_observed_at":"2026-08-04T23:34:13.332065Z","submitted_at":"2024-07-05T06:57:30Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.04295","snapshot_observed_at":"2026-08-06T00:32:03.047259Z","title":"Jailbreak attacks and defenses against large language models: A survey,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.047259Z"},"links":{"cited_paper":"/paper/2407.04295","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:6fff8f907f5e3e677ae24d7cb51c2e7e59e7ddf8fb106df0bc7b6cdab3f9cabb","observation_id":"a97d428a-fceb-4be6-8fc4-ca17cae119cd","resolution":{"observed_at":"2026-08-06T00:32:03.047259Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:10.998081Z","title":"How alignment and jailbreak work: Explain LLM safety through interme- diate hidden states,","venue":null,"work_id":"e2a32d83-db88-476f-869c-87536746897f","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.114301Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:6ce09f84bbdf7ee74e56503aaad6346fae8fb692321fbdf5e21b5f0b4fb5e902","observation_id":"82304e3e-518f-454f-b115-e4f1deaee3ea","resolution":{"observed_at":"2026-08-06T00:32:11.003027Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:10.821572Z","title":"Refusal in language models is mediated by a single direction,","venue":null,"work_id":"79f8ee66-8e4a-4607-bbef-3be034d345d1","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.163474Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:8aca70e0b79cfd077847f58cb50391d5656d29c72d51cd752d238d9af65fb5df","observation_id":"926fc726-8b48-467b-92d0-81271a535805","resolution":{"observed_at":"2026-08-06T00:32:10.887691Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:10.638671Z","title":"Analogy-based multi-turn jailbreak against large language models,","venue":null,"work_id":"7659e6a8-9dd5-441a-be64-93249dec27fc","year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.252443Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:c8a503b91e900ae62e6cf67c67c260728380d627d5292e430dbce6da3673fe2e","observation_id":"043cceac-e061-467a-ba4f-5526c9b4e407","resolution":{"observed_at":"2026-08-06T00:32:10.679596Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:03.338865Z","title":"Derail Yourself: Multi-turn LLM Jailbreak Attack through Self-discovered Clues,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.338865Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:542ee459422bc762bad3708ad1f79ac463c6ca110d26b20f2b3a64c9d2c580c9","observation_id":"3d3786ea-ab62-4bf5-9dcd-f29c6f26dcd6","resolution":{"observed_at":"2026-08-06T00:32:03.338865Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.11054","last_updated":"2025-03-11T03:06:17Z","snapshot_observed_at":"2026-07-06T20:37:18.647879Z","submitted_at":"2025-02-16T09:27:44Z","title":"Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.11054","snapshot_observed_at":"2026-08-06T00:32:03.417230Z","title":"Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.417230Z"},"links":{"cited_paper":"/paper/2502.11054","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:efe5bc7a1cb23541f0bfccf977ec254c72ec28cdb664abe08caab3721704dcd8","observation_id":"ab8bfe1c-295d-4435-bdd2-caee2c1d7bf3","resolution":{"observed_at":"2026-08-06T00:32:03.417230Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2601.20903","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:07.050629Z","title":"Icon: Intent-context coupling for efficient multi-turn jailbreak attack,","venue":null,"work_id":"d0413a06-7d77-4666-9606-c32b74e9c52c","year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.494338Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:8a7ea532571257b1b4599ebed30d5645370c3f63ab3fcbe492ef01f415d039f8","observation_id":"d9fc73cf-d792-4d98-94ae-f5207bc627d2","resolution":{"observed_at":"2026-08-06T00:32:07.159559Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.15399","last_updated":"2024-07-22T06:04:29Z","snapshot_observed_at":"2026-08-04T21:20:07.364297Z","submitted_at":"2024-07-22T06:04:29Z","title":"Imposter.AI: Adversarial Attacks with Hidden Intentions towards Aligned Large Language Models","version":1},"cited_work":{"arxiv_id":"2407.15399","doi":null,"metadata_source":"pith","pith_arxiv_id":"2407.15399","snapshot_observed_at":"2026-08-06T00:32:06.644076Z","title":"Imposter.AI: Adversarial Attacks with Hidden