{"as_of":"2026-08-14T08:47:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:e0567de7ca2c127025fb843f629a796a0236a199c7123db3a274fc06d995adc1","coverage":[{"denominator":67,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":67,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-12T00:22:49.865192Z","state":"measured"},{"denominator":67,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":67,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-14T06:32:32.682623+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.08212/citation-record","integrity":"/paper/2608.08212/integrity","json":"/paper/2608.08212/citation-record.json","paper":"/paper/2608.08212"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2510.11288","last_updated":"2026-04-20T09:09:30Z","snapshot_observed_at":"2026-07-06T22:32:32.632779Z","submitted_at":"2025-10-13T11:23:56Z","title":"Emergent Misalignment via In-Context Learning: Narrow in-context examples can produce broadly misaligned LLMs","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2510.11288","snapshot_observed_at":"2026-08-12T00:22:49.530177Z","title":"Emergent misalignment via in-context learning: Narrow in-context examples can produce broadly misaligned llms","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":1,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.530177Z"},"links":{"cited_paper":"/paper/2510.11288","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:488e15d40f7f6840a5c561dddb8de7b893f0f7e6faad9e33e8d62111e055ec31","observation_id":"30f2de63-4956-4b3a-8e2e-ddeb207cfd9c","resolution":{"observed_at":"2026-08-12T00:22:49.530177Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:51.054703Z","title":"Many-shot in-context learning","venue":null,"work_id":"0d58123a-085c-4c32-bf48-fb02f6589c90","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":2,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.536944Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:883b24d971ac715ea50d01d69a0ecf9f191b4b26530c12b252838a5dbd21073c","observation_id":"b3d0543b-02d0-4d6f-ab46-3fcea3315427","resolution":{"observed_at":"2026-08-12T00:22:51.059538Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.541983Z","title":"Bowman, Ethan Perez, Roger Grosse, and David Duvenaud","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":3,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.541983Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:0288fb3f0fe3e23dfd89207faf9a9157b72421ff517e2a969ce718e05149afd7","observation_id":"34b672a5-4256-405a-87d6-ffe7704fd03d","resolution":{"observed_at":"2026-08-12T00:22:49.541983Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.547731Z","title":"Refusal in language models is mediated by a single direction","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":4,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.547731Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:b46b0fb4d771409b3d9fcd1e5890c98e6d90edffc872b2005c61798ed1bc51a5","observation_id":"9e017570-f999-433d-9489-8145da40862b","resolution":{"observed_at":"2026-08-12T00:22:49.547731Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.08073","last_updated":"2022-12-15T06:19:23Z","snapshot_observed_at":"2026-08-02T04:53:58.766070Z","submitted_at":"2022-12-15T06:19:23Z","title":"Constitutional AI: Harmlessness from AI Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.08073","snapshot_observed_at":"2026-08-12T00:22:49.552757Z","title":"Bowman, Zac Hatfield-Dodds, Ben Mann, Dario Amodei, Nicholas Joseph, Sam McCandlish, Tom Brown, and Jared Kaplan","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":5,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.552757Z"},"links":{"cited_paper":"/paper/2212.08073","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:98c40a6f2d85e89c3ae0862400a913ce1c63fb77371f4ac28b0929ae45f6076a","observation_id":"aae8d46c-7a70-48f2-9e1b-da1be140e47c","resolution":{"observed_at":"2026-08-12T00:22:49.552757Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:51.018074Z","title":"Tell me about yourself: Llms are aware of their learned behaviors","venue":null,"work_id":"b44f4cbf-fb86-4ee6-903c-4e2013819c62","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":6,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.558154Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:7ede83469f630bd4ba4917299d403ed34112f11f57ddac717d84901f7bf5470c","observation_id":"639a3367-cad2-4e19-9d0b-8c672c1cfc80","resolution":{"observed_at":"2026-08-12T00:22:51.023208Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:51.002202Z","title":"Emergent misalignment: Narrow finetuning can produce broadly misaligned LLM s","venue":null,"work_id":"9d81ee82-7e37-4fdc-b9db-fbf050adc547","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":7,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.563493Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:10b3a134f049eb8cd3fa6f4a94f3216cf44a0ce2972ea20102d11982b0f04cbb","observation_id":"7eec4d22-4c79-4d89-8749-33db422aa9f1","resolution":{"observed_at":"2026-08-12T00:22:51.007811Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.21509","last_updated":"2025-09-05T07:44:31Z","snapshot_observed_at":"2026-08-09T05:08:13.935849Z","submitted_at":"2025-07-29T05:20:14Z","title":"Persona