{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2023:JUXQCDAH6DD6QOU5S5GRAHY5CV","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2ec07f8bc40c9d26f66dc397dafce609b4911c07d8b55a00594e0c5e0e44747c","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-08-07T16:55:20Z","title_canon_sha256":"c5717085b3c9718de16aa4cd67ced5c7a868ded0d8bb8e4113999ea62b24d0ef"},"schema_version":"1.0","source":{"id":"2308.03825","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2308.03825","created_at":"2026-05-17T23:38:14Z"},{"alias_kind":"arxiv_version","alias_value":"2308.03825v2","created_at":"2026-05-17T23:38:14Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2308.03825","created_at":"2026-05-17T23:38:14Z"},{"alias_kind":"pith_short_12","alias_value":"JUXQCDAH6DD6","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_16","alias_value":"JUXQCDAH6DD6QOU5","created_at":"2026-05-18T12:33:37Z"},{"alias_kind":"pith_short_8","alias_value":"JUXQCDAH","created_at":"2026-05-18T12:33:37Z"}],"graph_snapshots":[{"event_id":"sha256:6aef8b1147d54d401a2abff301899531bcc20c05d6ffd888b88f48553a5cdcb8","target":"graph","created_at":"2026-05-17T23:38:14Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":3,"items":[{"attestation":"unclaimed","claim_id":"C1","kind":"strongest_claim","source":"verdict.strongest_claim","status":"machine_extracted","text":"our experiments on six popular LLMs show that their safeguards cannot adequately defend jailbreak prompts in all scenarios. Particularly, we identify five highly effective jailbreak prompts that achieve 0.95 attack success rates on ChatGPT (GPT-3.5) and GPT-4"},{"attestation":"unclaimed","claim_id":"C2","kind":"weakest_assumption","source":"verdict.weakest_assumption","status":"machine_extracted","text":"The 1,405 collected prompts and the 107,250-question set across 13 scenarios are representative enough to support broad conclusions about the inadequacy of safeguards on all LLMs."},{"attestation":"unclaimed","claim_id":"C3","kind":"one_line_summary","source":"verdict.one_line_summary","status":"machine_extracted","text":"Real-world jailbreak prompts collected from the wild achieve up to 0.95 attack success rates against major LLMs including GPT-4, with some persisting for over 240 days."}],"snapshot_sha256":"4baa3b4ed8eb101189a43c0a17875ec17036929bf8888959893376f413598192"},"formal_canon":{"evidence_count":2,"snapshot_sha256":"5b18a39d923688a8b2e5d4e48025090c0b621f21d6f0f60104e3a21c6f0a31e8"},"paper":{"abstract_excerpt":"The misuse of large language models (LLMs) has drawn significant attention from the general public and LLM vendors. One particular type of adversarial prompt, known as jailbreak prompt, has emerged as the main attack vector to bypass the safeguards and elicit harmful content from LLMs. In this paper, employing our new framework JailbreakHub, we conduct a comprehensive analysis of 1,405 jailbreak prompts spanning from December 2022 to December 2023. We identify 131 jailbreak communities and discover unique characteristics of jailbreak prompts and their major attack strategies, such as prompt in","authors_text":"Michael Backes, Xinyue Shen, Yang Zhang, Yun Shen, Zeyuan Chen","cross_cats":["cs.LG"],"headline":"Real-world jailbreak prompts collected from the wild achieve up to 0.95 attack success rates against major LLMs including GPT-4, with some persisting for over 240 days.","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-08-07T16:55:20Z","title":"\"Do Anything Now\": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models"},"references":{"count":98,"internal_anchors":9,"resolved_work":98,"sample":[{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":1,"title":"https: //assets.publishing.service.gov.uk/government/ uploads/system/uploads/attachment_data/file/ 1146542/a_pro-innovation_approach_to_AI_ regulation.pdf","work_id":"502f913d-e96e-4d5c-84b9-631c5717f429","year":null},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":2,"title":"https://www.aiprm.com/","work_id":"bd0c8e0b-3f35-46da-bf1e-8ff70918fa6b","year":null},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":3,"title":"https://huggingface.co/ datasets/fka/awesome-chatgpt-prompts","work_id":"37765adf-2f9e-4180-a3c6-4e8fdd03fd5c","year":null},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":4,"title":"https://chat.openai.com/chat","work_id":"0aa94ec8-2047-4b5c-a599-16735e25fbcf","year":null},{"cited_arxiv_id":"","doi":"","is_internal_anchor":false,"ref_index":5,"title":"https://disboard.org/","work_id":"bb04aafd-7abb-42b4-957f-cb9e3dcf5f05","year":null}],"snapshot_sha256":"971c24f219f515eac5b68e35c04af7e43987f29f97844424a7eb75e4afa1e4bf"},"source":{"id":"2308.03825","kind":"arxiv","version":2},"verdict":{"created_at":"2026-05-17T08:29:12.747903Z","id":"d9b54ae9-1ad6-4d96-aa37-235348d72816","model_set":{"reader":"grok-4.3"},"one_line_summary":"Real-world jailbreak prompts collected from the wild achieve up to 0.95 attack success rates against major LLMs including GPT-4, with some persisting for over 240 days.","pipeline_version":"pith-pipeline@v0.9.0","pith_extraction_headline":"","strongest_claim":"our experiments on six popular LLMs show that their safeguards cannot adequately defend jailbreak prompts in all scenarios. Particularly, we identify five highly effective jailbreak prompts that achieve 0.95 attack success rates on ChatGPT (GPT-3.5) and GPT-4","weakest_assumption":"The 1,405 collected prompts and the 107,250-question set across 13 scenarios are representative enough to support broad conclusions about the inadequacy of safeguards on all LLMs."}},"verdict_id":"d9b54ae9-1ad6-4d96-aa37-235348d72816"}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2bc05165ca37fe9c34a015474e6b17667da8ad75c8e2fa30285eacdf54d101e2","target":"record","created_at":"2026-05-17T23:38:14Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2ec07f8bc40c9d26f66dc397dafce609b4911c07d8b55a00594e0c5e0e44747c","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2023-08-07T16:55:20Z","title_canon_sha256":"c5717085b3c9718de16aa4cd67ced5c7a868ded0d8bb8e4113999ea62b24d0ef"},"schema_version":"1.0","source":{"id":"2308.03825","kind":"arxiv","version":2}},"canonical_sha256":"4d2f010c07f0c7e83a9d974d101f1d15410a4d776d87aa93b28d1d8f8b213c7e","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4d2f010c07f0c7e83a9d974d101f1d15410a4d776d87aa93b28d1d8f8b213c7e","first_computed_at":"2026-05-17T23:38:14.560748Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-17T23:38:14.560748Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"UEwvNRuj/TFjWvstMnwC2Y7NEyRBCpp6SfvmoHmwlCIGCNHVSfIkheYvjUtI8CmfqjZSHatEx6yInQ9iWD3vBg==","signature_status":"signed_v1","signed_at":"2026-05-17T23:38:14.561505Z","signed_message":"canonical_sha256_bytes"},"source_id":"2308.03825","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2bc05165ca37fe9c34a015474e6b17667da8ad75c8e2fa30285eacdf54d101e2","sha256:6aef8b1147d54d401a2abff301899531bcc20c05d6ffd888b88f48553a5cdcb8"],"state_sha256":"f330b6621622ac53d42005d11dbef146a96c43662dc165aaf2f61355271522ea"}