Intentions towards Aligned Large Language Models","venue":"cs.CL","work_id":"bf8c516e-4f14-4834-b7be-52a44881ee40","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.566097Z"},"links":{"cited_paper":"/paper/2407.15399","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:13bf48b2a4a37fbb3f2a4204aa51d6ab7cca6c2cd0211b9cea44f9b64172c296","observation_id":"92d2c651-a785-4a19-863e-3548618c009f","resolution":{"observed_at":"2026-08-06T00:32:06.789503Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:10.425765Z","title":"Jigsaw puzzles: Split- ting harmful questions to jailbreak large language models in multi- turn interactions,","venue":null,"work_id":"0c733c75-c9c1-4bbb-8ce1-845d62180be7","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.632919Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:93846e631c7fa46a08d0a7b0605c2b788d65698469ffd5c267e5d41515f58744","observation_id":"66772022-4e13-4091-9227-62da7fa4a7fb","resolution":{"observed_at":"2026-08-06T00:32:10.488423Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.17262","last_updated":"2024-10-30T05:43:51Z","snapshot_observed_at":"2026-08-05T05:04:37.035197Z","submitted_at":"2024-02-27T07:11:59Z","title":"Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.17262","snapshot_observed_at":"2026-08-06T00:32:03.725656Z","title":"Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.725656Z"},"links":{"cited_paper":"/paper/2402.17262","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:61f11433ac4f3c83ebb208ff14c6166309d3e51643d0c7278a4d35e676574cd5","observation_id":"bab2029c-1c31-41e2-9a7c-9bb63166a6c7","resolution":{"observed_at":"2026-08-06T00:32:03.725656Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.03814","last_updated":"2025-01-07T07:46:16Z","snapshot_observed_at":"2026-07-06T19:46:06.343310Z","submitted_at":"2024-11-06T10:32:09Z","title":"MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialogue","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.03814","snapshot_observed_at":"2026-08-06T00:32:03.813752Z","title":"MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialogue,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.813752Z"},"links":{"cited_paper":"/paper/2411.03814","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:4173a4d6d0e772fc0003e34e214d971801e01094ea52cd30c2fcf16172e1eac2","observation_id":"0725efb6-4f12-4725-b318-224cac0672b1","resolution":{"observed_at":"2026-08-06T00:32:03.813752Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2501.14250","doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:06.296436Z","title":"Siren: A Learning-Based Multi-Turn Attack Framework for Simulating Real-World Human Jailbreak Behaviors,","venue":null,"work_id":"ecf63579-5db1-4379-87cf-6ddeb31d8599","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.894827Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:0f6947f2abd04ae7fa37c719b60e6d9ab2295851b5154b6580b81cd2365a105d","observation_id":"4d993044-2361-400f-928d-bc5f74a9ca81","resolution":{"observed_at":"2026-08-06T00:32:06.406267Z","resolver_source":"raw_fallback","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:10.143875Z","title":"Incremental exploits: Efficient jailbreaks on large language models with multi-round conversational jailbreaking,","venue":null,"work_id":"d6517a4e-be71-4baf-9e6c-9c6345a9937b","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:03.969138Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:e592db7d28f84edcfe7e38e0b64c8f2b2f1a4078053d54b8dedceb8397dd79b6","observation_id":"076552ef-0e08-42a0-8d2f-311aa3765703","resolution":{"observed_at":"2026-08-06T00:32:10.300942Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04060","last_updated":"2026-04-05T11:06:13Z","snapshot_observed_at":"2026-08-02T08:01:35.924581Z","submitted_at":"2026-04-05T11:06:13Z","title":"CoopGuard: Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Round Attacks","version":1},"cited_work":{"arxiv_id":"2604.04060","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.04060","snapshot_observed_at":"2026-08-06T00:32:05.923801Z","title":"CoopGuard: Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Round