Vectors: Monitoring and Controlling Character Traits in Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2507.21509","snapshot_observed_at":"2026-08-12T00:22:49.568072Z","title":"Persona vectors: Monitoring and controlling character traits in language models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":8,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.568072Z"},"links":{"cited_paper":"/paper/2507.21509","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:1efd55cb42a701075730525d7a7e3567bf08d7fba72eed03628c696cd6cd1cd3","observation_id":"6987c8c9-ac37-4a9f-81f8-310a38e9980e","resolution":{"observed_at":"2026-08-12T00:22:49.568072Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.985113Z","title":"\\ StruQ \\ : Defending against prompt injection with structured queries","venue":null,"work_id":"9cf7686e-8634-4a8f-8e9b-352161691fb8","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":9,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.573255Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:11144eaee48889bef368c84fb996893117c99834782d80bc33112abe19fc41a3","observation_id":"621d6d3f-6678-4dac-ba54-539ce9a0e19f","resolution":{"observed_at":"2026-08-12T00:22:50.991287Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.967860Z","title":"Secalign: Defending against prompt injection with preference optimization","venue":null,"work_id":"67b42e65-93c5-4704-a775-471136652bd5","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":10,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.578105Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:2231c178a26b92827fec36bd353b5ef42ff819b80c785a534d67ef53f9a47d99","observation_id":"555278eb-af8b-4711-8b0d-782113f92ac2","resolution":{"observed_at":"2026-08-12T00:22:50.973490Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.951831Z","title":null,"venue":null,"work_id":"0d27a8fd-b4bb-48f1-9b4c-28d8a62eccbe","year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":11,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.582662Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:b00f0bfc67d759d06d695dce5d43a5d495e401cfb4eab412444089f2de4d780f","observation_id":"287aaccf-420c-43a8-ac28-a9fd9141759d","resolution":{"observed_at":"2026-08-12T00:22:50.956682Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04132","last_updated":"2024-03-07T01:22:38Z","snapshot_observed_at":"2026-08-02T17:55:33.750637Z","submitted_at":"2024-03-07T01:22:38Z","title":"Chatbot Arena: An Open Platform for Evaluating LLMs by Human Preference","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.04132","snapshot_observed_at":"2026-08-12T00:22:49.587294Z","title":"Chatbot arena: An open platform for evaluating llms by human preference","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":12,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.587294Z"},"links":{"cited_paper":"/paper/2403.04132","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:1df9e416de4302d3ddf06265fd27af8b13e7f7732ec941a393aec9c8dbe66b93","observation_id":"e6d33028-ef89-4f53-9770-0574c9340885","resolution":{"observed_at":"2026-08-12T00:22:49.587294Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.05466","last_updated":"2024-05-11T04:45:59Z","snapshot_observed_at":"2026-08-13T00:11:57.018313Z","submitted_at":"2024-05-08T23:44:08Z","title":"Poser: Unmasking Alignment Faking LLMs by Manipulating Their Internals","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.05466","snapshot_observed_at":"2026-08-12T00:22:49.592032Z","title":"Poser: Unmasking alignment faking llms by manipulating their internals","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.592032Z"},"links":{"cited_paper":"/paper/2405.05466","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:8e304a75a80450741071fe2bb7ca14109bb3a9b887fe8caf02908f3e1a0595b9","observation_id":"2a708400-657c-4e5d-8fd3-9a4a967e2a09","resolution":{"observed_at":"2026-08-12T00:22:49.592032Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.935730Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents","venue":null,"work_id":"d1131db1-089a-4f54-9887-8aa305fb3774","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.597204Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:bd1861411272916134fbff811e66e53a3091b25041bc425558f583e4c185f48c","observation_id":"c34faec4-3895-4a1b-915d-106b7bb08079","resolution":{"observed_at":"2026-08-12T00:22:50.941303Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2107.07002","last_updated":"2021-07-14T21:08:30Z","snapshot_observed_at":"2026-08-13T18:45:34.365789Z","submitted_at":"2021-07-14T21:08:30Z","title":"The Benchmark Lottery","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2107.07002","snapshot_observed_at":"2026-08-12T00:22:49.601913Z","title":"Gritsenko, Zhe Zhao, Neil Houlsby, Fernando Diaz, Donald Metzler, and Oriol Vinyals","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":15,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.601913Z"},"links":{"cited_paper":"/paper/2107.07002","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:598e2d09d6f1a670edc6847eb1080d6c6c08adb52ecfc7708b28bb99e2e5e40b","observation_id":"0b928a21-9e6c-4d1d-ab14-36878b3288e1","resolution":{"observed_at":"2026-08-12T00:22:49.601913Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.10162","last_updated":"2024-06-29T00:28:47Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-06-14T16:26:20Z","title":"Sycophancy to Subterfuge: Investigating Reward-Tampering in Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.10162","snapshot_observed_at":"2026-08-12T00:22:49.606931Z","title":"Bowman, Ethan Perez, and Evan Hubinger","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":16,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.606931Z"},"links":{"cited_paper":"/paper/2406.10162","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:13df9f3b67c04360f7eb366c3c4473c6d3176ab05d6bc5ddb657c16bef92a917","observation_id":"f2dee1c2-19d9-41ec-9e01-97332837ef01","resolution":{"observed_at":"2026-08-12T00:22:49.606931Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.612207Z","title":null,"venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.612207Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:fe051f2db09445024e723598debe86951fab6f0dee4577dac98eba72ba69537d","observation_id":"fe8b9d1e-32ad-40d5-b753-bca601da0d05","resolution":{"observed_at":"2026-08-12T00:22:49.612207Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.617371Z","title":"The hitchhiker ' s guide to testing statistical significance in natural language processing","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":18,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.617371Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:942ed33bdbffa9d81fb8180aace61ad5933641d4c2e22b266cc50121c7cfff1a","observation_id":"271749fd-1904-46b7-98f6-0486be589366","resolution":{"observed_at":"2026-08-12T00:22:49.617371Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.04475","last_updated":"2025-03-10T09:27:03Z","snapshot_observed_at":"2026-07-06T17:56:23.317089Z","submitted_at":"2024-04-06T02:29:02Z","title":"Length-Controlled AlpacaEval: A Simple Way to Debias Automatic Evaluators","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.04475","snapshot_observed_at":"2026-08-12T00:22:49.622390Z","title":"Length-controlled alpacaeval: A simple way to debias automatic evaluators","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":19,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.622390Z"},"links":{"cited_paper":"/paper/2404.04475","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:9fc1eb754934c38c430d6572177a5dc82d8d0f8e070e1219a78a8f9c0c0e2d86","observation_id":"4cafb2b8-5361-417e-893a-f445a07474bd","resolution":{"observed_at":"2026-08-12T00:22:49.622390Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.920041Z","title":"Wasp: Benchmarking web agent security against prompt injection attacks","venue":null,"work_id":"70354176-0f74-4103-8b40-ee0e4073347d","year":2026},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":20,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.627513Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:34b57d78b31b429c836a24c848802680b3093ce79861e6bf56621d19b20ce973","observation_id":"011eecbf-38bf-4d25-b9a0-115bb38a7fa3","resolution":{"observed_at":"2026-08-12T00:22:50.925148Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.632374Z","title":"Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.632374Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:e5ad151428f5ad6f05dc012ad35e3f65a570d715497b9d6e9f608ab2e55b3c48","observation_id":"7ed41a84-9f6d-476d-b3c1-03ad84828a3a","resolution":{"observed_at":"2026-08-12T00:22:49.632374Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.903162Z","title":"Position: Anthropomorphic misalignment research needs stronger evidence","venue":null,"work_id":"cb0ac595-67f9-4e7b-953f-155abfdea3d6","year":2026},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":22,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.637059Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:70b4ee27060c2bec97c76b2886061c6d10055e8c2a5707c461ac11bbc8e173bb","observation_id":"f3b8397d-f8b9-4ca6-8209-559019f8cdd5","resolution":{"observed_at":"2026-08-12T00:22:50.908290Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-08-14T04:50:01.976958Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-08-12T00:22:49.641681Z","title":"Defending against indirect prompt injection attacks with spotlighting","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":23,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.641681Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:875de7ce98bb9298ee221e33a8994c680cd84c94f851b8ead4205e02127c48f5","observation_id":"a7ddc839-af7e-409e-a758-618ac23869c1","resolution":{"observed_at":"2026-08-12T00:22:49.641681Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.05566","last_updated":"2024-01-17T20:26:01Z","snapshot_observed_at":"2026-08-12T12:19:52.685961Z","submitted_at":"2024-01-10T22:14:35Z","title":"Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.05566","snapshot_observed_at":"2026-08-12T00:22:49.646499Z","title":"Sleeper agents: Training deceptive llms that persist through safety