Attacks","venue":"cs.CR","work_id":"86e72b97-5273-4745-b78a-398909e06feb","year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.056738Z"},"links":{"cited_paper":"/paper/2604.04060","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:39d5e3632bc3e7b2ee5ab50aa5165ff3f2d6ff30fd1911e1ff4788bae2f14d78","observation_id":"f59ab08c-020d-47f4-b020-addc7789e143","resolution":{"observed_at":"2026-08-06T00:32:06.083513Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:09.745223Z","title":"Multi- turn jailbreaking large language models via attention shifting,","venue":null,"work_id":"7c7666c8-8d19-4ad4-80c0-578bc870e7f2","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.125373Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:1455a43c993599f05cb7992d53df3258c5906b02c52d3aa51af17216f33507cb","observation_id":"61ca63f3-f7cc-4674-aecb-2c6a877b5f42","resolution":{"observed_at":"2026-08-06T00:32:09.892715Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:09.559148Z","title":"Efficient jailbreak attack sequences on large language models via multi- armed bandit-based context switching,","venue":null,"work_id":"39259775-d216-42c2-8a15-d6fc350884f8","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.224060Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:96bb0a0ba2c5b63f41ac019de4a85d57fdfbccc0f0888e74e714eee771db6ed4","observation_id":"6f2a0adf-ec4f-49fc-913b-16c9ddc03936","resolution":{"observed_at":"2026-08-06T00:32:09.660541Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:04.319422Z","title":"Jailbreaking large language models through iterative tool-disguised attacks via reinforcement learning,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.319422Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:f70413d6a53532bd6b3ea66e3162ed4f855d19cbde3706f28d26e577882ba10f","observation_id":"24b1c6a4-27b5-43c1-b0e0-2ecffa2d8602","resolution":{"observed_at":"2026-08-06T00:32:04.319422Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:04.435709Z","title":"Sema: Simple yet effective learning for multi-turn jailbreak attacks,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.435709Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:2969794bfde8f2f17fb33ff079f92778a41e59ab38cbfecaf320f6b1954b247c","observation_id":"afb91035-ec2b-4af9-abcf-dae7b523cba3","resolution":{"observed_at":"2026-08-06T00:32:04.435709Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2507.22063","last_updated":"2026-07-02T17:48:45Z","snapshot_observed_at":"2026-08-06T22:52:58.454957Z","submitted_at":"2025-06-25T06:20:15Z","title":"RedCoder: Automated Multi-Turn Red Teaming for Code LLMs","version":2},"cited_work":{"arxiv_id":"2507.22063","doi":null,"metadata_source":"pith","pith_arxiv_id":"2507.22063","snapshot_observed_at":"2026-08-06T00:32:05.445897Z","title":"RedCoder: Automated Multi-Turn Red Teaming for Code LLMs","venue":"cs.SE","work_id":"6673e675-0663-4415-8a36-a544692f2172","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.530222Z"},"links":{"cited_paper":"/paper/2507.22063","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:80507c095813b117b81742c5f71908cd4e0f6f2d67dc010def274fb0c4c1c533","observation_id":"7e351c69-5e56-4fc3-9e3b-b3a00197fa6f","resolution":{"observed_at":"2026-08-06T00:32:05.527855Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2601.02670","last_updated":"2026-04-08T04:11:40Z","snapshot_observed_at":"2026-07-06T22:40:46.465095Z","submitted_at":"2026-01-06T02:58:22Z","title":"Break Me If You Can: Self-Jailbreaking of Aligned LLMs via Lexical Insertion Prompting","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2601.02670","snapshot_observed_at":"2026-08-06T00:32:04.600055Z","title":"Multi-turn jail- breaking of aligned llms via lexical anchor tree search,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.600055Z"},"links":{"cited_paper":"/paper/2601.02670","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:ab91d240f6caf70e811b643417d8bd2bbe03f13dc93ebd3551c18504d4506dd5","observation_id":"b62a937e-c4f5-481e-b396-deb60e0be59a","resolution":{"observed_at":"2026-08-06T00:32:04.600055Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:09.401056Z","title":"I know what you asked: Prompt leakage via kv-cache sharing in multi-tenant llm serving","venue":null,"work_id":"f19cb9ee-a8b8-433c-9288-a65db1eecbcc","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.668588Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:d27420eeb2d6edb7272664d42880cb152f6fb34b3693de8fb4c7488059b03faf","observation_id":"483554e4-9234-4e79-9d61-34e7b145731e","resolution":{"observed_at":"2026-08-06T00:32:09.473026Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:09.254288Z","title":"Pleak: Prompt leaking attacks against large language model applications,","venue":null,"work_id":"a4bea95f-a11f-4b26-9750-4f52f9164818","year":2024},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":92,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.737414Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:bc6e802023674412f9bf95f71e6c06a0293201ff00045ed811377b3858699e09","observation_id":"bfa78f89-88b1-47e5-a5d2-b4ece3ff5afa","resolution":{"observed_at":"2026-08-06T00:32:09.315622Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:09.105291Z","title":"Safedialbench: a fine-grained safety evaluation benchmark for large language models in multi-turn dialogues with diverse jailbreak attacks,","venue":null,"work_id":"92805cff-8edd-4d5c-af39-056c1ae8e111","year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.831040Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:40a304a4cadabe43233f1514266e09f4f040095c3f33f523870452ffd20326e8","observation_id":"51a76467-7112-4432-ab00-ee5fc85d55c0","resolution":{"observed_at":"2026-08-06T00:32:09.167357Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:08.922651Z","title":"Agentharm: A benchmark for measuring harmfulness of llm agents,","venue":null,"work_id":"d1545d13-056e-4d01-b872-cfeb287dd9d5","year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.919048Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:4555761d1c72dbaa836015a1f4e24713d8903bccf741cb369f21e02d0fad08bb","observation_id":"7589fda7-9ecb-47db-8d54-013aca918cf6","resolution":{"observed_at":"2026-08-06T00:32:08.981778Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:04.995556Z","title":"Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:04.995556Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:694e3508a1f72f6f168f41cb8176f1663562ab48649d140b2449b971871bef57","observation_id":"a11d1aff-4c4c-4723-9274-6b40c7dfaca8","resolution":{"observed_at":"2026-08-06T00:32:04.995556Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.01687","last_updated":"2026-05-03T02:55:30Z","snapshot_observed_at":"2026-07-06T23:14:52.417213Z","submitted_at":"2026-05-03T02:55:30Z","title":"MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.01687","snapshot_observed_at":"2026-08-06T00:32:05.121298Z","title":"Multibreak: A scalable and diverse multi-turn jailbreak benchmark for evaluating llm safety,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":96,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:05.121298Z"},"links":{"cited_paper":"/paper/2605.01687","citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:4cb7e127b68e5843fd7979ce438c4f35192b26e9d43f9f4ea778b788e277ebaa","observation_id":"873285c7-9390-4192-b59f-e258f18a6098","resolution":{"observed_at":"2026-08-06T00:32:05.121298Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T00:32:08.703398Z","title":"For the MRCJ-side experiment, auxiliary questions and malice-level labels follow the MRCJ release [83] without modification","venue":null,"work_id":"85512869-66c1-47c4-bf40-ea0f191c4525","year":null},"citing_paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","version":1},"reference_index":97,"source":"pdf_text","source_observed_at":"2026-08-06T00:32:05.231888Z"},"links":{"citing_paper":"/paper/2608.01117"},"observation_digest":"sha256:ec628706f85ba7dc9f0038f3c5edd0906ae641532c70a36aa16767b8ecf738e4","observation_id":"e1951eec-5ccd-47d1-af44-5d220ed27450","resolution":{"observed_at":"2026-08-06T00:32:08.781491Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2608.01117","last_updated":"2026-08-02T09:24:08Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-06T23:25:36.295333Z","submitted_at":"2026-08-02T09:24:08Z","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks"},"reference_resolution":{"displayed":96,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":50,"verified_exact":7,"verified_fuzzy":39},"total_outbound_references":96},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"thesis":"As of 7 August 2026, this Paper Citation Record lists 96 of 96 outbound references and 0 inbound Pith citation observations for arXiv:2608.01117."}