training","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":24,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.646499Z"},"links":{"cited_paper":"/paper/2401.05566","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:9b9f91a4c46b0ad6936d141c2891d9bbdedb06bc86bb8c6623acc58dce2726c5","observation_id":"707eb619-952f-477e-9c6a-ad3ac84840bb","resolution":{"observed_at":"2026-08-12T00:22:49.646499Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.21038","last_updated":"2025-08-25T20:17:00Z","snapshot_observed_at":"2026-08-12T01:20:17.298418Z","submitted_at":"2025-04-28T07:38:43Z","title":"Prefill-level Jailbreak: A Black-Box Risk Analysis of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.21038","snapshot_observed_at":"2026-08-12T00:22:49.651555Z","title":"Prefill-level jailbreak: A black-box risk analysis of large language models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":25,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.651555Z"},"links":{"cited_paper":"/paper/2504.21038","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:509995fe2d2415bd130ac72835779529d62a6fe0d14ab3e29ecf92c91529bfbc","observation_id":"3af5cd8e-7a50-4e32-8e75-375ad1ea6fba","resolution":{"observed_at":"2026-08-12T00:22:49.651555Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2211.09110","last_updated":"2023-10-01T21:44:23Z","snapshot_observed_at":"2026-08-10T23:10:13.900680Z","submitted_at":"2022-11-16T18:51:34Z","title":"Holistic Evaluation of Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2211.09110","snapshot_observed_at":"2026-08-12T00:22:49.656331Z","title":"Manning, Christopher Ré, Diana Acosta-Navas, Drew A","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":26,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.656331Z"},"links":{"cited_paper":"/paper/2211.09110","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:85abcf187ab44757a1abdd3d536704b9dcb4339eb4dd4ad8848c7819af296e4c","observation_id":"943297e2-9f8b-4204-809a-eb77597ee23e","resolution":{"observed_at":"2026-08-12T00:22:49.656331Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.661445Z","title":"T ruthful QA : Measuring how models mimic human falsehoods","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":27,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.661445Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:0becdc970ae87a9f6090f0abdea7899b00fcac20dc5bc4976402057800574127","observation_id":"a957594b-48bf-4dee-a815-a3bdbd0f359b","resolution":{"observed_at":"2026-08-12T00:22:49.661445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1807.03341","last_updated":"2018-07-26T12:54:30Z","snapshot_observed_at":"2026-07-06T06:49:14.753521Z","submitted_at":"2018-07-09T18:59:17Z","title":"Troubling Trends in Machine Learning Scholarship","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1807.03341","snapshot_observed_at":"2026-08-12T00:22:49.666283Z","title":"Lipton and Jacob Steinhardt","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.666283Z"},"links":{"cited_paper":"/paper/1807.03341","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:4948565ad54d8706f52f28d7dc4f51e65fde267ad5de5257c9a4195e2366d7cc","observation_id":"6cc4a7ec-b8ed-41f7-b751-0b973dd54bc7","resolution":{"observed_at":"2026-08-12T00:22:49.666283Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.671474Z","title":"Formalizing and benchmarking prompt injection attacks and defenses","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":29,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.671474Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:40364ebbdd132e772b7197c74dad7ac09478f136f6175fe933948a3108874f2e","observation_id":"b0bfcf0f-6a85-4219-a202-965e0d18b19c","resolution":{"observed_at":"2026-08-12T00:22:49.671474Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.877676Z","title":"Datasentinel: A game-theoretic detection of prompt injection attacks","venue":null,"work_id":"fc1a3511-babf-44c7-a0dd-b2ee8a2c3b1e","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":30,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.676173Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:628bb1edd5d37f63e469a41b431d50c210851827cd26e532060b03b5a677261d","observation_id":"6b497d54-f1bd-41c8-a238-7675a2f36cde","resolution":{"observed_at":"2026-08-12T00:22:50.882879Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.681164Z","title":"Fantastically ordered prompts and where to find them: Overcoming few-shot prompt order sensitivity","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":31,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.681164Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:08675900d9cdab88506119149a5bacf225ff4e0335e7dad0c1fa43e068dff51a","observation_id":"44779ca1-8a59-498b-9a96-739c8251ba73","resolution":{"observed_at":"2026-08-12T00:22:49.681164Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.862799Z","title":"Harmbench: a standardized evaluation framework for automated red teaming and robust refusal","venue":null,"work_id":"9e0727d9-fc54-41f3-aa3c-23523007d4b7","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":32,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.686546Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:ec5ea1308df998a887102a9d14ba5620addf62bb3be333e20d07330dc25f6fa2","observation_id":"6097cff1-42b8-4d28-88d9-1490e17c7d2d","resolution":{"observed_at":"2026-08-12T00:22:50.867771Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.691804Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":33,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.691804Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:fb17c5f245d3a230bcca63d29036cea0bfff3885f5bb7fea3383c129038b330e","observation_id":"06198c22-fefc-4138-8fc5-8c0afef9c2a1","resolution":{"observed_at":"2026-08-12T00:22:49.691804Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2209.11895","last_updated":"2022-09-24T00:43:19Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-09-24T00:43:19Z","title":"In-context Learning and Induction Heads","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2209.11895","snapshot_observed_at":"2026-08-12T00:22:49.696753Z","title":"In-context learning and induction heads","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":34,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.696753Z"},"links":{"cited_paper":"/paper/2209.11895","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:a642049ee4033e7b323998343e295ec513a10eb0ba178b8312201138d3567dc6","observation_id":"f8ca78fb-49b4-49c5-82ed-3ef9b3d422ba","resolution":{"observed_at":"2026-08-12T00:22:49.696753Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.701739Z","title":null,"venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":35,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.701739Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:381bfbb8b26da1a51a2f85f6f22fd1978c02e59ed04723ad6f7b8067a9ca95f1","observation_id":"7b11e404-96c9-4ba4-903d-ad3ed9c08048","resolution":{"observed_at":"2026-08-12T00:22:49.701739Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.706357Z","title":"Red teaming language models with language models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":36,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.706357Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:e5d5da9805c3ffa43173240083afc00614bd2327116b7afb2f1c6b0501c12667","observation_id":"e62d3fa4-7db8-4f62-86f7-a53fcf23a849","resolution":{"observed_at":"2026-08-12T00:22:49.706357Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.847853Z","title":null,"venue":null,"work_id":"cf8bed6e-716b-43d2-9b41-35959fda0db3","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":37,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.711447Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:f886a1a4030d18c8b3feac7bea8adc12b6a76d9017be82447d9fae5bba6080c9","observation_id":"8af15e0e-5c6a-4abe-9cd6-e04a16c2ecd4","resolution":{"observed_at":"2026-08-12T00:22:50.852490Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.830838Z","title":"Safety alignment should be made more than just a few tokens deep","venue":null,"work_id":"01e157e6-2fed-4c0e-b374-c8a94f390a3d","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.716887Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:1de637849e812dffc278004ebea50b627953f6521d42951296e83467da32145a","observation_id":"6c9fde20-01e1-4d2f-ade2-8b20f8760903","resolution":{"observed_at":"2026-08-12T00:22:50.836554Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.721543Z","title":"Steering llama 2 via contrastive activation addition","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":39,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.721543Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:3bfe44e65256f612fd0dd5b0ba2fbf8d663deb170b0041e39e6dc030423242cb","observation_id":"1d6c92fa-476f-4f9b-a90e-df61fb8bfc51","resolution":{"observed_at":"2026-08-12T00:22:49.721543Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.814473Z","title":"In-context impersonation reveals large language models' strengths and biases","venue":null,"work_id":"1cf71da6-0c2f-43ac-bba2-12736022ae83","year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":40,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.726219Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:ca5f95a13a40a41a3eb8ffdcfb9f850ef9629be5ea55abf252ffa0c5b8f7788d","observation_id":"d797a939-59dc-4ca1-8447-11448dabf0ef","resolution":{"observed_at":"2026-08-12T00:22:50.819833Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.796740Z","title":"Quantifying language models' sensitivity to spurious features in prompt design or: How i learned to start worrying about prompt formatting","venue":null,"work_id":"fc9e73cb-4fb2-4bf3-b2a7-fc42a9638e23","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.731100Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:60f856293cc604b59ae3288d1e6a679e4c787dcc5d81905c8644182d4d3c468c","observation_id":"08a2ffe9-6d5a-4180-add7-e0ecdb619067","resolution":{"observed_at":"2026-08-12T00:22:50.802724Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.16367","last_updated":"2023-05-25T11:36:52Z","snapshot_observed_at":"2026-08-13T11:33:34.157657Z","submitted_at":"2023-05-25T11:36:52Z","title":"Role-Play with Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.16367","snapshot_observed_at":"2026-08-12T00:22:49.735823Z","title":"Role-play with large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":42,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.735823Z"},"links":{"cited_paper":"/paper/2305.16367","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:4dbbcbc6abf9e6d1d2a28ce90116d0526d5a7446a182decdb99810741dff332b","observation_id":"a32a04f3-3381-4b68-9e3d-45ef6dab5ac0","resolution":{"observed_at":"2026-08-12T00:22:49.735823Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.779883Z","title":"Judging the judges: A systematic study of position bias in llm-as-a-judge","venue":null,"work_id":"8adf25dc-1ea9-4353-9674-b816264b10ed","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":43,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.741322Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:00cc4a3e38b7852ba99bc6e87bd8f38cc140c06b2e2989822728bd3818fdc58b","observation_id":"f48c357c-f6d7-4264-9f4b-5f2b0b83337d","resolution":{"observed_at":"2026-08-12T00:22:50.784805Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.11618","last_updated":"2025-06-20T17:23:55Z","snapshot_observed_at":"2026-08-14T04:57:36.012123Z","submitted_at":"2025-06-13T09:39:54Z","title":"Convergent Linear Representations of Emergent Misalignment","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.11618","snapshot_observed_at":"2026-08-12T00:22:49.747675Z","title":"Convergent linear representations of emergent misalignment","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":44,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.747675Z"},"links":{"cited_paper":"/paper/2506.11618","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:bbd2ae5946dad4403d608508f8603b2de2a68a3ce58d589cc233d7e35afccaf6","observation_id":"e00827f3-94be-42f4-bccf-f8692ea9bdba","resolution":{"observed_at":"2026-08-12T00:22:49.747675Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.752615Z","title":"Extracting latent steering vectors from pretrained language models","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":45,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.752615Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:cda616bffeace30b8af0d1db85d5f27c4dcafb844d2b44c14f3f0f71df032462","observation_id":"094bf606-34ba-4f86-8738-0cc34bc864e2","resolution":{"observed_at":"2026-08-12T00:22:49.752615Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.763875Z","title":"Function vectors in large language models","venue":null,"work_id":"92558521-a5ff-42fa-ab61-1fedddf7afea","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.757488Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:cee38b3aab6aebbe1227469821a410d76bbc3fe90d22769c5dce45c02af7ea6e","observation_id":"66c2b156-72be-4896-8993-2f3a708ed2b0","resolution":{"observed_at":"2026-08-12T00:22:50.768991Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2308.10248","last_updated":"2024-10-10T13:20:13Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-08-20T12:21:05Z","title":"Steering Language Models With Activation Engineering","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.10248","snapshot_observed_at":"2026-08-12T00:22:49.761954Z","title":"Vazquez, Ulisse Mini, and Monte MacDiarmid","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.761954Z"},"links":{"cited_paper":"/paper/2308.10248","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:958f48840322aebb34fd1d5b38ebb9a8cd80c345af55b1be02e4894365075aa0","observation_id":"1c5d85c5-f224-4b3b-a920-24e93a739553","resolution":{"observed_at":"2026-08-12T00:22:49.761954Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.11613","last_updated":"2025-06-13T09:34:25Z","snapshot_observed_at":"2026-08-07T20:45:04.878203Z","submitted_at":"2025-06-13T09:34:25Z","title":"Model Organisms for Emergent Misalignment","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.11613","snapshot_observed_at":"2026-08-12T00:22:49.766759Z","title":"Model organisms for emergent misalignment","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.766759Z"},"links":{"cited_paper":"/paper/2506.11613","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:83c7d721736766c9b7ab6e02a349e63bb4bd4c0df47f84b6e6736e233ddd5d65","observation_id":"0cf35d45-3bd8-4b67-9c32-630c9aa32987","resolution":{"observed_at":"2026-08-12T00:22:49.766759Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.748098Z","title":"Transformers learn in-context by gradient descent","venue":null,"work_id":"2827e4c7-01d4-4642-9281-eda98e29157d","year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":49,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.771799Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:8c802d4c23867403edf7d631f662f7853cacdb8e034e99597e3c58e1afb563b3","observation_id":"46490b72-1a8e-4619-94d6-c86174bfc50e","resolution":{"observed_at":"2026-08-12T00:22:50.753509Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-11T23:45:02.178667Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-12T00:22:49.776344Z","title":"The instruction hierarchy: Training llms to prioritize privileged instructions","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":50,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.776344Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:39b05fceb78f7987f0a0272dc78b0fcf6b03c42432b0e7f6706c987499def57e","observation_id":"ec7a35d9-4bfe-4929-b435-e965a9bdbed7","resolution":{"observed_at":"2026-08-12T00:22:49.776344Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.781324Z","title":"Label words are anchors: An information flow perspective for understanding in-context learning","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":51,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.781324Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:a0ccf2d83e4aa5bebad798c23c41a1255b92c074063c8de24b4a995c378e193b","observation_id":"4b094c50-97c1-44ba-9ddd-1ed45fe2be86","resolution":{"observed_at":"2026-08-12T00:22:49.781324Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.786015Z","title":"Chi, Samuel Miserendino, Jeffrey Wang, Achyuta Rajaram, Johannes Heidecke, Tejal Patwardhan, and Dan Mossing","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":52,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.786015Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:1e87159a16fc1274fb66c4bcce2c079943a9cbb3d5bd471ba1ec88b5c315cd9e","observation_id":"eacf70e9-5587-4eab-b86e-fe3c99366590","resolution":{"observed_at":"2026-08-12T00:22:49.786015Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.732072Z","title":"Large language models are not fair evaluators","venue":null,"work_id":"c65e0f0d-f76e-4ec8-8655-c125de337ab7","year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":53,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.790803Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:ad701cb9a2b525b3108f9579f6d645fdd2999a729e6326e681eb52fe28ea54fc","observation_id":"04ec2cc2-764e-4977-81da-a5b56ba5ba9c","resolution":{"observed_at":"2026-08-12T00:22:50.737327Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.795389Z","title":"Evaluating general-purpose ai with psychometrics","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":54,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.795389Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:9c874c82134344232f8406be94d927ebe3d9d97597d21c63da4140b9a73517e3","observation_id":"bde5495e-709a-4086-a340-311f6d4c8a40","resolution":{"observed_at":"2026-08-12T00:22:49.795389Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.801300Z","title":"Do-not-answer: Evaluating safeguards in LLM s","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":55,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.801300Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:46eb9787c582d8e7488c1a44e36301c5f601ed84d1aa5af85103f7cf2e6cd1d5","observation_id":"9b8fbc86-2e1b-4f95-958e-c74bc8a148af","resolution":{"observed_at":"2026-08-12T00:22:49.801300Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.03846","last_updated":"2023-03-08T07:37:43Z","snapshot_observed_at":"2026-08-13T12:29:57.122699Z","submitted_at":"2023-03-07T12:24:17Z","title":"Larger language models do in-context learning differently","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.03846","snapshot_observed_at":"2026-08-12T00:22:49.806663Z","title":"Larger language models do in-context learning differently","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":56,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.806663Z"},"links":{"cited_paper":"/paper/2303.03846","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:98fceafaa4fea0c5caf4c5eb4968a544e4eeaa7282780220e64bd4533095c5b5","observation_id":"776dc142-fc57-413a-9d1c-f245d7b12027","resolution":{"observed_at":"2026-08-12T00:22:49.806663Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2111.02080","last_updated":"2022-07-21T07:44:13Z","snapshot_observed_at":"2026-08-10T22:45:29.185791Z","submitted_at":"2021-11-03T09:12:33Z","title":"An Explanation of In-context Learning as Implicit Bayesian Inference","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2111.02080","snapshot_observed_at":"2026-08-12T00:22:49.812498Z","title":"An explanation of in-context learning as implicit bayesian inference","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":57,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.812498Z"},"links":{"cited_paper":"/paper/2111.02080","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:56dbe8d778dd535328758d47ed09c79a6b6f643cf355da90b7faa4f6d97dc0d9","observation_id":"fabcc8f9-20fb-44f8-bf08-f210d668cb7c","resolution":{"observed_at":"2026-08-12T00:22:49.812498Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.817510Z","title":"Benchmarking and defending against indirect prompt injection attacks on large language models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":58,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.817510Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:7f8dd4d09b4e6930843083613db257c2cb6fe9f3d4ac97b2c4c00592ceaa55b8","observation_id":"062e3273-9fc6-479b-b782-78e195b40aba","resolution":{"observed_at":"2026-08-12T00:22:49.817510Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.822368Z","title":"I njec A gent: Benchmarking indirect prompt injections in tool-integrated large language model agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":59,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.822368Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:d9b29b1b62453c262ae3c6db396a4181e6dff5877f8032b20982be7e10757353","observation_id":"81dc7557-ccf9-4bdd-a4ff-f3a5204d5ccf","resolution":{"observed_at":"2026-08-12T00:22:49.822368Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.828046Z","title":"Adaptive attacks break defenses against indirect prompt injection attacks on LLM agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":60,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.828046Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:fde51c3660bf68fbe1bfb3ba81b0458c2a1053514c09c60af3088a2bdb61b5b9","observation_id":"06574918-5741-401b-9df0-05fae534f09f","resolution":{"observed_at":"2026-08-12T00:22:49.828046Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.715840Z","title":"Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents","venue":null,"work_id":"b94fe8c5-28a2-48d9-8025-b312fb76c189","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":61,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.834320Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:93ec7ec993bf6e2481b73d330e3efc612db68f1aa49604de708eb194dfb2ce1f","observation_id":"1d1f2b9f-31a1-47ff-a9c4-0d1878712b65","resolution":{"observed_at":"2026-08-12T00:22:50.721180Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.839228Z","title":"S afety B ench: Evaluating the safety of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":62,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.839228Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:be7051bfdf074dd1961ccade61deaaafc2110385d14c522fa492e4ea5fbc59a6","observation_id":"a3b41a47-a730-45b7-a7cf-40bb8f09ad11","resolution":{"observed_at":"2026-08-12T00:22:49.839228Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.844506Z","title":"Xing, Hao Zhang, Joseph E","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":63,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.844506Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:00d076b834915fba9aa7d16e45d2fe6c4bec15a9d62cbc3134b71a006aca6ad5","observation_id":"1462a989-03ce-4f85-97d9-9d494000fb1b","resolution":{"observed_at":"2026-08-12T00:22:49.844506Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:49.849554Z","title":"Poisoning retrieval corpora by injecting adversarial passages","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":64,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.849554Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:806439ae9ea66960834463cb7dbef8d1de78e832ba4b9b59bdb32b0ccc593a84","observation_id":"5c8999f8-653f-426f-80c7-79ea91de4597","resolution":{"observed_at":"2026-08-12T00:22:49.849554Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-12T00:22:49.854619Z","title":"Zico Kolter, and Matt Fredrikson","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":65,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.854619Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:b4efe2a3348aea49d0f2c6385cb308b983ac400e51fa8797bdd3214833bc8aff","observation_id":"82694d33-960d-4e7a-9b63-4501ef836839","resolution":{"observed_at":"2026-08-12T00:22:49.854619Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.01405","last_updated":"2025-03-03T06:14:14Z","snapshot_observed_at":"2026-07-06T16:26:38.284922Z","submitted_at":"2023-10-02T17:59:07Z","title":"Representation Engineering: A Top-Down Approach to AI Transparency","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.01405","snapshot_observed_at":"2026-08-12T00:22:49.859617Z","title":"Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, J","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":66,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.859617Z"},"links":{"cited_paper":"/paper/2310.01405","citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:b94867c53a2efe254eae98eef0dea03459b92822d4844d3ec286028354bee8a8","observation_id":"b92a93f7-de49-400c-bc3c-92b6e4798c5b","resolution":{"observed_at":"2026-08-12T00:22:49.859617Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-12T00:22:50.687927Z","title":"Poisonedrag: knowledge corruption attacks to retrieval-augmented generation of large language models","venue":null,"work_id":"8bda5f75-dea7-4c94-bf60-3df5d3841f99","year":2025},"citing_paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","version":1},"reference_index":67,"source":"arxiv_source","source_observed_at":"2026-08-12T00:22:49.865192Z"},"links":{"citing_paper":"/paper/2608.08212"},"observation_digest":"sha256:3964363b8bd05541cd3078bd8c5d60d84c2bda4d76ab85ea52860d8c36aff4b4","observation_id":"8a726419-49b6-41ea-9824-9c1fbdc9142f","resolution":{"observed_at":"2026-08-12T00:22:50.694801Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2608.08212","last_updated":"2026-08-08T16:13:38Z","latest_version":1,"primary_category":"cs.AI","snapshot_observed_at":"2026-08-13T23:24:39.917256Z","submitted_at":"2026-08-08T16:13:38Z","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment"},"reference_resolution":{"displayed":67,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":48,"verified_exact":0,"verified_fuzzy":19},"total_outbound_references":67},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"thesis":"As of 14 August 2026, this Paper Citation Record lists 67 of 67 outbound references and 0 inbound Pith citation observations for arXiv:2608.08212."}